Privacy Policy

1. Introduction

BC Holdings LLC, a District of Columbia limited liability company, doing business as Meridian CPA Review ("Company," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, store, and safeguard your information when you visit our website at www.meridiancpareview.com and use our services, applications, and features (collectively, the "Service").

Please read this Privacy Policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use the Service.

This Privacy Policy applies to information we collect through the Service, in email, text, and other electronic messages between you and the Service, and when you interact with our advertising and applications on third-party websites and services if those applications or advertising include links to this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide when you use the Service, including:

• Account Information: Email address, password (stored in encrypted form), full name, and display name
• Profile Information: Study preferences, target exam sections, exam dates, and NTS (Notice to Schedule) information
• Payment Information: When you make a purchase, our payment processor (Stripe) collects billing information including credit card details; we do not store complete payment card information on our servers
• Communication Data: Information you provide when you contact customer support, submit feedback, respond to surveys, or communicate with us via email
• User-Generated Content: Notes you create on questions, feedback you submit about questions, and feature ideas you share
• AI Interaction Data: Messages you send to the Meridian Navigator AI tutor and to Plan with Navigator (the cross-section AI study advisor)

2.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information, including:

• Device Information: Device type, operating system, unique device identifiers, browser type, browser version, and screen resolution
• Log Data: IP address, access times, pages viewed, links clicked, and the page you visited before navigating to the Service
• Usage Data: Information about how you use the Service, including features accessed, time spent on pages, and interaction patterns
• Study Performance Data: Practice question attempts, scores, accuracy rates, time spent per question, topic performance, mastery levels, study session duration, and streak information
• Exam Simulation Data: Exam simulation attempts, scores, section performance, and debrief results
• Location Data: General geographic location based on your IP address (we do not collect precise GPS location)
• Referral and Campaign Data: The page that referred you, the first page you landed on, and any campaign parameters in the link you arrived through (for example utm_source, utm_medium, and utm_campaign)

Visitors who have not created an account. If you arrive through a campaign link, we set a first-party identifier in your browser (the meridian_anon cookie, described in Section 8.1) and record the referral and campaign data above against it. This happens before you create an account and is not tied to your identity at that point.

If you later create an account, that identifier and the associated referral and campaign data are attached to your account. This means browsing activity we recorded before you signed up becomes linked to you. We use this only to understand which channels bring candidates to Meridian; it is not used for advertising or sold to anyone. You can prevent the link by clearing the cookie before signing up, and you can request deletion of this data under Section 7.

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Google OAuth: If you sign in using Google, we receive your email address, name, and profile picture from Google
• Payment Processors: Transaction confirmation and payment status from Stripe
• Analytics Providers: Aggregated and anonymized usage statistics from Google Analytics

2.4 AI Interaction Data

When you use our AI-powered features, we collect different categories of data depending on which feature you use:

Per-Question Navigator (the AI tutor attached to a single practice question, quiz, or exam-simulation review):

• The text of your messages and the AI's responses
• The current question's identifier and topic
• Your answers to that question, including your in-progress responses on a simulation while you are still working on it, and — when you are reviewing a completed question — the answer you gave and whether it was correct
• Topic-level performance summary statistics for the topic of the current question only (the per-question Navigator does not see your scores from other sections or topics)
• Timestamps and usage counts

Plan with Navigator (the cross-section AI study advisor at the dedicated coaching page):

• The text of your messages and the AI's responses
• Performance scores across every section (FAR, AUD, REG, TCP, BAR, ISC)
• Your study-log hours by section, including recent study dates
• Your exam dates and discipline-section choice
• AICPA blueprint reference data routed alongside your message
• Timestamps and usage counts

Safety and operational metadata. Each AI message is tagged with safety and operational metadata. Categories include:

• Model identifier: which underlying model handled the response.
• Routing reason: why that model was selected.
• Prompt-injection / content-safety detector results: whether the message triggered any input-side safety system.
• Contradiction-detection flag: whether the AI's response was flagged as potentially contradicting Meridian's authoritative content.

2.5 Safety and Wellbeing Data

The Service's AI features include automated detection for content indicating crisis, severe distress, or potential harm. When such content is detected, the AI may surface external crisis-support resources (for example, the 988 Suicide & Crisis Lifeline) and the conversation may be flagged for review.

