Privacy Policy
Last updated: 14 October 2026
This policy explains what personal information Meridian CPD collects, why, who we share it with and what your rights are.
Who we are
Meridian CPD is run by FistralAI Ltd, a company registered in England and Wales (company number 17091704), registered office 16 Polkerris, Par, PL24 2TL, United Kingdom. FistralAI Ltd is the controller of the personal information described here.
For anything about your information, email hello@meridiancpd.co.uk.
What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Your name and email address when you buy a course, subscribe or claim a free course | To send your course, give you access to My CPD, issue certificates and answer your emails | Contract |
| Purchase records (what you bought, when, the amount, and the Stripe reference) | To provide what you paid for, handle refunds and keep the accounts the law requires | Contract; legal obligation |
| Course progress (when you downloaded a course and when you marked it complete) | To issue your certificate only after you complete a course | Contract |
| Certificate details (name on the certificate, course, CPD hours, date and certificate number) | To issue your certificate and let you, your accreditation body or an employer check it is genuine | Contract; legitimate interests |
| Emails you send us | To reply and keep a record of what was agreed | Legitimate interests |
| Business contact details published on public assessor registers (name, email, scheme, area) | To tell assessors about our CPD courses where the law allows it, and to keep a do-not-contact list of anyone who asks us to stop | Legitimate interests |
We do not see or store your card or bank details. Payments are taken by Stripe.
Emails we send
If you buy from us we send the emails needed to deliver it: your course, your login links, your certificates, and messages about your purchase or subscription.
We only send marketing emails, such as news of new courses, where the law allows it: if you have agreed, or if you are an existing customer and have not opted out. Every marketing email has an unsubscribe link, and you can email us to stop them at any time. Anyone who opts out goes on a do-not-contact list that we keep so they are not emailed again.
Certificate checks
Each certificate has a number and a QR code. Anyone who has the certificate number can open our verification page and see the name, course, CPD hours and date on that certificate. They cannot see your email address or anything else about you.
Who we share it with
We use these service providers to run Meridian CPD. They process information for us under contract and only as we instruct:
- Stripe: takes payments and manages subscriptions
- Supabase: our database, which holds member, purchase, progress and certificate records
- Railway: hosts the app that delivers courses, My CPD and certificate checks
- Resend: sends course, login and certificate emails
- Google Workspace: our hello@meridiancpd.co.uk mailbox
- GitHub Pages: hosts this website
We do not sell your information, and we do not share it with anyone else unless the law requires us to.
Some of these providers store or process information outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations or by the contractual safeguards those providers offer under UK data protection law.
How long we keep it
- Purchase and payment records: 6 years from the end of the financial year they relate to, because company law and HMRC require it.
- Your member record, course progress and certificates: while you have an account with us, then 6 years, so that certificates can still be checked if your accreditation body audits your CPD. You can ask us to delete them sooner.
- Emails with us: up to 6 years.
- Public register contact details: until you ask us to delete them or we stop using them. If you ask us not to contact you, we keep only your email address on our do-not-contact list so we can make sure we never email you again.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the information we hold about you
- correct anything that is wrong
- delete your information, where we no longer need to keep it
- restrict how we use it, or object to our using it, including for marketing at any time
- give you your information in a format you can take elsewhere
Email hello@meridiancpd.co.uk. We reply within one month.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the chance to put it right first.
Cookies
This website uses no advertising or tracking cookies. When you log in to My CPD we set one cookie to keep you signed in; it is needed for the service to work. This website loads its fonts from Google Fonts, so your browser connects to Google when you visit.
Changes
We will update this page if anything changes and show the new date at the top.