Privacy Policy

MeraFlow LLC ("we," "our," or "us") operates the MeraFix platform and the website at merafix.com (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to visitors to our public website, business owners who subscribe to MeraFix ("customers" — typically appliance repair shops), and end consumers whose information our customers process through MeraFix ("end users" — typically the homeowners those shops serve).

Read this Policy together with our Terms of Service, our AI Disclosure, and our Cookie Policy.

1. Quick summary

• We do not sell your personal information.
• We do not use your data or your end users' data to train AI models, and we do not sell or license it to anyone for that purpose. We use AI vendors (Vapi, OpenAI, Google) to operate features you turn on; they process the data to provide those features, under their own terms.
• If you call our AI sales line, the call is recorded and transcribed for service operation, fraud detection, and product improvement. We will route you to a human if you request that, where one is available — otherwise the AI takes a message.
• You can request access, correction, deletion, or export of your data at any time by emailing [email protected].
• We are based in the United States. Data is stored in the United States.

2. Roles — who is the controller of what data?

MeraFix is a multi-tenant software-as-a-service platform. The same Service plays two different roles for two different relationships:

• For our customers (the repair shops who subscribe): we are the controller of the data relating to your business account — billing details, login credentials, preferences, support communications. This Policy explains how we handle that data.
• For end users (the homeowners and businesses your shop serves): when our customer enters or imports your information into MeraFix, our customer is the controller of that information and we act as a processor on their behalf. The customer's own privacy notice, not this Policy, primarily governs how that information is used. Our processing is contractually limited by our agreements with the customer.

3. Information we collect

3.1 Information you give us directly

• Account information: name, work email, phone, business name, role, and what plan you choose.
• Billing information: handled by our payment processor (Stripe). We receive only the last four digits of the card and a token — never the full PAN, CVV, or full account number.
• Customer-supplied data: for our customers using MeraFix as a CRM, anything they enter about their own end users — names, addresses, phone numbers, appliance details, service history, photos, signatures, payment references.
• Communications: what you write to us via contact form, waitlist, email, or phone.
• Lead-capture forms: if you submit your email or business name on our website to join the waitlist or request a demo, we save it together with the source page, the time, and any UTM parameters from the link you arrived through.

3.2 Information collected automatically when you use the Service

• Usage data: pages viewed, features clicked, approximate session duration, error logs.
• Device and connection: browser, operating system, screen size, language, IP address, approximate location derived from IP.
• Cookies and similar: see Section 9 and our Cookie Policy.
• Click identifiers: if you arrive via a Google Ads, Meta, or similar ad-network click, we may store the click identifier (for example, GCLID, fbclid) to attribute conversions for ourselves and, when applicable, for our customer whose ad you clicked.

3.3 Information from AI phone calls

When you call a phone number operated by MeraFix or by one of our customers using our AI Phone feature, the call is connected to an AI voice assistant. During and after the call we collect:

• Audio recording of the entire call.
• Real-time transcript generated by an automated speech-to-text service.
• Caller telephone number as delivered by the carrier (caller ID).
• Anything the caller says in response to AI prompts — name, address, appliance issue, payment-method preference, etc.
• Call metadata — start time, end time, duration, language detected, end reason, cost.

See our AI Disclosure for how AI-answered calls work, the recording notice callers hear, and how to avoid being recorded or reach a person.

3.4 Information we receive from integration partners

When one of our customers (a repair business) connects a third-party lead or marketplace platform to the Service (for example, Thumbtack or a similar home-services platform), that platform sends us information about the consumer who submitted the request so the business can respond: name, phone number, email address, the service requested, the project description, and the city/ZIP of the job. We process this information on behalf of the business the consumer contacted, in the same way as a booking-form submission, and we use it only to provide the Service to that business — we do not sell it, use it for our own marketing, or share it with other customers. The sending platform's own privacy policy also applies to the consumer's relationship with that platform. If a business disconnects an integration, we stop receiving new data from it; previously received records remain in that business's account subject to Section 7 (Data retention).

3.5 Mobile applications (technician app)

Our native mobile applications for technicians (iOS and Android; the browser-based version runs on any device) process the following in addition to the categories above:

• Camera and photos: photos a technician captures or attaches on a job (before/after photos, parts receipts, signatures) are uploaded to the employing business's account. The app accesses the camera or photo library only when the technician takes or selects a photo.
• Precise location: when a technician starts driving to a job with en-route sharing active, the app reports device location so the business can dispatch and the end customer can see arrival progress ("tech on the way"). Location reporting is tied to that job flow, is visible to the technician's employer, and is not collected in the background outside of it.
• Push notification tokens: a device token used to deliver job, message, and dispatch alerts to that device.
• Device unlock (Face ID / Touch ID / Android biometrics): biometric verification runs entirely on the device through the operating system's own APIs (Apple or Google). We never receive, store, or have any access to biometric data or biometric templates, and we cannot reconstruct them; the app only receives a yes/no unlock result.

