Privacy Policy

Last updated: October 13, 2026

This Privacy Policy describes how MeritFi Technologies, Inc. ("Merit", "we", "us"), a Delaware corporation, collects, uses, and protects information when you use meritfi.co and our related services (the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. What we collect

When you request a Merit Report or join the waitlist, we collect the information you provide directly:

  • Identity and contact: your name, email address and, if you set one, a password.
  • Situation information: your school and program or what describes you, your home country, whether you are in the US yet and when you arrive, US state, citizenship or visa status, whether you have a Social Security Number (yes/no only, see below), length of US credit history, whether you have credit history or an Amex card in your home country, your US income, whether you have a US bank account, whether you hold US credit cards, your self-reported credit score range and its source, and whether your university has a credit union and what you hold with it.
  • Goal information: the credit product you are navigating (for example a first US credit card, a student loan refinance, or an apartment), your timeline, and for an apartment your target rent, move date, location, and whether a guarantor or a deposit is available.
  • Debt details (where relevant): loan balance, interest rate, monthly payment, servicer, and whether a cosigner is available.
  • Prior application history: providers you have applied to, dates, results, offered terms, and stated rejection reasons, including redacted screenshots or letters you choose to upload.
  • Outcomes: what happened after your report — where you applied, the result, the terms, and any documents you choose to share.
  • Referrals: the referral link you arrived through, how you heard about Merit and, if you tell us, who told you.
  • Waitlist: your first and last name, email address, what interests you, when you might need help, and, if you tell us, who told you about Merit.

What we deliberately do not collect: your Social Security Number, your date of birth, and full account numbers. We ask only whether you have an SSN, never the number itself. Please redact sensitive identifiers from any document you upload.

We also automatically collect technical information (IP address, browser type, device type, pages visited, timestamps) used to operate and improve the Service. We use a small number of first-party cookies: to keep you signed in, to remember a referral link you arrived through, and to remember your time zone and display theme. We do not use advertising cookies or third-party tracking pixels.

2. How we use it

We use the information you provide to:

  • Prepare and deliver your Merit Report.
  • Communicate with you about your report, your case, and relevant updates.
  • Build de-identified, aggregate patterns from user outcomes (for example, which providers commonly decline particular profile types) to improve guidance for future users. These patterns never identify you.
  • Improve the Service over time.
  • Comply with legal obligations.

We do not sell your information. We do not share your information with third parties for their marketing purposes.

3. Who we share it with

Service providers only. We share information with providers necessary to operate the Service — currently Supabase (database, authentication, and file storage), Vercel (website hosting and page analytics), Anthropic (AI models that help us research and draft reports), and our email service. Each processes data on our behalf under contractual confidentiality and security obligations.

We do not share your personal information with any lender, financial institution, or other third party for their own purposes. If you follow a recommendation in your report, you apply directly with the provider yourself; we do not transmit your information to them.

Referral compensation disclosure. Some providers referenced in Merit Reports pay Merit a referral fee if you open or fund a product after following a link we provide. This does not involve sharing your personal information with the provider, and paid relationships are disclosed alongside the relevant recommendation.

With your explicit consent. If we ever offer to introduce you to a specific provider in a way that involves sharing your information, we will do so only after you affirmatively opt in to that specific transfer.

4. How long we keep it

We keep your information for as long as your account is active or as needed to provide the Service. You may request deletion at any time by emailing legal@meritfi.co. We will delete your information within 30 days of a verified request, except where retention is required by law or to defend against legal claims. De-identified, aggregate patterns that cannot be linked to you may be retained.

5. Your rights

You have the right to access, correct, delete, and receive a portable copy of your information, to withdraw consent, and to object to or restrict certain processing. To exercise any of these rights, email legal@meritfi.co; we will respond within 30 days. If you are in the European Union, the United Kingdom, California, or another jurisdiction with applicable data protection laws, you may have additional rights, which we will honor as required.

6. Security

We protect your information with administrative, technical, and physical safeguards, including encrypted storage, access controls, and row-level security on our database. Uploaded documents are stored in private storage accessible only to you and authorized Merit personnel. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you as required by applicable law.

7. Children

The Service is not intended for users under 18. We do not knowingly collect information from anyone under 18. If you believe we have collected information from a minor, email legal@meritfi.co and we will delete it.

8. International users

The Service is hosted in the United States. By using the Service, you understand that your information may be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. The "Last updated" date reflects the most recent revision.

10. Contact

For questions about this Privacy Policy or your information, contact legal@meritfi.co. For general questions, contact hello@meritfi.co.

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict of laws principles.