meterless Privacy Notice

Version 1.4. Effective 6 October 2026.

This notice explains what personal data meterless collects, why, who sees it, where it is kept, for how long, and what you can do about it.

1. Who is responsible

Meterless Limited, Office A, Innovation City Business Centre, RAK Bank ROC Office, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah 30099, United Arab Emirates, is the controller of the personal data described in sections 3 to 5. You can contact us about your data at privacy@meterless.com.

What you put inside your studio is yours: section 2 says what we do not do with it, and section 6 says where it runs. If you put other people's personal data in your studio, you decide what it is and why you use it, and you are responsible for it under the law that applies to you (Terms, section 13). We handle it only to run your studio for you, and as section 2 says.

We are established only in the United Arab Emirates. Our representative in the European Union, the European Economic Area, the United Kingdom and Switzerland for data protection, and our legal representative in the European Union under the EU Digital Services Act, is Data Protection Representative Limited (trading as DataRep). You can contact DataRep about meterless:

• by email to datarequest@datarep.com, quoting "Meterless Limited" in the subject line;
• through DataRep's online form at www.datarep.com/data-request;
• by post, at DataRep's address for your country, listed under "DataRep's postal addresses" at the end of this notice. Address your letter to "DataRep", not to Meterless Limited, or it may not reach DataRep.

DataRep is registered in Ireland, number 616588, at 77 Camden Street Lower, Dublin, D02 XE80, Ireland.

For the EU Digital Services Act, our legal representative's details are: DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland; digitalrequest@datarep.com; +353 1 919 8899.

DataRep handles data-protection matters only; for questions about the service, contact us at support@meterless.com.

2. What we do not do

• We do not read, index, publish or share what you make or store in your studio, except:
  • when you ask us to look, for example to help with a problem;
  • when our automated checks run on it, when they flag something, or when we review for abuse, going no further than needed (section 3);
  • when the law requires us to disclose it, or we report a breach (section 4); or
  • when you use a model marked on its page as running on a third-party service. That service receives the prompt and inputs you send to the model, under its own terms, which the model's page links to.
• We do not use anything you make or store to train any model, ours or anyone else's.
• We do not sell personal data, and we do not share it for advertising.
• We do not use analytics or advertising cookies, session replay, or keystroke capture.
• We do not buy data about you from third parties.
• We do not pass your name, email address or account details to the data-centre supplier whose machine runs your studio, unless the supplier needs them to deal with a legal request or an abuse complaint about your studio, we give them information about a breach as section 4 says, or the law requires it.

3. What we collect, and why

When you join the waitlist. Your email address, the time you signed up, and where the signup came from. We use it to send you the confirmation you asked for and, when the founding cohort opens, an invitation. We do not store your IP address.

When you open an account. We collect:

• your email address and the country you tell us you are in;
• the country of your connection when you sign up (a country code only);
• your sign-in tokens, second-factor settings, and any SSH public keys and access tokens you add;
• your plan and hours balance;
• records of your sessions: which studio, when it was opened, paused, resumed and closed, and the hours used.

If you sign in with Google, Google gives us your email address, your Google account identifier and basic profile details, such as your name. We tell Google nothing about your use of meterless beyond the fact that you signed in. Google handles the sign-in under its own privacy policy.

We use this information to run your account, to place your studio in a location suitable for your country (section 6), and to apply the make-good.

When you pay. You buy your subscription from Paddle, our reseller and Merchant of Record (Terms, section 7). Paddle collects your payment details, billing address and the evidence it needs for tax on its own checkout, as an independent controller under its own privacy notice. Your card number never reaches us. Paddle shares with us your name, email address, billing country and any other billing details it passes to sellers, your subscription and transaction records, and the brand and last four digits of your card, and we record the country of your connection when you pay (a country code only). We use these to run your subscription, to place your studio (section 6), to handle renewals, cancellations, withdrawals, refunds and payment disputes, and to prevent refund abuse.

