merıt

Privacy Policy

Last updated: July 1, 2026

This Privacy Policy describes how MeritFi Technologies, Inc. ("Merit", "we", "us"), a Delaware corporation, collects, uses, and protects information when you use meritfi.co and our related services (the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. What we collect

When you request a Merit Report, we collect the information you provide directly:

  • Identity and contact: first name, last name, email address.
  • Situation information: current school or company, US state (current or destination), citizenship or residency status, whether you have a Social Security Number (yes/no only — see below), length of US credit history, approximate income or signed offer amount, whether you have a US bank account, whether you hold US credit cards, and your self-reported credit score range and its source.
  • Goal information: the credit product you are navigating (for example a first US credit card, a student loan refinance, a personal loan, or an apartment approval) and your timeline.
  • Debt details (where relevant): loan balance, interest rate, monthly payment, servicer, and whether a cosigner is available.
  • Prior application history: providers you have applied to, dates, results, offered terms, and stated rejection reasons, including redacted screenshots or letters you choose to upload.
  • Outcomes: what happened after your report — where you applied, the result, the terms, and any documents you choose to share.
  • Referrals: email addresses you voluntarily provide to refer others.

What we deliberately do not collect: your Social Security Number, your date of birth, and full account numbers. We ask only whether you have an SSN, never the number itself. Please redact sensitive identifiers from any document you upload.

We also automatically collect technical information (IP address, browser type, device type, pages visited, timestamps) used to operate and improve the Service. We use minimal essential cookies for session management. We do not use advertising cookies or third-party tracking pixels.

2. How we use it

We use the information you provide to:

  • Prepare and deliver your Merit Report.
  • Communicate with you about your report, your case, and relevant updates.
  • Build de-identified, aggregate patterns from user outcomes (for example, which providers commonly decline particular profile types) to improve guidance for future users. These patterns never identify you.
  • Improve the Service over time.
  • Comply with legal obligations.

We do not sell your information. We do not share your information with third parties for their marketing purposes.

3. Who we share it with

Service providers only. We share information with providers necessary to operate the Service — currently Supabase (database, authentication, and file storage), Vercel (website hosting), and our email service. Each processes data on our behalf under contractual confidentiality and security obligations.

We do not share your personal information with any lender, financial institution, or other third party for their own purposes. If you follow a recommendation in your report, you apply directly with the provider yourself; we do not transmit your information to them.

Referral compensation disclosure. Some providers referenced in Merit Reports pay Merit a referral fee if you open or fund a product after following a link we provide. This does not involve sharing your personal information with the provider, and paid relationships are disclosed alongside the relevant recommendation.

With your explicit consent. If we ever offer to introduce you to a specific provider in a way that involves sharing your information, we will do so only after you affirmatively opt in to that specific transfer.

4. How long we keep it

We keep your information for as long as your account is active or as needed to provide the Service. You may request deletion at any time by emailing legal@meritfi.co. We will delete your information within 30 days of a verified request, except where retention is required by law or to defend against legal claims. De-identified, aggregate patterns that cannot be linked to you may be retained.

5. Your rights

You have the right to access, correct, delete, and receive a portable copy of your information, to withdraw consent, and to object to or restrict certain processing. To exercise any of these rights, email legal@meritfi.co; we will respond within 30 days. If you are in the European Union, the United Kingdom, California, or another jurisdiction with applicable data protection laws, you may have additional rights, which we will honor as required.

6. Security

We protect your information with administrative, technical, and physical safeguards, including encrypted storage, access controls, and row-level security on our database. Uploaded documents are stored in private storage accessible only to you and authorized Merit personnel. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you as required by applicable law.

7. Children

The Service is not intended for users under 18. We do not knowingly collect information from anyone under 18. If you believe we have collected information from a minor, email legal@meritfi.co and we will delete it.

8. International users

The Service is hosted in the United States. By using the Service, you understand that your information may be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. The "Last updated" date reflects the most recent revision.

10. Contact

For questions about this Privacy Policy or your information, contact legal@meritfi.co. For general questions, contact hello@meritfi.co.

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict of laws principles.