What this means in practice:

• No distress score is stored. Distress is assessed only from the conversation in front of you, in memory, for the length of a single reply. Nothing is written to your record and nothing carries over to a later session.
• No thirty-day flag. We do not keep, or act on, a signal that you were flagged in an earlier conversation. A difficult day does not follow you around.
• No operator email identifying you. We record only a dated count that a detection occurred, with no name, email, account, conversation or message text attached, so we can confirm the safety feature is working without knowing who it fired for.
• Per-message metadata is limited to operational information such as which AI model answered you. Health-related labels are not stored.

Safety detection is used solely to surface crisis resources and to suppress speculative or harmful AI behavior. It is not used for marketing, model training, advertising, or any other purpose. Because it is not retained, there is no stored safety or wellbeing profile to delete, export, or limit the use of — but the rights in Sections 7.1 and 7.2 still apply to your conversation records themselves.

Meridian is not a crisis service and does not monitor for emergencies. If you are in danger or crisis, contact the 988 Suicide & Crisis Lifeline (call or text 988 in the US), the Crisis Text Line (text HOME to 741741), or your local emergency number.

3. How We Use Your Information

We use the information we collect for various purposes, including:

3.1 Providing and Improving the Service

• Creating and managing your account
• Providing access to practice questions, simulations, study materials, and the video library
• Personalizing your learning experience through our Prime Meridian adaptive algorithm
• Tracking your progress and providing performance analytics
• Operating AI features including the per-question Navigator tutor and Plan with Navigator (the cross-section study advisor)
• Sending NTS expiration reminders and score release notifications
• Improving and optimizing the Service

3.2 Communications

• Sending transactional emails (account confirmation, password reset, purchase receipts)
• Responding to your inquiries and support requests
• Sending promotional communications about new features, updates, and offers (with your consent)
• Conducting surveys and collecting feedback

3.3 Business Operations

• Processing payments and preventing fraud
• Analyzing usage patterns and trends to improve the Service
• Conducting research and analytics (using aggregated, anonymized data)
• Enforcing our Terms of Service and other policies
• Complying with legal obligations

3.4 Safety and Security

• Protecting against unauthorized access, fraud, and abuse
• Monitoring for security incidents and responding to threats
• Confirming that an account is used by a single person, which may involve reviewing sign-in metadata such as network address, approximate location, and device or browser characteristics, as described in Terms of Service Section 4.5
• Maintaining the integrity of the Service

4. How We Share Your Information

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Supabase, Inc.: Database hosting, user authentication, and data storage
• Vercel, Inc.: Website hosting, content delivery, and (with your analytics consent) Vercel Analytics
• Stripe, Inc.: Payment processing, subscription billing, and the billing management portal
• Resend, Inc.: Transactional and product-update email delivery. Resend also delivers our internal safety and security alerts, which can include a short excerpt of a message that triggered a security or content-safety detector, together with the associated account email address, so that a person can review it. Crisis detections do not generate an alert of this kind; see Section 2.5.
• Anthropic, PBC: AI model provider for the per-question Navigator and Plan with Navigator. Anthropic processes your AI conversations as a data processor on our behalf under the Anthropic Data Processing Addendum, which is incorporated into our agreement with Anthropic by reference. Based on Anthropic's publicly published policies as of the effective date of this Privacy Policy: Anthropic does not train its models on data submitted through our use of its API; Anthropic's default retention is up to thirty (30) days; and Anthropic may retain conversations flagged for Usage Policy violations for up to two (2) years. Anthropic publishes its subprocessor list at trust.anthropic.com/subprocessors and its data-handling documentation at platform.claude.com.
• Google LLC (Google Analytics 4): Website analytics and usage tracking — loaded only after you accept analytics cookies via our consent banner
• Microsoft Corporation (Microsoft Clarity): Session-level usage analytics — loaded only after you accept analytics cookies via our consent banner
• Mapbox, Inc.: Renders the animated globe on our home page. The globe is decorative and has no bearing on your account or your studying, but drawing it requires your browser to request map tiles from Mapbox, so Mapbox receives your IP address and browser type when you load that page. It is not gated behind the analytics consent banner, because it is part of rendering the page rather than a measurement tool. Mapbox receives no account information and nothing about your study activity.
• Google LLC (YouTube): Hosts the video lessons and the video library. Videos are embedded through youtube-nocookie.com, YouTube's privacy-enhanced mode, which does not set advertising or personalization cookies unless you play a video. When you do play one, YouTube receives your IP address and the video you watched, and its own terms apply to that. On lesson pages we also load YouTube's player API so the site can tell when a video is playing and count your study time; that API is served from youtube.com and has no privacy-enhanced equivalent.
• Functional Software, Inc. (Sentry): Application error monitoring and performance tracing. Sentry receives error reports and a sample of performance traces from the Service, which can include the page or API route involved and technical request context. We do not enable Sentry's personally-identifiable-data collection or its session-replay recording.

