Privacy Policy

Overview

Meandr, Inc., a Delaware corporation with principal place of business at 169 Madison Ave, STE 66267, New York, NY 10016, United States (“Meandr,” “us,” or “we”), provides infrastructure software that enables organizations to securely manage interactions between AI agents and software tools, including external services and internal systems. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices available to you.

This Privacy Policy applies to our website at meandr.com, our application dashboard at console.meandr.com, our gateway endpoints at *.meandr.io, and any related subdomains (collectively, the “Site”). It also applies to the Service offered by Meandr through the Site (the “Service”).

By using or accessing the Site, you accept the practices described in this Privacy Policy, our Terms of Use, and all other policies or notices posted by us on the Site.

Data We Collect

Where possible you may have the option of interacting with us anonymously (for example, when browsing the Site as a casual visitor). We will usually make it clear whenever this is an option.

Personal data we may collect includes:

  • Account data: name, email, organization or company information, role, and other information you provide when you create an account or fill out a form on the Site. If You sign in with Google, we receive Your name, email address and Google account identifier;
  • Billing data: information you provide when subscribing to a plan. Payment card data is handled directly by our third-party payment processor and is not stored by Meandr;
  • Communications: comments, support tickets, or other information you provide when you contact us;
  • Usage and technical data automatically collected from your computer or device, such as device identifier, IP address, browser type, internet service provider, referring/exit pages, operating system, date/time stamp, and clickstream data;
  • Location information derived from your device or network, where permitted by law;
  • Interaction information when you interact with our content on the Site or on third-party sites or platforms.

Our community forum at community.meandr.com has its own accounts and posts. It records visitors’ IP addresses to limit and block abuse, and sends email through our email provider.

Customer Data

Customer Data consists of the information and configuration submitted by customers through the Service, including:

  • Workspace configuration (servers, tools, agents, policies);
  • Connection details for upstream services;
  • Credentials provided by the customer for the Service to access upstream services on the customer’s behalf (stored encrypted at rest);
  • Operational metadata of tool calls processed through the Service (described below);
  • Tool call payloads (described below);
  • For servers hosted by Meandr: their settings, including any secrets You provide (stored encrypted at rest), and the resource use of the instances they run on (described below).

What we log per tool call (operational metadata only):

  • Timestamp of the call
  • Latency / duration
  • Status code (success or error class)
  • Byte counts (request / response, client and upstream)
  • Policy decision (allow / deny / approval-required / rate-limited)
  • Token counts where reported by the upstream
  • The caller’s IP address
  • The agent, server, tool and policy involved
  • The region that served the call
  • For approvals: who decided, their comment, and when

Tool call payloads: Meandr stores the request body of each tool call processed through the Service, including calls Your policies deny or hold for approval. Storing response bodies is optional and is enabled by You per policy rule. Stored payloads are encrypted at rest, kept for the retention window of Your plan, as published at meandr.com/pricing, and then deleted; they are decrypted only for authorized users of Your account, in the console or in exports they request; export files are kept for about a day. Answers You give to a server’s questions are stored encrypted, like payloads; approval decisions are stored with the call, including who decided and any comment.

We never log in cleartext:

  • Tool call payloads
  • Credentials or secrets inside a payload are stored with it, encrypted, and are never logged in cleartext
  • Upstream credentials provided by You — these are stored encrypted at rest (see “Security” below)

Hosted servers: when Meandr runs an MCP server for You, that server processes data on its own instance, under Your control. Meandr does not collect what it processes. Its logs stay on the instance, are read only when You view them or when Meandr investigates abuse, and are deleted with the instance. To detect abuse, Meandr monitors the instance’s resource use (processor, memory, disk, and network volume) and network metadata (connections and DNS lookups), never the content of its traffic.

Except as required to operate the Service, Meandr does not access Customer Data.

No AI training. Unless explicitly agreed with a customer, Meandr does not use Customer Data or tool call payloads to train machine learning or artificial intelligence models, whether ours or those of third parties.

Customers remain responsible for the legality of the data they submit through the Service and for ensuring they have all rights necessary to submit such data to and process such data through the Service.

