Privacy Policy

Effective October 11, 2026. This policy covers usemeritai.com, the Merit AC dashboard, and the products sold on this site. Merit AC is operated by Clark X Group LLC ("we", "us"). We do not sell personal information.

What we collect, and why

Forms you fill in

Waitlists, the contact form, demo requests and similar forms collect your email address and, where the form asks, your name, company, a short note, and which form you used. We use it to reply to you, or to tell you when the thing you signed up for is available.

Dashboard accounts

To sign in to the dashboard we store your name, email address and the organization you belong to. If you use a password, we store only a one-way hash of it (bcrypt), never the password itself. If you sign in with Google, we receive your Google account identifier and email address from Google.

Data a customer sends into Merit AC

A company using the Merit spend tracker sends us records about its own staff so we can attribute AI spend: each person's name, work email, team, role and seat tier; the account identifiers that connect them to AI tools (for example an API key ID or a GitHub username); and AI usage metadata -- which tool and model, token counts, cost and time. It can also send work outcomes and quality signals (for example a merged pull request or a reverted change). We do not ask for, and the product does not store, the content of prompts or AI responses. We process this data on the customer's behalf and under its instructions; the customer decides what it sends and is responsible for telling its own staff.

The site assistant

If you ask the assistant on this site a question, the question is sent to Anthropic, along with excerpts from this site's own pages, to generate an answer. We do not save your question.

Purchases

Checkout runs on Stripe. Stripe collects your payment details; we never see or store your card number. We receive what Stripe shares with sellers -- typically your name, email, billing country or address, any tax ID you choose to enter, what you bought, and the amount -- and anything a checkout form asks for, such as a repository link for a build review. We use it to deliver what you bought and to keep tax and accounting records.

Technical data

Your IP address is used, in memory only, to rate-limit sign-in, sign-up, form and assistant requests; we don't write it to our database. Our hosting providers keep their own short-term request logs. The site loads fonts from Google Fonts, so Google receives your IP address when a page loads, and our host Cloudflare may run its own security and bot-protection checks.

Stored in your browser

We use your browser's local storage, not advertising or analytics cookies, for three things: your light/dark theme choice, your dashboard sign-in token, and which days you've checked off on the prompt archive. Clearing your browser storage removes them. We don't use advertising trackers or third-party analytics.

Who we share it with

Only the service providers that run this site and its products, for that purpose:

• Cloudflare -- hosts the website.
• Fly.io -- hosts our servers and database, in the United States.
• Stripe -- processes payments. For some products Stripe acts as the reseller (merchant of record) and handles the sale and sales tax under its own terms and privacy policy.
• Google -- Google sign-in (if you choose it) and web fonts.
• Anthropic -- answers questions sent to the site assistant.
• Our email provider -- sends the emails you asked for.

We may also disclose information if the law requires it, or to protect our rights or someone's safety. If the business is sold or merged, information may transfer to the new owner under this policy.

How long we keep it

• Form submissions: until you ask us to delete them, or we no longer need them.
• Dashboard accounts: while the account exists.
• A customer's data: for as long as the customer uses the service, then deleted on request, unless we're legally required to keep it.
• Purchase records: as long as tax and accounting law requires.

Your choices

You can ask us what we hold about you, and ask us to correct or delete it, through the contact form. We'll answer within 30 days. If your data reached us because your employer uses Merit AC, we'll pass your request to them, since they control that data. Depending on where you live (for example the EU, UK or California) you may have further rights under local law, including to complain to a regulator; we honor these requests wherever you are.

Security

Traffic is encrypted in transit (HTTPS), passwords are stored only as hashes, and each customer organization's data is kept separate from every other's. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.

Where it's processed

We and our providers process data in the United States. If you're outside the US, your information is transferred there.

Children

This site and its products are not meant for anyone under 16, and we don't knowingly collect their information.

Changes

If we change this policy we'll update the date at the top, and for a significant change we'll say so on this page.

Contact

Questions or requests: contact us. See also our terms.