Due Meridian Privacy Policy
This Privacy Policy will be reviewed by our legal counsel, and we may update it after that review.
Effective date: October 28, 2026
Last updated: October 28, 2026
This Privacy Policy explains how Echelon Capital Holdings, LLC ("Echelon", "we", "us"), which operates Due Meridian at duemeridian.com (the "Service"), collects, uses, shares and protects personal information.
Due Meridian is a new service. This policy describes what the Service does today. Where we describe a feature that is planned but not yet available, we say so; we will update this policy before such a feature goes live.
Improving the Service, including with AI. We may use de-identified or aggregated data (data that cannot reasonably be linked to you, your business, your clients or any other individual) to operate, analyze and improve the Service, including to develop and improve features that use artificial intelligence. We will not use identifiable information to train artificial intelligence or machine-learning models unless we first give you advance notice and you opt in. See Section 3.
1. Who this policy covers, and our role
| Person | Example | Our role |
|---|---|---|
| Customers | A freelancer or agency that signs up, and their users | We decide how and why we process their account and billing information. We are the business / controller for this data. |
| Customers' clients | The people or businesses your invoices are addressed to (including individuals who owe a customer money), whose names, email addresses and invoice details you upload or import | We process this data on behalf of, and on the instructions of, the customer, under the Data Processing Terms in Appendix A of our Terms of Service. We act as the customer's service provider / processor. The customer is the business / controller and is responsible for having a lawful basis to provide the data and to contact its clients. |
| Website visitors | Anyone browsing duemeridian.com | Business / controller for the limited technical data described below. |
If you are a customer's client and have a question or request about your data, please contact the business that issued your invoice. We will also forward requests we receive to the relevant customer and help them respond.
2. Information we collect and why
2.1 Customers (signed-in accounts)
When you sign in, your account data is stored on our servers (Cloudflare D1 database).
| Data | Source | Why we use it |
|---|---|---|
| Email address | You, at sign-in | To create your account and send you one-time sign-in links. Transactional email from the Service (sign-in links, and reminders when sending is on) is sent through Cloudflare Email Service. |
| Account settings (business name and time zone) | Fixed defaults today ("My business", UTC−6); you cannot change them yet | To label your account and, in future, schedule reminders in the right time zone |
| Sign-in records: one-time link tokens (stored only as one-way hashes, together with the email they were sent to), session identifiers (stored only as hashes), session start and expiry times, and when you last verified by link | Generated by the Service | To keep you signed in securely and require recent re-verification for sensitive actions such as deleting your account |
| Rate-limit counters: a keyed one-way hash (HMAC-SHA-256 with a secret key) of your IP address, and a one-way hash (SHA-256) of your email address, each with a count and time window. We do not store your raw IP address. | Your sign-in request | To limit sign-in requests (currently 5 per email and 20 per IP address per 15 minutes) and prevent abuse |
| Activity (audit) log entries: account and user identifiers, the action taken and when (for example sign-in, sign-out, import, export, marking an invoice paid, recording a promise, setting a due date or client email), and limited details such as invoice numbers, dates and counts | Generated by the Service | Security, troubleshooting, and an accurate history of your account |
| Support emails and their contents | You | To answer you and process requests such as cancellation |
Billing. You subscribe through a Stripe Payment Link hosted by Stripe. Stripe collects your name, email, billing address and payment card, and an optional "invoicing tool" field we added to the checkout. This information stays in Stripe; none of it reaches the Due Meridian application or database. We can see it in our Stripe dashboard to manage your subscription. We never receive your full card number.
2.2 Customers' clients (processed for customers)
| Data | Source | Why |
|---|---|---|
| Client name and an import reference (for example the client name or a Stripe customer ID that appears in an imported file) | Customer upload or CSV import | To group invoices by client |
| Client location (state, province or country) and consumer setting | Entered by the customer | To apply sending times in the client's time zone and to apply restrictions on reminders to consumer clients by location. |
| Client email address | Same, or entered by the customer | To send reminder emails about the customer's invoices when the customer has reminder sending on (including to clients the customer has marked as consumers, except consumer clients located in California, who are never sent reminders). Client replies pause reminders on that invoice and are forwarded to the customer. |
| Invoice details: invoice number, currency, total, amount paid, issue date, due date, status, paid date, flags (for example disputed or paused), promised payment date | Same, and actions the customer takes in the app | To show the customer's receivables |
| Invoice history: promises to pay, payments marked, disputes, pauses, resumes and due-date changes recorded by the customer | Generated when the customer acts in the app | To show the customer a history of each invoice |
We do not ask for, and customers must not upload, Social Security numbers, health data, bank account or payment card numbers, or other sensitive personal information.
