Privacy Policy

This Privacy Policy explains how SD Wares (“we”, “us” or “our”) collects, uses, shares and protects information in connection with Meridian, including the portal at https://app.sdwares.com and the API at https://api.sdwares.com (the “Service”). It applies together with our Terms of Service; capitalized terms not defined here have the meaning given there.

1. Our role

Account information. For information about the people who use the portal (for example their names, email addresses and activity), we decide how and why it is processed, and this policy describes our practices.

Customer Content. The prompts, messages and other inputs our customers send through the API, and the model responses, belong to our customers. We process Customer Content on behalf of the customer organization, as its service provider, to provide the Service. If your personal information is contained in content a customer sent through Meridian, please contact that customer; we will assist them with your request.

2. Information we collect

Information you give us or that comes from your sign-in

• Sign-in. You sign in with Google, or with a one-time code we send to your email address. With Google, Google tells us your verified email address and, if available, your name; we do not receive or store your Google password. With an email code, we store the code only as a keyed hash for up to 10 minutes; we do not use passwords.
• Access requests. When you request access: your email address (confirmed with Google or with a one-time code we send to it), your name if Google provides it, your company or project name, and the description of your intended use.
• Organization information. Names of organizations and projects; members and their roles; email addresses of people you invite; budgets, feature settings and PII redaction settings.
• Credentials. API keys we issue are stored only as one-way (SHA-256) hashes; the full key is shown to you once. Provider keys you add are encrypted with a key held in Microsoft Azure Key Vault; the portal shows only their last characters.
• Communications. Messages you send us, such as support requests.

Information collected when you use the Service

• Request metadata. For each API request: time, project and API key identifiers, the requested and the serving model and provider, token counts, calculated cost, latency, status and error type, whether a cache or fallback was used, whose provider key paid for it, and — if PII redaction is enabled — the types and counts of personal data detected (never the detected values).
• Session and security information. IP address and browser user agent of each portal session, sign-in and activity times, and an audit log of changes made in the portal (who, what and when, including the IP address).
• Server logs. Our servers record technical logs of requests, including IP addresses, request paths, response codes and timings. Logs do not contain prompts or responses.
• Browser storage. A strictly necessary session cookie keeps you signed in; your browser’s local storage remembers interface preferences such as the selected project. We do not use advertising or analytics cookies. Google sets its own cookies when you use Google sign-in, and our pages load fonts from Google Fonts, which receives your IP address when the fonts are fetched.

Customer Content

• Customer Content passes through Meridian to the selected Model Provider and back. We do not store prompts or responses in our database or in our logs.
• Response cache. To answer repeated identical requests, the Service keeps model responses in a cache for up to 24 hours, keyed by a hash of the request and separated by project. Each project can turn the response cache off. When PII redaction is enabled, cached responses contain placeholders instead of the detected personal data.
• Semantic cache. If you turn it on for a project, the Service also sends the request text to OpenAI to compute a numerical representation (embedding), and stores it together with the response for up to 24 hours, to answer similar requests. It is off by default.
• PII redaction. If you enable it, the Service detects and masks or replaces certain personal data before it reaches a Model Provider, the cache or our monitoring tools.

3. How we use information

• to provide the Service: authenticate users, route requests to Model Providers, return responses and cache them where enabled;
• to calculate costs, enforce budgets, rate limits and the trial credit, and show usage in the portal;
• to review access requests and send service emails, such as invitations, access decisions and important notices;
• to secure the Service: detect and prevent abuse, fraud and unauthorized access, investigate incidents and keep audit records;
• to provide support, including our access to your organization in the portal, which is recorded in its audit log;
• to monitor, troubleshoot and improve the Service, using request metadata and aggregated statistics;
• to comply with law, enforce our Terms and protect our rights and the rights of others.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use Customer Content to train machine-learning models. We will not send marketing emails without your consent.

4. How we share information

We share information with the service providers that help us run Meridian, under contracts or terms that limit their use of it to providing their services:

When a request is sent with your own provider key, the Model Provider processes it under your agreement with that provider. When it is sent with our keys, it is processed under our agreement. In both cases the Model Provider’s handling of data is governed by its own terms and privacy policy, which we encourage you to review.

We may also share information:

• within your organization: members can see the organization’s projects, members, usage and audit log according to their role;
• for legal reasons: if we believe in good faith that disclosure is required by law, subpoena or court order, or necessary to protect the rights, property or safety of Meridian, our users or others;
• in a business transfer: as part of a merger, acquisition, financing or sale of assets, subject to this policy’s protections;
• with your consent or at your direction.

5. Security

We use measures designed to protect information, including encryption in transit (TLS), encryption of provider keys with a key held in a managed key vault (Microsoft Azure Key Vault), hashing of API keys, secure session cookies with cross-site request forgery protection, role-based access within organizations, audit logging, and restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as required by law.

6. Retention

• Account, organization and credential information: while your organization exists.
• Organizations not used for 30 consecutive days may be deleted with their data (Terms, section 14).
• Request metadata and audit logs: while your organization exists, because they support usage reporting, budgets, security investigations and future billing.
• Cached responses: up to 24 hours.
• Portal sessions: a session ends after 12 hours without activity or 7 days at most; ended sessions are deleted.
• Server logs in Microsoft Azure: 30 days. Monitoring data at New Relic and Langfuse: their standard retention periods.
• Access requests: until we review them and for as long as needed to manage access.
• Database backups: up to 90 days.

When an organization is deleted, or on a verified request, we delete the related information within 30 days, except where we must keep it to comply with law, resolve disputes or enforce our agreements, and except for backups, which expire on the schedule above.

7. Your choices and rights

• Organization owners can manage members, revoke API keys, remove provider keys, turn off the response cache and enable PII redaction in the portal.
• You can ask us to access, correct, export or delete your personal information by writing to support@sdwares.com.
• You can stop receiving non-essential emails at any time; service emails are part of using the Service.

8. US state privacy rights

Depending on where you live, laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and the consumer privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states, may give you rights regarding your personal information, to the extent those laws apply to us. These may include the right to:

• know or access the personal information we collect about you, and receive a portable copy;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, or of targeted advertising and certain profiling — we do not sell or share personal information or engage in targeted advertising or such profiling;
• limit the use of sensitive personal information — we use it only to provide the Service;
• not be discriminated against for exercising these rights.

To make a request, email support@sdwares.com. We will verify your request by confirming the email address associated with your account, and respond within the time the law requires (45 days under the CCPA, which may be extended once). An authorized agent may submit a request with proof of your authorization. If we decline your request, you may appeal by replying to our decision; if we deny the appeal, you may contact your state attorney general. Because we do not sell or share personal information, we treat Global Privacy Control signals as requests already satisfied.

Nevada residents may ask us not to sell their covered information by writing to support@sdwares.com. We do not sell covered information as defined by Nevada law.

Categories of personal information (last 12 months)

We collect these categories for the purposes in section 3 and keep them for the periods in section 6. We have not sold or shared (for cross-context behavioral advertising) personal information in the last 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

9. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 as defined by the Children’s Online Privacy Protection Act. If you believe a child has provided us personal information, contact us and we will delete it.

10. Where information is processed

We are based in the United States, and the Service is hosted in Microsoft Azure’s United States regions. Our database, cache and other service providers may process information in other countries. By using the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those of your country.

11. Do Not Track

There is no common industry standard for Do Not Track browser signals, so we do not respond to them. We do not track you across third-party websites.

12. Changes to this policy

We may update this policy at any time. We will post the new version on this page with a new effective date, and we may also tell the owners of your organization by email or in the portal.

Contact

Email: support@sdwares.com.