How We Use Data

We use the data we collect to:

  • Provide, maintain and improve the Site and the Service;
  • Operate the gateway functionality, including routing tool calls, enforcing customer policies and rate limits, managing customer-provided credentials, and producing operational metadata;
  • Run the servers You host with Meandr, and monitor their resource use and network activity to keep the Service and others safe;
  • Diagnose and fix technical issues;
  • Detect, investigate, and prevent activity that may violate our policies or applicable law;
  • Analyze trends and usage patterns to improve the Service;
  • Bill for use of the Service in accordance with the applicable subscription plan;
  • Deliver customer support and respond to inquiries;
  • Communicate with you, including newsletters, product updates, security advisories, and offers (see “Your Rights” below for opt-out options);
  • As otherwise described to you at the time of collection or as authorized or required by applicable law.

Legal Bases for Processing

We process personal data on the legal bases described in applicable law, including:

  • Performance of a contract — to provide the Service you have subscribed to;
  • Compliance with legal obligations — including tax, fraud prevention, and lawful information requests;
  • Our legitimate interests — including security, abuse detection, service improvement, and protection of our rights and the rights of our users;
  • Your consent, where required by applicable law.

Sharing

Meandr does not sell, trade, share, or transfer your personal data to third parties except in the following limited circumstances:

  • We may share personal data with third-party service providers who help us operate the Site and the Service (including hosting, payment processing, customer support, and analytics). These providers are authorized to use personal data only as necessary to provide services to us, and are bound by appropriate confidentiality and data protection obligations. Meandr uses these service providers to operate the Service: Amazon Web Services (hosting and storage), Stripe (payments, as merchant of record), Postmark (email), Sentry (error tracking in the dashboard), Google (sign-in, when You choose it), and WP Engine (website hosting);
    Stripe — payment processor and merchant of record. All billing, subscription management, and payment processing for the Service is handled by Stripe, Inc. (“Stripe”), our payment processor and merchant of record. Meandr does not collect, store, or process Your full payment-card details; payment data is provided directly to Stripe and is handled under Stripe’s terms and privacy policy (available at https://stripe.com/legal). Meandr receives only the billing metadata necessary to operate Your subscription (e.g., subscription status, plan tier, billing-period totals).
  • We may share personal data with our affiliates, who may use it consistent with this Privacy Policy;
  • We may share personal data when we have a good-faith belief that disclosure is reasonably necessary to: (a) comply with applicable law, regulation, legal process, or enforceable governmental request; (b) enforce our Terms of Use or investigate violations; or (c) protect against imminent harm to the rights, property, or safety of Meandr, its users, or the public;
  • We may share personal data to detect, prevent, or address fraud, security, or technical issues;
  • As described in “Changes of Control” below, we may share personal data if we become involved in a merger, acquisition, bankruptcy, or sale of some or all of our assets; and
  • We may share personal data with a third party if we have your consent to do so.

We may also share aggregated or non-personally identifiable information with third parties for other purposes.

Upstream services. When a customer configures the Service to connect to a third-party MCP server (an “upstream service”), the Service relays the customer’s tool call requests to that upstream service on the customer’s behalf using the credentials the customer provides. The upstream service operates independently of Meandr; its handling of any data sent through it is governed by its own terms and privacy policy. Meandr is not responsible for the practices of upstream services.

International Transfers

Meandr is a United States entity (Meandr, Inc., a Delaware corporation). Personal data collected through the Service is processed by Meandr in the United States. Where Your access to the Service originates outside the United States — including from edge points and end users located in the European Economic Area, the United Kingdom, Switzerland, or elsewhere — personal data is transferred across international borders to Meandr’s U.S. infrastructure.

Some data may first be received and briefly processed at a regional location closer to where Your traffic originates (for example, within the European Economic Area). Any such regional copies are transient — typically retained for only a few days, and no longer than approximately one week — after which the data is moved in the background to, and permanently stored on, Meandr’s primary infrastructure in the United States. Meandr does not maintain a permanent regional data store outside the United States.

Servers hosted by Meandr run in the region You select, which may be outside the United States, and the data they process stays on their instance there for the life of that instance. Their settings, resource metrics, and the operational metadata of their tool calls are stored on Meandr’s primary infrastructure in the United States.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards, including the Standard Contractual Clauses (“SCCs”) approved by the European Commission (Commission Implementing Decision (EU) 2021/914) and equivalent mechanisms recognized by the United Kingdom and Switzerland, as applicable, to maintain full compliance with the General Data Protection Regulation (GDPR) and related international data-transfer requirements.

By using the Site or otherwise providing personal data to us, you acknowledge and consent to the transfer of Your personal data to the United States and to any other country in which Meandr or its service providers maintain facilities, subject to the safeguards described above.

