Legal
This Privacy Policy explains how Merydia Digital Pty Ltd (ACN 698 772 315) ('Merydia', 'we', 'us', 'our') collects, uses, stores and handles personal information when you submit a founding member application through merydia.app.
We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This policy satisfies our APP 1 transparency obligation for the current waitlist stage of the service.
A more comprehensive privacy policy covering the full matching service — including identity verification, profile data, messaging and credit transactions — will be published before the matching service opens.
If you have questions about this policy or your personal information, contact our Privacy Officer at privacy@merydia.app.
When you submit a founding member application, we collect the information you provide in the form. This includes your first name, age band, location, gender, who you would like to meet, relationship status, dating history, comfort with identity verification, pricing comfort, and email address.
Purpose: to assess your application for founding membership and to determine whether Merydia is a suitable service for you at this stage.
Legal basis: collection is necessary for the purpose of assessing your application (APP 3.3(a)), and you provide it voluntarily.
If you tick the optional marketing consent checkbox in the application form, we collect your email address for the purpose of sending you updates about Merydia's launch and membership availability.
Purpose: direct marketing communications, with your consent.
Opt-out: you can withdraw consent at any time by emailing apply@merydia.app or using the unsubscribe link in any marketing email we send. Withdrawal does not affect the lawfulness of any communications sent before withdrawal.
We use Cloudflare Web Analytics to understand how visitors find and use this website — for example, which pages are viewed, general location (country level), and how visitors arrived at the site. Cloudflare Web Analytics does not use cookies or any persistent identifier, and is designed not to identify individual visitors. This is separate from the advertising cookies described in Section 2.4 below, and operates regardless of your cookie preference choice, because it does not involve cross-site tracking.
Purpose: to understand website usage and improve the site.
Legal basis: this is designed not to identify individual visitors, so this is not expected to require a consent basis under the Privacy Act.
If you accept advertising cookies via the cookie preference banner shown on this website, we use Meta Pixel and Meta's Conversions API to measure and improve our own advertising campaigns on Facebook and Instagram.
This involves sending Meta Platforms, Inc. ('Meta') a cryptographically hashed version of your email address — a one-way transformation that is not intended to be reversed in ordinary use, though it is not the same as fully anonymous data, since Meta may be able to match it against its own records. We do not send your name, phone number, or any other application field to Meta — only the hashed email address, and only if you have accepted advertising cookies.
Purpose: to measure and improve the effectiveness of Merydia's own advertising campaigns.
Legal basis: your consent, given via the cookie preference banner. Cross-border aspects of this disclosure are addressed in Section 6.
You can decline advertising cookies, or withdraw consent at any time, using 'Manage preferences' in the cookie banner, available on every page of this website. If you decline or withdraw, no data is sent to Meta from that point.
As part of your application, we ask you to select your gender (I am a man / I am a woman / I prefer not to say). This is sensitive information under the Privacy Act 1988 (Cth). We collect it with your express consent, for the purpose of assessing your application and, if you proceed past the waitlist stage, enabling gender-based matching in our introduction service. It is used only for these purposes and, like the rest of your application data, is handled only by the processors described in Sections 3.2 and 6 — it is not otherwise disclosed to third parties. You may decline to answer by selecting "I prefer not to say."
Application form responses are initially collected and stored by Tally BV ('Tally'), our form provider, a company incorporated in Belgium. Tally processes data on servers located within the European Union.
Tally acts as a data processor on our behalf under a Data Processing Agreement that incorporates the European Commission's 2021 Standard Contractual Clauses. We are satisfied that these protections are broadly equivalent to what the Australian Privacy Principles require (APP 8). You can review Tally's DPA at tally.so/help/data-processing-agreement.
We export application data from Tally into the Google Sheet described in Section 3.2 within 30 days of submission and delete it from Tally at that point. Form responses are not left in Tally indefinitely.
Application data submitted via Tally is exported into a Google Sheet, which we use to review and manage applications. This Google Sheet is operated through our Google Workspace account, and access is restricted to Merydia's co-founders and any personnel directly involved in reviewing applications.
If we contact you about your application or send you marketing updates (with your consent), emails are sent via Postmark, a service operated by ActiveCampaign, LLC. Postmark processes email delivery data including your email address and delivery metadata. You can review Postmark's privacy policy at postmarkapp.com/privacy-policy.
If you accept advertising cookies (Section 2.4), we disclose a hashed version of your email address to Meta Platforms, Inc., a company headquartered in the United States, for the purpose described in Section 2.4. This disclosure is governed by Meta's Business Tools Terms and Data Processing Terms, available at facebook.com/legal/terms/dataprocessing.