Employment context. Technician accounts are created and administered by the repair business that employs or engages the technician — that business is the controller of personal information processed in the working relationship (including en-route location), and we process it as the business's service provider. Technicians should direct privacy questions and requests to their employer; we assist the employer in fulfilling them. See also Account & Data Deletion.

3.6 Categories under California law (CCPA/CPRA)

For readers who prefer the statutory categories, the information above maps to California's categories as follows:

Sensitive personal information. The only sensitive categories we process are account credentials and the technician app's precise geolocation (Section 3.5). We use them solely to provide the Service — never to infer characteristics about individuals — so a separate "Limit the Use of My Sensitive Personal Information" control is not required; the rights in Section 10 apply.

In the preceding 12 months we have not sold personal information. We have "shared" identifiers and internet activity with Meta solely to measure our own advertising, with the opt-out described in Section 10.

4. How we use information

• To provide, operate, and maintain the Service, including answering AI calls and routing them to the right place.
• To bill subscribers and reconcile usage-based charges (for example, AI minutes).
• To authenticate accounts, prevent fraud, detect abuse, and enforce our Acceptable Use Policy.
• To respond to support questions and other communications you send us.
• To improve the Service — measuring conversion funnels, debugging errors, evaluating quality of AI responses, and prioritizing features.
• To send you transactional messages (booking confirmations, invoices, receipts, security alerts) and, with your consent or where permitted by law, product updates. You can opt out of marketing email at any time.
• To comply with applicable law, regulatory requests, and legal process.

5. AI processing — what we do and do not do

We use third-party artificial-intelligence services to operate features you turn on. Specifically:

• Voice answering and conversation uses Vapi, which in turn uses OpenAI's language models, Deepgram's transcription, and ElevenLabs' speech synthesis as sub-processors. On some lines the assistant runs directly on OpenAI's real-time voice model instead of Vapi.
• Transcripts, summaries and quality review of recorded calls and voicemails use Google's Gemini models.
• Written lead replies (for example, answering a lead received through a lead platform) may be drafted with Google's Gemini models.
• Landing-page copy generation and translation uses Google's Gemini models.

We send these vendors only the inputs needed to perform the requested task (call audio for transcription and summaries; the lead's message for a drafted reply; shop name, brands serviced, and similar facts for content generation). We do not use this data to train AI models ourselves, and we do not sell or license it to anyone for that purpose.

We may use anonymized, aggregated data — call counts, average call duration, common request types — to improve our own product. This aggregated data does not identify you or any individual.

6. How we share information

We do not sell personal information. We share it only in these circumstances:

6.1 Sub-processors

The following companies process information on our behalf to operate parts of the Service. Each is bound by contract to use the information only for the purpose listed.

We update this list when sub-processors change. Customers will be notified of material additions in advance where reasonably practicable.

6.2 Customers' integrations

When you, or a customer of ours, authorizes a third-party integration (for example, Google Ads, Google Calendar, an SMS gateway), we exchange data with that third party on the authorizing party's behalf. The third party's own privacy policy then also applies.

6.3 Required disclosures

We may share information when required to do so by law, by valid legal process, or where we believe in good faith that disclosure is necessary to protect our rights, the safety of our users, or the integrity of our Service.

6.4 Business transfers

If MeraFlow LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify affected users and provide reasonable choices where practicable.

6.5 With your consent

For any other purpose, only with your explicit consent.

6.6 Mobile opt-in & SMS data

Mobile opt-in information and SMS consent — including a phone number and the fact that consent to receive text messages was given — are not shared with, rented to, or sold to any third parties or affiliates for their marketing or promotional purposes. Where text messages are sent, the mobile number is shared only with the SMS carrier and messaging platform that deliver those messages on our (or our customer's) behalf, and only as needed to send them. Message frequency varies; message and data rates may apply; reply STOP to opt out and HELP for help.

7. Data retention

We keep information only as long as we need it for the purposes described, plus a reasonable period to satisfy legal obligations and resolve disputes. Specific defaults:

• Account records — while the account exists, plus a limited period afterward to resolve disputes and meet legal obligations.
• Customer-supplied tenant data (the data your shop puts into our CRM) — kept while your subscription is active. After the paid period ends we keep it for a 60-day export window; after that we delete or de-identify it from active systems in the ordinary course, and it may remain in rolling backups for up to 30 additional days. You may request earlier deletion.
• Call audio recordings — deleted automatically after the retention period the business has set for its account: 120 days by default, adjustable by the business between 7 days and 12 months. A recording tied to an open dispute or legal hold may be kept longer as required.
• Call transcripts, summaries, and call metadata — the business's service records; kept while the related account is active so the business can review its own calls, and deleted or de-identified with the rest of the account's data after it ends. Any individual or customer may request deletion of a specific recording or transcript at any time via [email protected].
• Billing and tax records — 7 years (US federal tax recordkeeping).
• Activity and security logs — kept for as long as needed for security monitoring and incident investigation.
• Database backups — rolling 30 days.
• Lead-capture submissions — until you ask us to delete them.