Security

We take reasonable measures to protect personal data and Customer Data:

  • Encryption in transit using TLS 1.2 or higher for all connections to the Site, the dashboard, the gateway endpoints, and our APIs;
  • Encryption at rest for credentials, audit metadata, and stored tool call payloads;
  • Access controls limiting employee access to personal data and Customer Data to those who need it to perform their roles;
  • Continuous monitoring and periodic security reviews.

No method of transmission over the Internet or method of electronic storage is one hundred percent secure. We cannot guarantee absolute security.

We ask that you not send us, and you not disclose, any sensitive personal data (such as information related to racial or ethnic origin, religion or other beliefs, health, criminal background, or trade union membership) on or through the Site or otherwise. If, contrary to this request, you do provide any sensitive information, in doing so you consent to us collecting and handling that information in accordance with this Privacy Policy.

Retention

We retain personal data and Customer Data for the period necessary to support the Site and the Service, comply with our legal obligations, resolve disputes, or otherwise fulfill the purposes outlined in this Privacy Policy.

Operational data (audit metadata, configuration history, metrics) and stored tool call payloads are retained for the retention window of Your plan, as published at meandr.com/pricing.

Even after you cancel your account, copies of some information may remain in backup or archive systems for a period, and may be retained for fraud detection, to comply with applicable law, or to comply with our internal security policies.

Customer-provided credentials for upstream services are deleted together with their configuration and remain in backups for up to 35 days.

Your Rights

Depending on where you live, you may have additional rights under applicable privacy laws, including the European Union’s General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act and California Privacy Rights Act (“CCPA/CPRA”), and similar state laws in the United States.

These rights may include:

  • Access — to request a copy of the personal data we hold about you;
  • Rectification — to request correction of inaccurate or incomplete data;
  • Erasure — to request deletion of your personal data, subject to certain legal exceptions;
  • Portability — to receive your personal data in a structured, commonly used, machine-readable format;
  • Objection — to object to certain processing, including direct marketing;
  • Opt-Out of Sale or Sharing — to opt out of any “sale” or “sharing” of personal data as defined under applicable law (we do not sell personal data in the conventional sense);
  • Non-discrimination — we will not deny you services, charge different prices, or provide a different level of service because you exercised any of these rights.

Personal data that passes through a customer’s tools is processed on that customer’s behalf; requests about it go to the customer. Tool call records and payloads cannot be deleted one at a time: they are deleted when their retention window ends or when the account is deleted.

To exercise any of these rights, contact us at privacy@meandr.com. We may need to verify your identity. We will respond within thirty (30) days, or such longer period as permitted by applicable law.

Account holders can access and update most of their personal data directly through the dashboard.

Cookies and Tracking Technologies

The Site uses cookies and similar technologies (pixel tags, web beacons, HTML5 local storage) for purposes including authentication, preferences, analytics, and security. You can remove or block cookies using your browser settings, but parts of the Site may cease to function properly if you do so.

If you no longer wish to receive our newsletter or promotional communications, you may opt out by following the instructions in such communications or in the dashboard. You may not have the option to opt out of certain service-related communications (such as billing notifications, security advisories, or material policy changes).

Children Under Age 13

The Site is not intended for use by anyone under the age of 13, nor does Meandr knowingly collect or solicit personal data from anyone under the age of 13. If we confirm that we have collected personal data from someone under 13 without verification of parental consent, we will delete that data promptly. If you are a parent or legal guardian of a child under 13 and believe that we might have any information from or about such child, please contact us at the email or mailing address provided at the end of this Privacy Policy.

Changes of Control

If we sell all or part of our business, or make a sale or transfer of assets, or are otherwise involved in a merger or business transfer, or in the event of bankruptcy, dissolution, liquidation, or similar proceeding, we may transfer personal data and Customer Data to one or more third parties as part of that transaction.

Third Party Sites

The Site may contain links to other third party websites. This Privacy Policy applies only to information collected by Meandr. We are not responsible for the privacy practices of other websites and encourage you to familiarize yourself with their policies.

Changes to This Policy

We reserve the right to change our Privacy Policy and our Terms of Use at any time. Non-material changes will take effect immediately, and material changes will take effect within thirty (30) days of their posting on the Site (unless we specify a different notice period). If we make material changes, we will notify you here, by email, or through notice on our home page.

Contact

If you have questions or suggestions about this Privacy Policy, or to make any request described above, contact us:

Mail: Meandr, Inc., 169 Madison Ave, STE 66267, New York, NY 10016, United States

Email: privacy@meandr.com

Updated: October 7, 2026