These service providers are contractually obligated to protect your information and may only use it to provide services to us. They are not permitted to use your personal information for their own purposes.

4.2 Legal Compliance and Protection

We may disclose your information if required to do so by law or in response to valid requests by public authorities, including:

• To comply with a legal obligation, court order, or legal process
• To protect and defend our rights or property
• To prevent or investigate possible wrongdoing in connection with the Service
• To protect the personal safety of users of the Service or the public
• To protect against legal liability

4.3 Business Transfers

If BC Holdings LLC is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

4.4 Aggregated and De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you. This data may be used for industry analysis, research, or other purposes.

5. Data Retention

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specific retention periods include:

• Account Data: Retained while your account is active and for a reasonable period thereafter to allow for account reactivation or to comply with legal obligations
• Practice and Performance Data: Retained while your account is active to provide personalized learning experiences
• AI Conversation Logs (Meridian-side): Retained by Meridian for up to ninety (90) days for quality improvement, safety review, and contradiction-flag triage
• AI Conversation Logs (Anthropic-side): Retained by Anthropic for up to thirty (30) days under its standard commercial terms; up to two (2) years if Anthropic flags a conversation for a Usage Policy violation. Anthropic's retention is governed by Anthropic's own published policies (see Section 4.1). A request to delete your conversation history can clear Meridian's records but does not directly accelerate Anthropic's retention TTLs.
• Flagged-Interaction Copies: When a message triggers a security, content-safety, or content-accuracy detector, a copy of that message and the AI's response is written to a separate review record so a person can examine it. Crisis detections do not create such a record; see Section 2.5. The message text in those records is erased on the same ninety (90) day schedule as the conversation logs. The record that a flag occurred — its category, severity, timestamp, and whether it was resolved — is kept after that, without the conversation text, so we retain an accurate safety history.
• Per-Message Safety Metadata: Retained alongside the AI conversation log it tags (same ninety-day Meridian-side window).
• Payment Records: Retained as required by applicable tax and accounting laws (typically seven years)
• Communication Records: Retained for as long as necessary to resolve support issues and comply with legal requirements
• Analytics Data: Aggregated analytics may be retained indefinitely

When we no longer need your personal information, we will securely delete or anonymize it in accordance with applicable laws.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption: Data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption
• Password Security: Passwords are hashed using secure cryptographic algorithms and are never stored in plain text
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis
• Security Monitoring: We monitor our systems for security incidents and unauthorized access attempts
• Regular Updates: We regularly update our software and systems to address security vulnerabilities
• Incident Response: We have procedures in place to respond to data breaches and security incidents

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you provide information at your own risk.

7. Your Rights and Choices

7.1 All Users

Regardless of your location, you have the following rights:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your account and personal information, subject to certain exceptions
• Safety and Wellbeing Data Deletion: We do not store distress scores or a recent-crisis flag, so there is normally nothing of this kind held about you to delete (see Section 2.5). Your conversation records themselves remain covered by the Deletion right above.
• Data Export: Request a copy of your data in a portable format
• Marketing Opt-Out: Unsubscribe from marketing communications at any time via the unsubscribe link in emails or by contacting us
• Cookie Preferences: Change your analytics cookie choice at any time using the "Your privacy choices" control in the footer of every page. Your browser settings remain available as well.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale: We do not sell personal information, but you have the right to opt-out if we ever do
• Right to Limit Use of Sensitive Personal Information: Limit the use and disclosure of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at support@meridiancpareview.com. We will respond to verifiable requests within forty-five (45) days. You may designate an authorized agent to make requests on your behalf.

