Meridian
Book a Demo →

Privacy Policy

Last updated · 1 January 2026

Version History and Document Control

  • Version 1.0 (11 September 2026): Original Meridian Privacy Policy Addendum, supplementing the Netbay Group Privacy Policy.
  • Version 1.1 (15 September 2026): Split the lawful-basis table to separate transactional and marketing communications to Authorized Users (POPIA Section 69); removed an unrelated reference to another Netbay product.
  • Version 1.2 (15 September 2026): Tightened the Grace Period cross-reference to cite the Meridian Master Services Agreement directly.
  • Version 2.0 (15 September 2026): Converted to a fully standalone policy, since Meridian is served from its own dedicated website separate from netbay.co.za. Named Meridian's actual infrastructure sub-processors (Supabase, Vercel, PayFast, Stripe, Resend) in place of generic categories. Replaced placeholder retention figures with the confirmed billing-lifecycle figures: 14-day trial and 90-day post-cancellation data retention. Added a dedicated Security Measures section reflecting Meridian's actual technical controls. Added support@meridian-crm.co.za as the operational contact channel.

1. Responsible Party and Operator Roles

1.1. Netbay (Pty) Ltd (Registration Number: 2019/505218/07), trading as Meridian (“Netbay”, “we”, “us”), is the Responsible Party for account, billing, and product-usage data collected directly from Meridian subscribers (“Account Data”).

1.2. Netbay acts as an Operator, not a Responsible Party, in relation to “End Customer Data” — the contact records, deal records, and notes that a subscriber's business enters into Meridian about its own customers or leads. Processing of End Customer Data is carried out solely on the subscriber's instructions and is governed in full by the Meridian Data Processing Agreement (POPIA Section 21 Operator Agreement).

2. Data We Collect and Lawful Basis

  • Account Identifiers — subscriber sign-up, identity verification, licence-seat assignment. Lawful basis: Contractual Necessity.
  • Billing/Financial — ZAR (or USD, where paid via Stripe) subscription billing and tax compliance. Lawful basis: Legal Obligation.
  • Admin/Owner Contact Data — transactional — billing reminders, payment-failure and deletion-warning notices, service notices sent to Authorized Users. Lawful basis: Contractual Necessity.
  • Admin/Owner Contact Data — marketing — newsletters or other promotional communications sent to Authorized Users. Lawful basis: Explicit Consent (Opt-in) under POPIA Section 69, with an unsubscribe option in every communication.
  • End Customer Data (contacts, deals, notes) — processed as Operator on the subscriber's instruction, per the Meridian Data Processing Agreement. Lawful basis: the subscriber's own lawful basis; Netbay processes under written mandate.
  • Product Usage Data — in-app analytics, automated security testing, and CI monitoring for reliability and product improvement. Lawful basis: Legitimate Interest (subject to LIA).

Meridian does not collect GPS/location data or public social content.

3. Third-Party Operators

Meridian is built on named, certified infrastructure providers, each bound by a Data Processing Agreement:

  • Supabase — database, authentication, and file storage. SOC 2 Type II certified; PostgreSQL with Row-Level Security; data encrypted at rest and in transit.
  • Vercel — application hosting and content delivery. SOC 2 certified; global edge network; automatic TLS; DDoS protection.
  • PayFast — primary payment processing (South Africa). PCI-DSS compliant; Meridian never sees or stores card data.
  • Stripe — optional payment processing for international subscribers. Used only where a subscriber is billed outside South Africa.
  • Resend — transactional email (billing warnings, invitations, export notifications). Authenticated sending (SPF, DKIM, DMARC).

Meridian never stores card numbers or handles raw payment data directly — this remains with the PCI-DSS compliant payment provider at all times.

We may update our list of third-party sub-processors from time to time as our infrastructure evolves. Any changes or additions to sub-processors will be reflected by updating this Policy on our website at least 30 days prior to the new sub-processor processing any End Customer Data. Your continued use of Meridian after such updates constitutes acceptance of the modified sub-processor roster.

4. International Transfers

4.1. Supabase, Vercel, Stripe, and Resend are providers domiciled outside South Africa. Transfers to these providers are protected by Standard Contractual Clauses or Data Processing Agreements consistent with Section 72 of POPIA. PayFast, as our primary payment processor, is a South African provider.

5. Security Measures

  • Row-Level Security enforced on every database table, ensuring tenant isolation so subscribers can only ever access their own organisation's data.
  • A single active session per licensed seat, preventing credential sharing.
  • 150+ hardened, injection-resistant database functions handling business logic server-side, not in the browser.
  • An immutable audit log: every change is recorded and cannot be altered.
  • Encryption in transit (TLS/HTTPS) and at rest (database and backups), with automated backups and point-in-time recovery.
  • Secrets and service keys are never exposed to the browser; card data is never handled or stored by Meridian.
  • An automated security test suite — covering tenant isolation, privilege escalation, injection, mass-assignment, and anonymous-access scenarios — runs on every deployment, alongside a passive security scan.

6. Retention

6.1. Account Data is retained for the duration of the subscription plus 12 months thereafter.

6.2. End Customer Data is retained for the duration of the subscription. On cancellation or a payment failure, an account moves through the following states: past_due (recoverable by payment) → deactivated (with staged deletion-warning emails sent 30, 7, and 1 day before deletion) → permanently deleted (“scrapped”) after a total of 90 days from deactivation. This 90-day window is the Grace Period referred to in the Meridian Master Services Agreement, during which Netbay does not access, view, or otherwise use End Customer Data other than to restore access if the subscriber reactivates.

6.3. Subscribers are solely responsible for exporting any data they wish to retain before the 90-day window expires.

7. Your Rights

7.1. You may exercise your rights under POPIA (access, correction, deletion, objection, and withdrawal of consent) by contacting support@meridian-crm.co.za for routine requests, or admin@netbay.co.za for formal requests directed to the Information Officer. We provide a substantive response within 30 calendar days. Unresolved matters may be escalated to the Information Regulator (POPIAComplaints@inforegulator.org.za).

8. Children

8.1. Meridian is intended for business use by individuals 18 years and older. We do not knowingly collect personal information from minors.

9. Changes to This Policy

9.1. We may update this Policy from time to time. The version and date at the top of this document reflect the version currently in force.

10. Contact

  • Full Name: Netbay (Pty) Ltd, trading as Meridian
  • Registration Number: 2019/505218/07
  • Information Officer: Prenasen Iyer
  • Physical Address: Mondeor, Johannesburg, 2091
  • Statutory/Legal Contact: admin@netbay.co.za
  • Product Support: support@meridian-crm.co.za