Privacy Policy

Last updated 18 October 2026

This policy explains what personal data Meritleaf handles, why, and the choices you have. Meritleaf is operated by Meritleaf (“we”). Questions go to support@meritleaf.com.

1. Two roles

• Organisations that issue credentials (universities, institutes, training providers and companies) decide whose credentials are issued and what they contain. For recipient data, the issuing organisation is the controller and we are its processor: we use that data only to provide Meritleaf to that organisation, on its instructions.
• For the people who sign up for and use Meritleaf accounts, and for visitors to our websites, we are the controller.

If you received a credential and want to correct or remove it, contact the organisation that issued it. Its contact details are on your credential page. We will help them handle your request, and you can also write to us.

2. What we collect

• Account data: name, email address, organisation, role, password (stored only as a strong one-way hash), two-step sign-in settings, and sign-in activity.
• Credential data provided by issuers: recipient name and email address, achievement, dates, and any extra details the issuer adds (such as grade or hours).
• Engagement data: when a credential email is opened (using a small image in the email), and when a credential page is viewed, downloaded, shared or added to LinkedIn. Issuers see these as totals and per credential.
• Technical data: IP address, browser type and request logs, used for security, abuse prevention and troubleshooting.

3. What is public

Each credential has a public page so that anyone the recipient shares it with can verify it. That page shows the recipient's name, the achievement, the issuer and the dates. The recipient's email address is never shown. Inside the signed credential file it is stored only as a salted hash, so it cannot be read back. Credential pages are not listed in search engines by Meritleaf, but anyone with the link can open them.

4. Why we use data

• To provide the service: issuing, sending, verifying and managing credentials (performance of a contract with the issuer).
• To keep it secure and prevent fraud and abuse (legitimate interests).
• To send service emails such as sign-up confirmation, password resets, invitations and important changes (contract and legitimate interests).
• To meet legal obligations, such as tax records for paid plans.

We do not sell personal data, use it for advertising, or train artificial intelligence models on customer data.

5. Cookies

Meritleaf uses only cookies that are needed for it to work: keeping you signed in, protecting forms against cross-site attacks, and completing two-step sign-in. We do not use advertising or third-party tracking cookies.

6. Who we share data with

• Infrastructure: our servers are rented from RackNerd LLC in a data centre in the United States. The provider hosts the machines but has no access to the application's data.
• Email delivery: emails are sent from our own servers to the recipient's email provider.
• People you choose: recipients share their credential pages with whomever they like; issuers can send data to their own systems through webhooks and the API.
• Authorities when the law requires it. We will tell the affected customer unless we are legally prevented.

Data may be processed outside your country, including in the United States. Where data protection law requires it, we use appropriate safeguards such as standard contractual clauses.

7. How long we keep data

• Credentials are kept while the issuing organisation's account is active, so they stay verifiable. After an account closes, verification pages stay online for 12 months unless the issuer asks us to remove them sooner, then the data is deleted within 90 days.
• Revoked credentials stay listed as revoked so that a verifier is not misled.
• Engagement events are kept for up to 24 months. Server logs are kept for up to 30 days. Backups roll over within 30 days.

8. Security

Connections are encrypted with TLS. Each organisation's signing key is encrypted at rest. Passwords are hashed with Argon2, two-step sign-in is available to every user, and every important action is written to a tamper-evident audit trail. Access to production systems is limited to the people who run the service, using key-based authentication.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, and to complain to a data protection authority. To use these rights, write to support@meritleaf.com. For a credential, also contact the organisation that issued it. We answer within 30 days.

10. Children

Meritleaf accounts are for organisations and adults. Issuers who issue credentials to people under 18 are responsible for having the consent the law requires.

11. Data processing terms for issuers

When we process recipient data for an issuer, we: act only on the issuer's documented instructions (its use of the service); keep the data confidential; apply the security measures above; help the issuer respond to data subject requests; tell the issuer without undue delay about a personal data breach; delete or return the data when the service ends; and make information available to show we meet these obligations. Our sub-processor is listed in section 6, and we will give 30 days' notice before adding another. A signed data processing agreement is available on request.

12. Changes

We will post changes here and, for significant ones, tell account holders by email at least 30 days in advance.

Contact

Meritleaf · support@meritleaf.com · meritleaf.com