Sanctions screening. Your country is checked at signup, and your name and country when you pay and at intervals afterwards, against the sanctions lists of the United Nations, the United States, the European Union, the United Kingdom and the United Arab Emirates. We keep the result. We screen because our suppliers and our reseller require it, and to comply with the sanctions laws that apply to us and to them.

Automated checks. Some checks are automated. Signups from a country where meterless is not available are refused automatically. A possible sanctions match, or an automated check under section 10 of the Acceptable Use Policy, can pause your studio or hold your account automatically while a person looks at it. No account is closed by automated means alone: a person reviews the evidence before an account is closed. You may ask a person to look again at any automated refusal, pause or hold, give your view and contest it, at privacy@meterless.com. Paddle runs its own automated fraud and sanctions checks at checkout; ask Paddle at paddle.net about a payment Paddle has declined.

When you visit the site or use the app. GitHub, which hosts the site, and Cloudflare, which fronts the app, each process your IP address and browser details to deliver the pages and protect against attacks, and keep their own logs for a short period; Cloudflare does so under its data-processing terms with us. We do not copy those logs into our own systems, and we look at Cloudflare's security records only to deal with an attack. Our own application logs record what happened (which page, when, which account). To decide where your studio runs and where your saved work is kept, we use the country you give us, the country of your connection when you sign up and when you pay (worked out by our network provider), and your billing country. When your browser connects to your studio, the connection passes through our edge, which removes your IP address before anything reaches the data-centre machine your studio runs on.

When you write to us. Your name, email address and what you write, at any of our addresses. We use it to answer you.

Checks and reviews for abuse. No person reads your files, prompts or outputs as a matter of course. Section 10 of the Acceptable Use Policy sets out the automated checks we may use: technical signals such as GPU, process and network activity; checks of outputs made with the studio's built-in tools for sexually explicit content and child sexual abuse material; and matching of stored files against lists of known illegal material. A check that flags something leads to a review, and we may also review when a report, a data-centre supplier, Paddle or an authority gives us reason to believe the Acceptable Use Policy or the law has been broken. A review may look at activity, inputs, outputs and stored files and goes no further than needed. The data-centre supplier whose machine runs your studio may also watch its own hardware and network for abuse. We keep a record of what we reviewed, what we found and what we did. When we act, we tell you, with the exceptions in section 10 of the Acceptable Use Policy.

The legal basis for each use.

Where we rely on legitimate interest, you may object (section 8).

What you must give us. To open an account you must give us your email address and your country, and to buy a subscription Paddle needs your payment and billing details. Without them we cannot provide the service. The sanctions-screening and tax records in this section are needed for us to offer the service at all. Everything else you give us is optional.

4. Who we share it with

We share personal data only with the providers we need to run meterless, each under a contract that binds them to protect it, and as this section says. We do not share it with anyone for their own marketing.

We may disclose personal data to a court, regulator or law-enforcement body where the law requires, to protect someone's safety, or when we report suspected illegal activity. We may give information about a breach of the Acceptable Use Policy, including content and account details, to the data-centre supplier whose hardware was involved and to Paddle, as far as needed to stop the breach, meet a legal duty, or protect people or our service. If a public authority asks us for your data, we tell you and give you a copy of the request, unless the law prohibits it, the authority asks us not to for an investigation, or telling you would put someone's safety at risk.

If meterless is sold or merges, your data may transfer to the new owner, who must use it in line with this notice. We tell you before your data comes under the new owner's control.

5. How long we keep it

Our encrypted backups are replaced on a rolling basis, so a copy of deleted data can remain in a backup for a limited period before it is overwritten. We do not restore deleted data from a backup except to recover from an incident, and if we do, we delete it again. Any period in this section can be extended where we need the data to establish, exercise or defend a legal claim, where we preserve it under section 10 of the Acceptable Use Policy, or where a court or authority requires us to keep it.

6. Where your studio runs, and international transfers

We are in the United Arab Emirates. When you give us your personal data, you give it to us in the UAE, and the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection apply to how we handle it, which is why we have appointed DataRep (section 1). Our providers process it in the countries in sections 4 and 6. We and our providers may also access it from other countries where we or they work, to run and support the service, under the same contracts and safeguards. Personal data can therefore leave the country you are in.

