Privacy Policy

This Privacy Policy explains how MERITT DEV LIMITED ("Meritt Dev", "we", "us", "our") collects, uses, and protects personal data across the Meritt Dev website and all of our products and services. It applies to https://meritt.dev and to the products we operate, including BillBridge (invoicing, quotes, time tracking, client management, and expense tracking, at billbridge.meritt.app) and LeadCall (call tracking and lead attribution, at leadcall.tech).

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the EU GDPR, the Data Protection Act 2018, and other applicable privacy laws.

Who we are

MERITT DEV LIMITED is a company registered in England and Wales (Company Number: 16581026), with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Meritt Dev is the data controller for personal information processed through our website and products.

For all privacy and data protection enquiries, contact us at [email protected].

Products this policy covers

• BillBridge — invoicing, quotes, time tracking, client management, expense tracking, and subscription billing for freelancers and small businesses (billbridge.meritt.app).
• LeadCall — call tracking, lead attribution, and CRM synchronization for sales teams (leadcall.tech).
• Meritt Dev Booking — meeting scheduling at calendar.meritt.dev, managed by authorized team members at dashboard.meritt.dev/bookings.
• The Meritt Dev marketing website and any related services we provide.

Information we collect

• Account data — your name, email address, and authentication identifiers used to create and secure your account.
• Business data you enter — for BillBridge, this includes clients, invoices, quotes, time entries, and expenses; for LeadCall, this includes company and CRM-related information, phone numbers, and call activity.
• Payment-related metadata — billing details and subscription status processed by our payment provider when you subscribe. We do not store full card numbers.
• Usage, device, and log data — such as browser type, IP address, pages visited, and analytics events.
• Contact data — information you provide when you contact us, such as your message content.
• Cookie and advertising identifiers — collected when you accept non-essential cookies or when advertisements are served.

How we use information

• To provide, secure, and improve our website and products.
• To process subscriptions and send transactional emails such as invoices, quotes, and account notifications.
• To respond to support requests and monitor service reliability.
• To understand how our website and products are used and to measure advertising performance where permitted.
• To comply with legal obligations and prevent abuse or fraud.

Meritt Dev Booking and Google Calendar data

Meritt Dev Booking is managed internally by our team. Team members connect their own Google calendars, including accounts from different organizations, so availability reflects their commitments across all connected accounts. The app accesses account email addresses to identify connections, calendar free/busy times to calculate availability, and events to manage bookings. It does not request Gmail permissions or read mailbox messages.

The app creates booking events with Google Meet links and displays and cancels bookings created by the app. Visitors to the public scheduling page see available times, not the contents of connected calendars.

When a visitor books a call, their name, email address, chosen time and optional notes are sent to Google to create the event and shared with its participants. Google delivers event invitations and cancellation notifications. We store connected account email addresses and OAuth refresh tokens on our server to maintain the connection; access tokens are cached temporarily in memory.

Owners can disconnect accounts on the dashboard's Bookings page. This removes the account's stored connection and attempts to revoke its Google authorization. Access can also be revoked at https://myaccount.google.com/connections. Disconnecting does not delete existing Google Calendar events. For data access or deletion requests, contact [email protected].

Google Workspace data, AI and Limited Use

Meritt Dev Booking does not integrate with AI/ML models, third-party AI providers, model aggregators or self-hosted models. Its Google Calendar data is processed by the booking application and Google for scheduling; the booking application does not transfer that data to AI services.

Meritt Dev Booking's use and transfer of raw or derived information received from Google Workspace APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy) and the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy), including the Limited Use requirements.

We do not use, transfer or sell Google user data obtained by Meritt Dev Booking, including aggregated, anonymized or derived data, to create, train or improve foundational or generalized AI/ML models. We do not use this data for advertising.

Legal bases (EEA, UK, and Switzerland)

• Contract — to provide the service you sign up for, including account management and billing.
• Legitimate interests — to secure and improve our products, prevent fraud, and support users, balanced against your rights.
• Consent — for non-essential cookies, analytics, and personalized advertising, which you may withdraw at any time.
• Legal obligation — where we must retain or disclose data to comply with law.

Cookies and similar technologies

We use essential cookies for authentication and security, and analytics cookies to understand how our website and products are used (Google Analytics, Google Tag Manager, and PostHog). Analytics technologies load only after you give consent through our cookie banner, where required by law, and you can withdraw consent at any time. See our Cookie Policy for the full breakdown.

Advertising

Some of our products display advertisements. BillBridge shows advertisements through Google AdSense on its free plan and on public marketing pages; paid BillBridge subscribers receive an ad-free dashboard experience. Third-party vendors, including Google, may use cookies, web beacons, device identifiers, or IP addresses to serve and measure ads based on your visits to our sites and other sites. If you decline non-essential cookies, ads may still appear in non-personalized form where permitted. You can opt out of personalized advertising via Google Ads Settings (adssettings.google.com) or aboutads.info.

Service providers and subprocessors

We share data only with the infrastructure and service providers required to operate our products, under appropriate data protection terms. Our providers may include:

• Stripe — subscription billing and payment processing.
• Clerk — authentication and account management.
• Google Calendar and Google Meet — booking events, availability, meeting links and event notifications for Meritt Dev Booking.
• Firebase / Firestore (Google) — data storage for BillBridge.
• Resend — transactional email delivery.
• Vercel — website hosting and deployment.
• Google Analytics, Google Tag Manager, and Google AdSense — analytics and advertising.
• PostHog — product analytics.
• CRM providers connected by customers, such as Zoho CRM, for LeadCall.

Sharing and no sale of personal data

We do not sell personal data. We do not share or sell personal information for cross-context behavioral advertising as defined under California law. We share data only with the service providers described above and when required by law.

International transfers

We use service providers that may process data in the United States and other countries outside your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms offered by our providers.

Data retention

We retain personal data only as long as necessary for the purposes described in this policy, or as required by law — for example, billing records may be retained for up to seven years where required. Analytics and advertising data are retained according to our providers' policies and your cookie choices.

Security

We use industry-standard administrative, technical, and organizational safeguards to protect personal data. However, no online service can guarantee absolute security.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. For BillBridge, you can access, update, or delete much of your account data from within the app. To exercise your rights, email [email protected] with the subject line "Privacy request". If you are in the EEA or UK, you may also lodge a complaint with your local data protection authority, such as the UK Information Commissioner's Office (ICO).

California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, request deletion or correction, and opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising. To exercise your rights, email [email protected] with the subject line "Privacy request". You may use an authorized agent where permitted.

Customer responsibilities

Where you use our products to process personal data about your own clients or contacts (for example in BillBridge or LeadCall), you are responsible for obtaining any notices, permissions, or consents required under applicable law before providing that data to us.

Children's privacy

Our products are business tools and are not directed at children under 13, and we do not knowingly collect personal information from children under 13. In the EEA and UK, we do not knowingly offer the service to children under 16 without appropriate consent. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy with an updated "Last updated" date, and material changes may also be notified through the service or by email where appropriate.

Contact

For privacy enquiries, contact MERITT DEV LIMITED at [email protected], or by post at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.