Privacy Policy

Dock (dock.surf) is a trade name of Surf Online ("we", "us", or "our"). This Privacy Policy explains how we collect, use, store, and share personal data when you use Dock.

Surf Online operates Dock (dock.surf) as a trade name, and is registered with the Dutch Chamber of Commerce (KvK) under number 42127201.

We collect information needed to run Dock, including:

• Account data: display name, email (when provided through linked sign-in), avatar, Discord user ID, Meridian user ID, and plan entitlements.
• Linked sign-in data: when you connect Meridian or Discord, we receive profile fields those providers share with us under the permissions you grant.
• Site builder data: page layouts, block content, themes, navbar settings, access rules, custom domain configuration, and uploaded media.
• Bot data: information synced from your linked Meridian bot that you choose to display on your sites, such as user identifiers, reasons, evidence URLs, durations, and related metadata.
• Published-site visitor data: when visitors sign in with Discord to access protected pages, we may receive profile fields and guild membership or role information needed to enforce your access settings.
• Payment data: subscription and billing metadata processed through your Meridian account and Stripe. We do not store full card numbers.

For your Dock account and platform operation, Surf Online is the data controller.

When you publish bot data or other information on your sites, you are the controller for that information and Surf Online acts as a processor hosting and displaying it on your instructions. You must provide any notices and obtain any consents required by law. See our Data Processing Agreement.

Meridian is a separate product with its own privacy practices. Data processed solely within Meridian is governed by Meridian's privacy policy at meridian.surf.

We use personal data to:

• Provide, host, and secure Dock.
• Authenticate users and enforce page access controls.
• Sync and display bot data from linked bots.
• Process subscriptions and plan entitlements.
• Provision custom domains and SSL certificates.
• Detect abuse, fraud, and technical issues.
• Comply with law and enforce our policies.

We do not sell personal data.

We share data only when needed to operate Dock:

• Subprocessors listed in section 6 who host or process data for us.
• Discord and Meridian when you connect those accounts or when your sites verify guild access.
• Legal requests when required by law or to protect rights and safety.
• Business transfers in a merger, acquisition, or asset sale, with notice where required.

We use the following subprocessors to deliver Dock. Each processes only the data needed for its role:

We may update this list as our infrastructure changes. Material changes will be communicated according to our Terms of Service.

We are based in the European Union. Some subprocessors process data in the United States or other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission for transfers from the EEA/UK.

We keep account and site data while your account is active and as needed to provide the Service. When you request deletion, we delete personal data within a reasonable period, unless a longer period is required by law.

If we terminate your account for abuse or legal reasons, we may retain relevant data for investigations, dispute resolution, or legal hold.

Temporary signup and OAuth state data expires automatically on shorter schedules.

We use technical and organizational measures to protect data. No method of transmission or storage is completely secure.

Reporting bugs. Sensitive issues (authentication, sessions, unauthorized access to site data, or exposure of private user information) should be reported to us directly. Do not post exploit steps, tokens, or customer data in public channels.

Do not run bulk scans, credential stuffing, or denial-of-service tests against production. If you accidentally access data you should not have, stop and report it.

Contact: security@meridian.surf. Qualifying security reports may receive a bounty or account credit at our discretion. Nothing here is a binding offer.

Surf Online uses cookies and similar technologies on Dock (dock.surf) and published sites to operate the Service and keep you signed in.

Cookies are small text files stored on your device.

Strictly necessary cookies. These are required for Dock to work:

• Session cookies that keep you signed in to the Dock dashboard.
• OAuth redirect cookies that route you back to the correct page after sign-in.
• Published-site cookies that store Discord identity and access tokens for page access checks.

Blocking these cookies may prevent you from signing in or accessing protected pages.

Analytics. Dock does not use third-party advertising or analytics cookies. We do not sell cookie data.

Your choices. Most browsers let you block or delete cookies. Essential cookies are required for core features.

Depending on where you live (including the EEA, UK, and California), you may have rights to access, correct, delete, restrict, or port your personal data, and to object to or withdraw consent for certain processing.

You can:

• Contact us at legal@meridian.surf to request access, correction, or deletion.
• Object to processing where applicable law gives you that right.
• Lodge a complaint with your local supervisory authority.

Site operators may embed third-party content in pages they build. Those services may collect data under their own policies when a visitor interacts with an embed. Review their privacy terms before adding embeds to your site.