7.3 European Economic Area, United Kingdom, and Switzerland Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or equivalent laws:

• Right of Access: Request access to your personal data
• Right to Rectification: Request correction of inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request restriction of processing of your personal data
• Right to Data Portability: Receive your personal data in a structured, machine-readable format
• Right to Object: Object to processing of your personal data for direct marketing or based on legitimate interests
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects
• Right to Withdraw Consent: Withdraw consent at any time where we rely on consent for processing
• Right to Lodge a Complaint: Lodge a complaint with a supervisory authority

To exercise these rights, contact us at support@meridiancpareview.com. We will respond within thirty (30) days. Our legal bases for processing include: consent, performance of a contract, legitimate interests, and compliance with legal obligations.

7.4 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at:

• Email: support@meridiancpareview.com
• Subject Line: "Privacy Rights Request"

We may need to verify your identity before processing your request. We will respond within the timeframes required by applicable law.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your use of the Service.

8.1 Types of Cookies and Storage We Use

We use cookies and similar local-storage technologies in two categories:

Strictly Necessary (always active). Required for the Service to function. These cannot be turned off.

Analytics (active only after you accept the consent banner). These do not load until you click "Accept" on our cookie banner. If you click "Decline" or never see the banner, none of the analytics scripts below run.

Attribution Storage

These are set by Meridian, not by a third party, and only when you arrive through a link carrying campaign parameters. Unlike the analytics cookies above, they are not gated behind the consent banner: they are written on arrival so we can tell which channel referred you. They contain a random identifier and the campaign values from the link. They are not used for advertising, are not shared with advertising networks, and are not sold. See Section 2.2 for how this is linked to your account if you later sign up.

Cookie names and durations reflect the providers' published behavior at the effective date of this Privacy Policy. Specific durations are controlled by the providers and may change. The set of strictly-necessary cookies may also vary slightly by browser and session state.

8.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all or some cookies, or to alert you when cookies are being sent. Note that disabling certain cookies may affect the functionality of the Service.

8.3 Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature. At this time, we do not respond to DNT signals. You can decline analytics cookies outright using the "Your privacy choices" control in the footer of every page, which we honor immediately and which you can change as often as you like.

8.4 Google Analytics

We use Google Analytics to analyze usage patterns. Google Analytics uses cookies to collect information about your use of the Service. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout

9. Children's Privacy

The Service is not intended for individuals under eighteen (18) years of age. We do not knowingly collect personal information from individuals under 18. At signup, every user is required to affirm via an explicit checkbox that they are at least 18 years old; the timestamp of that affirmation is recorded.

If we learn or have reason to believe that an account holder is under 18 years of age, we will terminate the account immediately and delete associated personal data, except where retention is required by law (for example, retention of legal records of misrepresentation in account creation).

Parents or guardians who believe their child has provided us with personal information without consent should contact us at support@meridiancpareview.com. We will treat the report as a deletion request and act on it within thirty (30) days.

10. International Data Transfers

Your information may be transferred to, and processed in, countries other than the country in which you reside. Our servers and service providers are primarily located in the United States.

If you are located outside the United States, please be aware that information we collect will be transferred to and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards including Standard Contractual Clauses approved by the European Commission, and our service providers' certifications under applicable data protection frameworks.

10.1 If You Are Outside the United States

Free accounts are open worldwide. You can create one and use the free tier from any country, and we do not restrict it by location.

Paid plans are currently available in the United States only. We are a small company based in Washington, DC, and we have chosen to sell in one market while we are getting started rather than to take payment in markets where we are not yet set up to meet every local obligation. If you are outside the United States and try to purchase, you will be told plainly rather than charged.

This does not reduce your privacy rights. We honor access, correction, deletion, portability and objection requests from anyone who asks, wherever you live, and we do not require you to be in a particular country or on a paid plan to exercise them. The rights described in Section 7 and the tools that deliver them — including account deletion and data export in your Settings — are available to every account. Contact us at support@meridiancpareview.com and we will not ask where you are before helping you.

11. Third-Party Links and Services

The Service may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to third-party services, and we are not responsible for the privacy practices of any third party.

We encourage you to review the privacy policies of any third-party services before providing any personal information or using such services.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" and "Effective Date" at the top of this policy
• Post the updated policy on the Service
• Where feasible, send email notification to the address associated with your account

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

13. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

We will make every reasonable effort to respond to your inquiry within thirty (30) days.

Summary: Data We Collect and Why