Legal

Privacy Policy

Effective date: 17 October 2026

1. Introduction

This Privacy Policy explains how Nestafar Technologies Private Limited (CIN: U79110KA2024PTC190444), the operator of the Meridian platform ("Nestafar", "Meridian", "we", "us"), collects, uses, and shares information when you use the Meridian platform, websites, and related services (the "Service"). It applies to visitors, account holders, and members of organizations that use Meridian. By using the Service, you agree to the practices described here.

2. Information we collect

We collect the following categories of information:

  • Account information — name, email address, organization, and authentication details you provide when you register or sign in (including via Google sign-in).
  • Venture and product data — the content you create or upload, including ventures, market signals, features, personas, project plans, and any repositories or boards you connect.
  • Usage and analytics data — pages viewed, actions taken, device and browser type, and approximate location, collected through the analytics tools described in Section 3.
  • Billing data — plan, credit balance, and transaction records; payment card details are handled by our payment processors, not stored by us.
  • Communications — messages you send us, such as support requests.

3. Analytics

We use the analytics tools below on our websites and in the Service to understand how they are used, diagnose issues, measure feature adoption and sign-up and purchase conversion, and prioritize improvements.

  • PostHog — product analytics and session insights. PostHog may collect usage events, device and browser information, and session recordings. We configure it to identify profiles only for signed-in users.
  • Google Analytics 4 (Google LLC) — measures pages and screens viewed and key actions such as signing up, signing in, creating a project, reaching milestones in the product (for example deploying an app or connecting an integration), viewing plans, starting, abandoning or completing a checkout (plan, amount and a payment reference), errors you run into (such as a failed sign-in, sign-up or payment, recorded as a short error code), and how far visitors get in the onboarding chat with Astra before signing up, measured with a random identifier for each chat session (never the content of the chat). For signed-in users we send an internal account identifier — not your name or email address — so that your activity can be measured consistently across devices and sessions, together with general account attributes such as your plan, workspace type, team role, sign-up method and referral channel. Google also derives device, browser and approximate location information. Learn how Google uses this data at policies.google.com/technologies/partner-sites.
  • Microsoft Clarity (Microsoft Corporation) — heatmaps and session replays showing how pages are used, such as clicks, scrolling and navigation, together with device and browser information. See the Microsoft Privacy Statement.

We limit what we send to these tools. Web addresses are stripped of query strings, and links that carry security tokens (such as password-reset, invitation and share links) are reported without those tokens. We do not send your name, email address, or the content of your chats, ventures or uploads to Google Analytics. You can limit collection by blocking or deleting cookies in your browser, with the Google Analytics opt-out browser add-on, or with similar tracker-blocking tools.

4. How we use information

We use the information we collect to:

  • provide, operate, and secure the Service, and run Astra and the value engine on your behalf;
  • authenticate users, process credits and billing, and provide support;
  • analyze usage and improve the performance, reliability, and design of the Service;
  • send service-related and, where permitted, product communications; and
  • comply with legal obligations and enforce our terms.

We use your venture and product data to deliver the Service to you. We do not use it to train shared models for other customers.

5. Cookies and sessions

We and our providers use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and collect analytics. Analytics cookies include those set by Google Analytics (such as _ga and _ga_*) and Microsoft Clarity (such as _clck and _clsk), which help these tools recognise a returning browser. Where consent is required (for example in the European Economic Area, the United Kingdom and Switzerland), analytics and advertising cookies stay off until you accept them in our cookie banner; until then Google Analytics receives only cookieless signals without identifiers. You can change your choice at any time in Cookie settings. You can also control cookies through your browser settings; disabling some cookies may affect functionality such as staying logged in.

6. Third parties and integrations

We share information with service providers who process it on our behalf — including cloud hosting, AI model providers, analytics (PostHog, Google Analytics and Microsoft Clarity), email delivery, and payment processors — under contracts that require them to protect it. When you connect a third-party integration such as GitHub or Jira, data flows according to the permissions you grant. We may also disclose information to comply with law, enforce our terms, or protect rights and safety. We do not sell your personal information.

7. Data retention

We retain personal and product data for as long as your account is active and as needed to provide the Service, then for a reasonable period to comply with legal, accounting, and dispute-resolution obligations. When data is no longer needed, we delete or anonymize it. You can request deletion of your data as described below.

8. Your rights

Depending on your location, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing or withdraw consent. You can exercise these rights, or ask us a privacy question, by emailing [email protected]. We will respond within the timeframes required by applicable law.

9. Security

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and scoping of data to your organization. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Children

The Service is not directed to children, and we do not knowingly collect personal information from children under the age required by applicable law (for example, 13 or 16 depending on jurisdiction). If you believe a child has provided us personal information, contact us and we will delete it.

11. International transfers

We operate globally and may process and store information in countries other than your own, including where our providers are located. Where required, we use appropriate safeguards — such as standard contractual clauses — for cross-border transfers of personal data.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, for example by posting the updated policy with a new effective date or by notifying you in the Service. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions about privacy or this policy? Contact us at:

Nestafar Technologies Private Limited (CIN: U79110KA2024PTC190444)
2nd Floor, 235 Binnamangala, ProWorks, 13th Cross Road, Indiranagar, Bengaluru — 560038, Karnataka, India
Email: [email protected]

LinkedIn X [email protected]