2.3 Demo and browser-only modes
The dashboard at duemeridian.com/app also offers a demo with sample data and a "My invoices (this browser)" mode. In these two modes, data you enter or import is processed and stored only in your own browser (browser "local storage") and is not sent to us. You can clear it with the app's delete option or by clearing your browser storage. This does not apply once you sign in: signed-in account data is stored on our servers as described in Section 2.1.
2.4 Website visitors
- Server and security logs. Our hosting provider, Cloudflare, processes technical data such as IP address, browser type and request details to deliver the site and protect it from attacks.
- Analytics. We use Cloudflare Web Analytics, provided by Cloudflare, Inc., to measure how our website is used. When you load a page on duemeridian.com, a small script from Cloudflare (static.cloudflareinsights.com) sends Cloudflare information about that page view, such as the page address, the referring page, your browser and device type, screen size, page-load performance data, and the approximate country, derived from your IP address. Cloudflare provides us only with aggregated statistics. Cloudflare Web Analytics does not set cookies or use your browser's local storage, and Cloudflare states that it does not use this data to track you across sites or to build a profile of you. We do not use it for advertising.
3. How we use information
We use personal information only to: provide and secure the Service; authenticate users; import, store and display invoice data; send sign-in links; manage subscriptions (through Stripe); respond to support requests; detect and prevent abuse; maintain an audit trail; comply with law; and improve the Service.
We do not: sell personal information; share it for cross-context behavioral advertising; use customers' clients' data to market to those clients; or add customers' clients to any marketing list. De-identified data and AI. We may create de-identified or aggregated data from the information described in this policy and use it to operate, analyze and improve the Service, including to develop and improve features that use artificial intelligence. We take reasonable measures to ensure such data cannot be linked to any person or business, we publicly commit not to re-identify it, and we require anyone we share it with to do the same. We will not use identifiable personal information, including your clients' information, to train artificial intelligence or machine-learning models unless we first give you advance notice and you opt in. We will not apply such a change to information we already hold without that consent.
Planned features. Connections to accounting platforms are planned but not available yet. We will update this policy, including what data they use and any new service providers, before they go live.
4. Who we share it with (service providers)
Today the Service uses these providers:
| Provider | What they do | Data involved |
|---|---|---|
| Cloudflare, Inc. | Website and application hosting (Cloudflare Pages and Workers), database (Cloudflare D1), DNS, security, and cookieless website analytics (Cloudflare Web Analytics) | All Service data is stored and processed on Cloudflare's infrastructure. We have not selected a specific database region; Cloudflare places it automatically. |
| Cloudflare, Inc. (Cloudflare Email Service) | Delivering transactional email: sign-in links from login@duemeridian.com and, when sending is on, reminder emails to customers' clients | Recipient email address, subject and message content (sign-in link, or the reminder and invoice details). We do not receive or store delivery or bounce events. |
| Stripe, Inc. | Hosted subscription checkout (Payment Link), billing and the customer billing portal | Billing details and payment card data you give Stripe at checkout. Stripe does not send this data to our application. |
| Cloudflare, Inc. (Cloudflare Email Routing) and Proton AG (Proton Mail) | Receiving support email sent to support@duemeridian.com and forwarding it to our Proton Mail inbox, where we read and answer it | Support correspondence, including your email address and anything you include |
Future connections. If and when we offer connections to platforms such as QuickBooks Online (Intuit), Xero, FreshBooks or Stripe (Stripe Apps), data will be exchanged with that platform only if you choose to connect it, and that platform's own terms and privacy policy will apply to your use of it. We will update this policy before any connection is available.
We may also disclose information: to comply with law, a court order or a valid legal request; to protect the rights, safety and security of our customers, their clients, us or others; and in connection with a merger, acquisition, reorganization or sale of the Service, subject to this policy. Echelon affiliates may access information only to operate the Service.
5. How long we keep information
- Account and invoice data (account, users, clients, invoices, invoice history): kept while your account exists. We do not delete accounts automatically because they are inactive. We may review inactive accounts internally and may contact the account owner about them. The data is deleted when the account owner deletes the account in the app, which is available today (see "Account deletion" below).
- Activity (audit) log entries for live accounts: we may delete or anonymise entries older than 24 months. Entries are deleted when the account is deleted, as described below.
- Sessions last a fixed 14 days from sign-in and are not extended by activity. They end earlier when you sign out. Expired sessions are removed by an hourly cleanup.
- One-time sign-in tokens expire after 15 minutes and work once. Used or expired tokens are removed by an hourly cleanup (and during sign-in requests).
- Rate-limit counters are removed after their 15-minute window passes, by the same cleanup.