8. Security

We use technical and organizational measures including TLS encryption in transit, encryption at rest for backups and secrets, role-based access control, multi-factor authentication on administrative accounts, audit logging, and regular review of access and permissions. We segregate customer data using row-level security so that one tenant cannot read another tenant's rows. Despite these efforts, no system is perfectly secure; we cannot guarantee absolute security.

If we become aware of a security breach involving your personal information, we will notify affected parties and applicable authorities consistent with applicable law (and in any event without unreasonable delay).

We use Cloudflare Turnstile and related server-side controls to protect login, booking, and other forms from automated abuse. These controls may process browser, device, IP-address, and interaction signals for fraud and bot detection. Cloudflare acts as our service provider for this purpose.

9. Cookies and similar technologies

We use a small number of cookies for essential functions (authentication, session, CSRF protection) and, where applicable, for product analytics. The only third-party advertising technology on the public website is the Meta Pixel (together with its server-side Conversions API), which we use solely to measure our own advertising — it is automatically disabled for visitors whose browsers send the Global Privacy Control signal, and you can opt out any time on our Do Not Sell or Share page. We run no other third-party advertising trackers. See our Cookie Policy for the full list and controls.

For platform analytics we run Umami, a privacy-first analytics tool self-hosted on our own infrastructure. Umami records aggregate page views and sessions without setting cookies, without collecting personally identifying information, and without sharing data with third parties. Visitors are not tracked across sessions or across sites.

10. Your rights

Depending on the state of residence, individuals in the United States may have rights including the right to:

• Know what personal information we collect, where we got it, and how we use it.
• Access a copy of the personal information we hold.
• Correct inaccuracies in that information.
• Delete personal information we hold, subject to limited legal exceptions.
• Opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information. We do use the Meta Pixel / Conversions API to measure our own advertising, which may qualify as "sharing" under some state laws — opt out any time on our Do Not Sell or Share My Personal Information page. We also honor the Global Privacy Control (GPC) signal on this website: browsers sending GPC are automatically opted out of the Pixel.
• Limit use of sensitive personal information where applicable.
• Appeal a denial of a privacy request.
• Non-discrimination for exercising any of these rights.

Which of these rights apply depends on the law of your state.

To exercise any right, email [email protected]. We may need to verify your identity before fulfilling certain requests. We will respond within a reasonable time and, where a state privacy law that applies to us sets a deadline, within that deadline.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We will ask the agent for proof of your signed permission, and may also ask you to verify your identity directly or confirm that you granted the permission.

Appeals. If we decline a request, you may appeal by replying to our decision (or emailing [email protected] with "Appeal" in the subject). We will respond within a reasonable time. If your appeal is denied, you may contact your state Attorney General.

If your personal information is held by a customer of ours (you used a repair shop's booking form, you spoke with a shop's AI assistant, etc.), please contact that shop directly. We will assist them in fulfilling your request.

For step-by-step instructions on deleting an account and its associated data — including accounts used in our mobile applications — see Account & Data Deletion.

11. Recorded calls

Calls to our AI sales line and to our customers' AI assistants are recorded and transcribed. By default, the call begins with a notice that it may be recorded; a business using our Service can turn that notice off, and is then responsible for its own recording notices and consents. The assistant is configured to identify itself as an AI assistant when a caller asks whether they are speaking with a person. If you do not want a call recorded, you may end the call and contact the business another way. See the full AI Disclosure.

12. Children

The Service is intended for use by businesses and the adults who run them. It is not directed at children under 16. We do not knowingly collect personal information from children. In particular, the Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13 within the meaning of COPPA; if a child ends up speaking with an AI phone line, we do not knowingly retain their information once we become aware of it. If we learn we have collected information from a child without verified parental consent, we will delete it upon becoming aware.

13. International users

The Service is offered only to businesses located in the United States. We do not knowingly enter into subscriptions with businesses located outside the United States. The Service is operated from and hosted in the United States. If you access the Service from outside the United States, you understand and agree that your information will be transferred to and processed in the United States.

14. Third-party links

The Service may contain links to third-party websites. We are not responsible for the practices of those sites. Please review their privacy policies before providing information to them.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will post the revised version at this URL and update the "Last updated" date. Material changes will be communicated by email to active customers at least 30 days before they take effect, except where a shorter notice period is required by law or to address a security risk.

16. Contact

For privacy questions or to exercise any right under this Policy:

• Privacy: [email protected]
• General support: [email protected]
• Operator: MeraFlow LLC, organized under the laws of South Carolina, United States — meraflow.co