For certain purposes — including measuring and improving advertising across its own platforms — Meta may handle this information as an independent party responsible for its own compliance, rather than solely as a processor acting on our instructions. Meta's data policy, describing how it handles information it receives and for what purposes, is available at facebook.com/privacy/policy.
This disclosure occurs only if you have opted in via the advertising cookie preference described in Section 2.4; if you decline or withdraw that preference, we do not send any data to Meta.
Cloudflare Web Analytics is provided by Cloudflare, Inc., our website hosting and content delivery provider. Cloudflare may process aggregate analytics data, not intended or expected to identify individuals, outside Australia as part of its global infrastructure. On that basis, this is not treated as requiring assessment under APP 8. You can review Cloudflare's privacy policy at cloudflare.com/privacypolicy.
We retain application data in the Google Sheet described in Section 3.2 for up to 18 months from the date of submission, or until the service has launched and you have either been accepted as a full member or confirmed you do not wish to proceed — whichever is sooner.
Form responses are exported from Tally and deleted from Tally within 30 days of submission, as described in Section 3.1.
If you withdraw your marketing consent, we remove your email address from our marketing list within one business day.
If you ask us to delete your application data, we will do so within 30 days, subject to any legal obligation to retain records.
We retain an anonymised record of your cookie consent choice (not linked to your identity) for up to 12 months, so that we can demonstrate our cookie banner was functioning correctly during the period you visited.
We do not sell, rent or trade your personal information. We share it only with:
Other than the advertising measurement disclosure to Meta described above, which occurs only with your consent, we do not share your information with any third party for marketing or advertising purposes.
Tally processes application data in the European Union before we export it to our Australian systems. This constitutes a cross-border disclosure under APP 8.
The transfer is governed by Tally's Data Processing Agreement and the European Commission's 2021 Standard Contractual Clauses, which provide data protection standards that Merydia is satisfied are broadly equivalent to the protections required under the Australian Privacy Principles. Tally is based in Belgium and subject to the GDPR.
Postmark may process email delivery data in the United States. This transfer is governed by ActiveCampaign's data processing terms, which include Standard Contractual Clauses for transfers outside the EEA.
We use Google Workspace, including Google Sheets to store application data (Section 3.2) and Google Apps Script to send transactional confirmation emails, and Google may process and store this data outside Australia as part of its global infrastructure. We have not yet confirmed the specific data region configuration for our Workspace account. Google's data processing terms, which incorporate the European Commission's Standard Contractual Clauses for applicable transfers, are available at workspace.google.com/terms. We consider these terms, together with Google's broader data protection commitments, to constitute reasonable steps for the purposes of APP 8.1, and are working to confirm our Workspace tenant's specific data residency configuration as a follow-up action.
If you accept advertising cookies, the hashed email disclosure described in Sections 2.4 and 3.4 involves sending data to Meta Platforms, Inc. in the United States. This is also a cross-border disclosure under APP 8. We consider Meta's Business Tools Terms and Data Processing Terms, together with Meta's participation in recognised international data transfer frameworks, to be reasonable steps for the purposes of APP 8.1. This disclosure only occurs with your consent via the advertising cookie preference, which provides an additional basis for the disclosure independent of that assessment.
Access. You may request access to the personal information we hold about you. We will respond within 30 days. Contact privacy@merydia.app.
Correction. If any information we hold about you is inaccurate, contact us and we will correct it promptly.
Deletion. You may ask us to delete your application data at any time. We will do so within 30 days subject to any legal retention obligation. This includes requesting deletion of any data remaining in Tally within the 30-day export window.
Withdrawal of marketing consent. You may withdraw marketing consent at any time as described in Section 2.2. Withdrawal does not affect transactional communications related to your application.
Withdrawal of advertising cookie consent. You may withdraw advertising cookie consent at any time using 'Manage preferences' in the cookie banner. This does not affect the lawfulness of any disclosure to Meta made before withdrawal.
Complaints. If you believe we have handled your personal information in a way that does not comply with the Australian Privacy Principles, you may lodge a complaint with us at privacy@merydia.app. We will respond within 30 days. If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. Application data stored in the Google Sheet described in Section 3.2 is protected by access controls and encryption in transit. We limit access to application data strictly to those who need it to review your application.
In the event of a data breach likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
Merydia is intended for adults aged 50 and over. We do not knowingly collect personal information from anyone under 18. If you believe we hold information about a minor, contact us immediately at privacy@merydia.app.
We will update this policy as the service develops. When the matching service opens, a comprehensive privacy policy covering all service functions will replace this document. We will notify applicants who have provided their email address of any material change before it takes effect. The current version is always available at merydia.app/privacy.
Merydia Privacy Policy v2.6 (Waitlist Stage) | Effective 12 August 2026 | merydia.app/privacy