- Account deletion. The account owner can delete the account in the app (a recent sign-in and a typed confirmation are required). This immediately deletes, from our live database, the account's users, sessions, clients, invoices, invoice history, account record, any outstanding sign-in tokens for the account's email addresses, the email-based rate-limit counters, and the account's activity-log entries. We keep only:
- one minimal deletion record ("account.deleted") containing random account and user identifiers, the number of records deleted from each table, the time, and integrity hash values. It contains no email address, name or invoice number; and
- an internal marker noting that the account's activity log was erased (account identifier, position in the log, and time).
- Full data deletion by the operator. If we decide to delete all data in the Service (for example, because we are discontinuing it), we will email customers at least 30 days in advance and give them a chance to export their data first, except where immediate deletion is required by law or is needed to respond to a serious security incident. A full deletion removes all accounts, users, clients, invoices, history, sessions, sign-in tokens, rate-limit counters and activity-log entries; we keep only a single record that the deletion took place, containing no customer data. This capability is restricted to the operator by a separate secret and recent re-verification.
- Backups. Our database provider keeps point-in-time recovery history automatically. Our database (Cloudflare D1, on Cloudflare's Workers Paid plan) can be restored to any point in the last 30 days. Deleted data may therefore remain recoverable in that history for up to 30 days, after which it can no longer be restored. We do not restore deleted data except to recover from an incident affecting the whole Service.
- Billing records. We keep records of charges, refunds, cancellations and your acceptance of our subscription terms for 7 years, for tax and accounting and to meet automatic-renewal record-keeping rules. Stripe also keeps billing records under its own privacy policy.
- Support emails are kept for 2 years after your request is resolved, or longer if needed for a legal claim.
6. Security
We use measures designed to protect personal information, including: - passwordless sign-in with single-use links that expire after 15 minutes, stored only as one-way hashes; - session identifiers stored only as hashes, in a Secure, HttpOnly cookie; same-origin checks and a per-session token on every change; - rate limits on sign-in requests, stored without raw IP addresses; - separation of each customer's data at the database-access layer; - a hash-chained activity log designed so that any edit can be detected, kept for the periods described in Section 5; - HTTPS-only connections; - confirmation steps and recent re-verification before destructive actions.
No system is completely secure. If we become aware of a breach affecting your personal information, we will notify you and authorities as required by law.
7. Cookies and similar technologies
- Sign-in cookie. When you sign in we set one strictly necessary cookie (
__Host-dm_session) that keeps you signed in for a fixed 14 days. It is HttpOnly, Secure and SameSite=Lax, and contains only a random identifier. - Local storage. The app uses your browser's local storage to remember which mode you chose and, in the demo and browser-only modes, to hold that data (Section 2.3).
- No advertising or tracking cookies. We do not use advertising cookies or third-party trackers.
- We do not sell or share personal information, so there is nothing for a Global Privacy Control signal to opt you out of. If that ever changes, we will honor GPC signals as an opt-out.
8. Your privacy rights
Depending on where you live, and where applicable law gives you these rights (for example in California, Colorado, Connecticut, Virginia and other U.S. states with privacy laws), you may have the right to: - know / access the personal information we hold about you and receive a copy; - correct inaccurate information; - delete your information; - opt out of the sale or sharing of personal information, or targeted advertising (we do not do either); - limit use of sensitive personal information (we do not collect it for that purpose); and - not be discriminated against for exercising these rights.
What you can do in the app today: export your invoices as a CSV file; correct a client's email address or an invoice's due date; correct other invoice details by re-importing a corrected file; and delete your account. Your business name and account email address cannot be changed in the app yet, and recorded promises cannot be edited in the app; we will make these corrections on request through support.
To make any request, email support@duemeridian.com. We will verify your request by confirming control of the email address on the account, and respond within the time required by law (generally 45 days). You may use an authorized agent; we may ask for proof of authorization. If we deny your request, you can appeal by emailing support@duemeridian.com with "Privacy appeal" in the subject within 60 days of our decision. We will respond in writing within 45 days, explaining what we decided and why. If you are not satisfied, you may be able to complain to the data-protection authority, privacy regulator or attorney general where you live.
If you are a customer's client, we process your data for that customer, so we will refer your request to them and assist them as required.
9. Children
The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.
10. International users
The Service is offered in the countries we list on our website. Customers are responsible for complying with the laws that apply to them and their clients. We are based in the United States, and our providers may process and store data in the United States and other countries where they operate, which may have data-protection laws different from those where you live. Where the law requires a legal basis for transferring personal information across borders, we rely on the mechanisms that law provides.
11. Changes to this policy
We may update this policy. If changes are material, we will notify customers by email or in the app at least 30 days before they take effect. The "Last updated" date shows the current version.
12. Contact us
Due Meridian, operated by Echelon Capital Holdings, LLC
Privacy requests and support: support@duemeridian.com