Your studio. If your account is European under the Terms (section 3: the country you give us, your connection country or your billing country is in the EEA, the UK or Switzerland), your studio runs on data-centre capacity inside the EEA or the UK whenever European capacity is available. When it is not, your studio may run in Canada or the United States, only on a supplier under a data-processing contract with us. Your saved state is stored in EU-jurisdiction storage whichever country the studio ran in. The connection between your browser and your studio passes through our edge server in or nearest to the region of the machine, and never through our control plane. If your account is not European, your studio may run on any of our capacity, including in the United States, and your saved state is stored in the United States.

Safeguards. Where personal data goes to a provider in a country that European data-protection law does not recognise as giving adequate protection, our contract with that provider includes the European Commission's Standard Contractual Clauses, with the UK and Swiss versions where they apply. You can ask us for a copy of the safeguards for any provider at privacy@meterless.com.

7. Cookies

The app uses a small number of strictly necessary cookies and browser storage to keep you signed in, protect the app against attacks and run the tools in your studio. Paddle's checkout and Google's sign-in use their own cookies. There are no analytics or advertising cookies. The Cookie Notice lists them.

8. Your rights

Wherever you are, you can:

• see and export your account data from the account page, and your studio contents from your studio;
• correct your email address and country on the account page;
• delete your account from the account page. Your subscription is cancelled, your data is marked for deletion, and you have 7 days to reverse it. Deletion completes within 30 days of your request, except the records section 5 says we keep;
• restrict processing, and withdraw consent where consent is the basis, by emailing privacy@meterless.com;
• ask us anything about your data at privacy@meterless.com.

Your right to object. You may object at any time to processing we base on legitimate interest. We then stop, unless we have compelling grounds to continue or need the data for a legal claim. Sanctions screening, tax and accounting records, the security of the service and checks for abuse are conditions of providing meterless. We consider any objection to them, but we continue them for as long as you have an account, because we have compelling grounds to do so. If you do not want them to continue, you can close your account. Records that must be kept for the periods in section 5 are kept even if you object or ask us to delete them; when we answer your request we tell you which, and why.

If you are in the EEA, the UK or Switzerland, these are your rights under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, and you also have the right to portability of the data you gave us.

US residents. Whether or not a particular state's privacy law applies to us, we give residents of every US state the rights in this section: to know and access the personal information we hold, to receive a copy, to correct it and to delete it. We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising, so there is nothing to opt out of. We use sensitive personal information, such as your sign-in credentials, only to provide the service. If we refuse a request, you may appeal by replying to our answer or by writing to privacy@meterless.com, and if you are unhappy with the result you may contact your state attorney general. An authorised agent may make a request for you with proof of authority. We do not treat you differently for using these rights.

If you are elsewhere, we give you the same rights in any case.

We answer requests within one month; if a request is complex we may take up to two further months and we tell you why. We may ask you to confirm your identity through your account before we act. We do not charge for requests unless they are manifestly unfounded or excessive, in which case we tell you the cost first.

Complaints. If you are unhappy with how we handle your data, tell us first at privacy@meterless.com. You also have the right to complain to a supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk); in the EU your national authority (list at edpb.europa.eu); in Switzerland the Federal Data Protection and Information Commissioner (edoeb.admin.ch). You may contact our representative DataRep instead of us for any of this. As a UAE company we also handle personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and you may also complain to the UAE Data Office.

9. Children

meterless is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have, tell us at privacy@meterless.com and we will delete it, apart from any payment record we must keep.

10. Changes

We will revise this notice when our processing changes. If a change reduces your rights or adds a new purpose, we tell you by email at least 30 days before it takes effect. The version and date are at the top. Past versions are available on request.

DataRep's postal addresses

Write to DataRep at the address for the country you live in, addressing your letter to "DataRep". DataRep may change these addresses; when it tells us, we update this list. For email and the online form, see section 1.