Meya

GDPR overview

GDPR compliance is claimed explicitly and documented on a dedicated page. Meya positions itself as a data processor under Article 28 and publishes a signable data processing agreement, sent for electronic signature within two business days of a request to its privacy address. Access and erasure requests are handled through the same address, with an account ID and a Meya user ID. Eight subprocessors are named publicly: AWS, Smooch, Sentry, PubNub, Pusher, Google Geocoding, Google Translate and Wit.ai, each under its own agreement. Transfers outside the EEA rely on the standard contractual clauses of Decision 2010/87/EU, and the agreement also covers the CCPA. Two gaps stand out: no Article 27 EU representative is designated anywhere, and the privacy policy dates from January 2020.

Who owns the data?

The customer owns its data. Section 6(b) of the terms states that the customer retains all right, title and interest in Customer Data and acts as data controller, while Meya acts only as data processor on the customer's behalf. The data processing agreement adds that Meya has no right to sell, rent, lease, combine, display, modify, transfer or disclose Customer Data outside the customer's written instructions. Meya reserves a narrower access right for support, administration, anonymised data aggregation, invoicing and compliance checks. The platform itself, its code and its documentation remain Meya intellectual property, licensed rather than transferred.

Reuse rights

End users of the platform, meaning Meya's business customers, may reuse their own data freely and without asking permission: they own it as data controller, and Meya only processes it on instruction. The service level agreement commits Meya to giving customers either the means to export Customer Data themselves or a full export in downloadable formats on request, and the terms give Meya ten business days after termination to hand a copy back. Reuse of the platform itself is far more restricted: the licence is non-transferable, limited to internal use, and explicitly forbids acting as a service bureau for more than one third party or accessing the service for competitive purposes.

Data retention & training

Hosting summary

Meya's services are hosted on Amazon Web Services. The terms state that the platform is served from a third-party hosted facility located in the United States, and the privacy policy confirms that servers and the central database sit in the United States, warning users outside the country that their information may be transferred, stored and processed there. AWS is named as the main subprocessor, hosting and storing the majority of user data. The privacy policy notes that Amazon's data centres are accredited under ISO 27001, SOC 1, 2 and 3, PCI Level 1, FISMA Moderate and Sarbanes-Oxley; these are Amazon's accreditations, not Meya's. Cloud hosting is the default on all three plans. Single tenancy, a custom cloud provider and custom regionality are listed as possible on the Partner plan only, while on-premises and hybrid cloud hosting are offered on no plan. The service level agreement adds at least one redundant data store, updated daily.