Privacy Policy
Controller: Meritia Technologies Ltd, a private company registered in the Dubai International Financial Centre (DIFC Commercial Licence No. CL14430), registered office GA-00-SZ-L1-RT-164, Level 1, Gate Avenue – South Zone, Dubai International Financial Centre, Dubai, United Arab Emirates, trading as Meritia. Contact: privacy@meritia.io Last updated: 16 October 2026 (map tiles: OpenFreeMap added to the providers in §3) · Version: 1.2
1. What Meritia does
Meritia is a portfolio, tax and compliance platform for cross-border real estate investors. To provide it we process personal data belonging to three groups: investors (account holders), team members/delegates they invite, and — on behalf of investor landlords — tenants. Tenants receive a separate Tenant Privacy Notice; this policy covers investors and delegates.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data (name, email, password hash, language) | Operating your account | Contract |
| Tax profile (residency, nationality, income figures, marital/joint-filing status) | Tax computation, simulations, recommendations | Contract |
| Property, mortgage, rental and transaction data | Portfolio management, tax estimates, benchmarks | Contract |
| [NEW] Short-term rental bookings imported from your connected channel manager (via Calry), which include guest names, stay dates and payment amounts | Income materialisation, STR dashboard | Contract (you act as controller for your guests' data; we process it for you) |
| Notification preferences and consent records | Honouring your choices; Art. 7 accountability | Legal obligation / consent |
| [NEW] Marketplace contact events (which professional you contacted, from which feature) | Referral analytics, professional billing | Consent (see §5) |
| Billing data (via Stripe) | Subscriptions and payments | Contract |
| Audit log (logins, exports, permission changes) | Security, GDPR accountability | Legitimate interest |
We do not sell personal data. We do not use third-party advertising or tracking cookies.
Before you have an account: early-access requests
If you request early access on meritia.io, we store the name, email address and portfolio description you give us, together with the time of the request and the IP address it was sent from (to prevent abuse of the form), so that we can review your request and contact you about it. Legal basis: the steps you ask us to take before entering a contract, and our legitimate interest in managing access to a service in limited release. If we do not approve your request, we delete it 12 months after your last request. You can ask us to delete it sooner at privacy@meritia.io. Approved requests become part of your account record and follow the account retention rule in §7.
3. [NEW] Processors and sub-processors
| Processor | What they process | Where |
|---|---|---|
| Render (hosting, database) | All platform data | EU (Frankfurt) |
| AWS SES (email delivery) | Email address, notification content | EU region configured |
| Stripe (payments) | Billing details | EU/US — Stripe's SCCs apply |
| Calry (channel-manager connectivity) | STR bookings incl. guest personal data for properties you connect | Per Calry's DPA — sub-processor for your guest data |
| Google (Places API) | We receive business listing data from Google; when you open a professional's Maps link, Google processes your visit under its own policy | US — SCCs |
| OpenFreeMap (map tiles, delivered through Cloudflare) | When you open the Map view of the investment analyzer, your browser loads the map from OpenFreeMap: they receive your IP address and which part of the map you view. No Meritia account data is sent; OpenFreeMap handles these requests under its own terms | Worldwide content-delivery network (Cloudflare) — SCCs where applicable |
International transfers outside the EEA (Stripe, Google, OpenFreeMap/Cloudflare, and email routing) rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
4. [NEW] Team access and delegates
When you invite a team member (property manager, tax advisor, accountant), they see the data your grant covers — specific properties, jurisdictions, or your whole portfolio, per the permission you configure. Financial amounts in notifications are sent only to you unless the delegate's grant includes financial visibility. You can revoke access at any time in Settings → Team.
5. [NEW] Professional referrals (marketplace)
When you actively choose to contact a professional through the marketplace,
we (a) show you their contact details, (b) record the contact event including
which feature triggered it, and (c) may share your name and contact details
with that professional so they can respond. This never happens automatically
— only for professionals you contact. The first contact records your
professional_referral consent, revocable in Settings → Privacy (revoking
stops future sharing; it does not un-share past contacts).
Local service listings shown in the marketplace are sourced from Google and displayed with attribution; those businesses' details are processed under our legitimate interest in operating a directory of publicly listed businesses.
6. [UPDATED] Automated processing
Tax estimates, simulations, risk scores and investment recommendations are computed automatically from your data and current law. They are advisory outputs, not decisions producing legal effects — no Article 22 automated decision-making takes place. Regulatory intelligence is classified with the assistance of AI models; those pipelines process legislation text, not your personal data.
7. [NEW] Retention
| Data | Retention |
|---|---|
| Account & portfolio data | Life of the account; deleted with account deletion |
| Consent & audit records | 6 years after account closure (accountability) |
| Marketplace contact events | 3 years, then anonymised to aggregates |
| Notification rows | 24 months |
| Data-export bundles | 30 days after generation |
| Email delivery logs | 12 months |
| Early-access requests that were not approved | 12 months after the last request, then deleted |
8. Your rights
Access, rectification, erasure, restriction, portability and objection — exercisable in-app: Settings → Privacy provides one-click data export (Art. 15/20), rectification requests (Art. 16), the audit log of processing events on your account, and account deletion. Complaints: the DIFC Commissioner of Data Protection (the supervisory authority for Meritia Technologies Ltd), or the data protection authority of the country where you live.
9. Changes
Material changes bump the version and require re-acceptance in-app before continued use. The version history is retained in your consent records.