Skip to content
GetMeritus

Privacy Policy

Last updated: October 15, 2026

1. Who we are and who is responsible

The Meritus platform (getmeritus.org and its mobile app, the “Service”) is operated by OptiMystic Holdings Inc. (“we”), a business based in Quebec. We comply with the Quebec Act respecting the protection of personal information in the private sector (as amended by Law 25), the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, the GDPR.

Person in charge of the protection of personal information
OptiMystic Holdings Inc.
[email protected]

This person is responsible for our compliance, answers your questions, handles your requests and complaints, and keeps our register of confidentiality incidents.

2. What we collect and why

  • Identity and contact: name, email, phone, address, city, province, country, preferred language. Purpose: create and secure your account, contact you about it.
  • Credentials and documents: certification details, oath records, skills, and the files you upload. Files are encrypted at rest with AES-256-GCM. Purpose: build your verifiable credential record.
  • Public profile: name, photo, bio, trades, credentials and their status, and (only if you turn it on) your approximate location. Purpose: let employers verify you.
  • Veteran status (optional): branch, status and an encrypted supporting document. Purpose: show a verified veteran badge if you ask for one.
  • Emergency profile (optional, sensitive): allergies, medical conditions, medications, blood type, emergency contact and, only with a separate express consent, substance-use information. Purpose: let first responders who scan your red emergency QR code help you. It is off until you turn it on, it is never shown on your credential profile, and you can turn it off or clear it at any time.
  • Workplace records: incidents in which you are named and forensic credential reports generated by an employer you work with, and disputes or endorsements about your credentials. Purpose: credential integrity and workplace safety records.
  • Location proofs (optional): if you register a GeoSeal device, its public key and the GPS-signed proofs you choose to create.
  • Payments: amount, plan, date and processor reference. Card numbers are handled by Stripe and never reach our servers.
  • Verification log: when someone checks one of your credentials: date, method, result, country and the verifier's IP address.
  • Technical data: server logs (IP address, page, time) for security; usage analytics only if you accept them in the cookie banner.

We collect only what these purposes need. We do not sell personal information and we do not use advertising trackers.

3. Consent

We ask for your consent in clear terms, separately for each purpose. Sensitive information (your emergency profile, and especially substance-use information) is collected only with your express consent, which you give by switching the feature on. Analytics run only after you click Accept in the cookie banner. You can withdraw any consent at any time from your dashboard or by writing to [email protected]. We keep a dated record of the consents you give and withdraw; you can see it in your data export.

4. Privacy by default

Optional features that reveal more about you (emergency profile, location sharing, analytics, veteran badge) are off by default. Your credential profile is published so that employers can verify you, which is the core purpose of the Service. To hide it from search and public lookup, send a privacy request.

5. Who receives your information

  • Employers and the public: your public profile and credential status, when you or they look up your serial number or QR code. Your email, phone, address and uploaded files are never shown.
  • First responders: your emergency profile, only through your red QR code, and only if you turned it on. Each scan is logged and you can see the log.
  • Employer portals: only those you accept an invitation to join.
  • Service providers acting on our instructions, under contract (see section 7).
  • Authorities when the law requires it.

6. How long we keep it

  • Account and everything attached to it (profile, credentials, uploaded files, emergency profile, skills, portal memberships, consent records): until you delete your account. Deletion is immediate and permanent.
  • Tamper-evident ledger: each trust act (for example a credential issued or revoked) is recorded as a cryptographic hash with identifiers, anchored in Bitcoin through OpenTimestamps. These entries cannot be altered or removed; they contain no document content.
  • Records that belong to other people (a dispute an employer filed, an incident report) are kept for their purpose but detached from your deleted account.
  • Verification log: 90 days.
  • Payment records: as long as tax law requires (6 years after the end of the tax year concerned), then destroyed.
  • Privacy requests: 2 years after they are closed.
  • Server logs: 14 days.

When a purpose is achieved, we destroy the information or anonymize it for serious and legitimate purposes, as the law requires.

7. Where your information is stored and transferred

Our servers and encrypted storage are located in Quebec. Some service providers process information outside Quebec. Before any such communication we assess whether the information will receive adequate protection (privacy impact assessment), and we bind each provider by contract:

  • Cloudflare (network security and delivery, bot protection): traffic passes through its global network.
  • Email relay hosted by Hetzner in the European Union (Finland/Germany): transactional emails.
  • Anthropic (United States): reads a certificate image only when you use the upload assistant, and answers help-desk chat messages.
  • Stripe (Canada/United States): card payments.
  • Expo (United States): push notifications to the mobile app.
  • Google or Facebook: only if you choose to sign in with them.

8. Automated processing

Some outcomes are produced automatically. You can ask us which personal information was used, the reasons and main factors behind the outcome, and ask a person to review it, through the privacy request form.

  • Employer trust score: computed automatically for employer organizations from the violation reports filed against them (severity, age, status, whether the report is sworn or anonymous, size of the employer).
  • Deadlines: a dispute with no escalation after 30 days is dismissed automatically; a violation report with no employer response after 14 days is upheld automatically; a responded report with no follow-up after 14 days is resolved automatically; a credential is marked expired on its expiry date.
  • Upload checks: uploads get a risk score that only flags them for human review. It never rejects anything on its own.

9. Your rights

  • Access to the personal information we hold about you, and to know how it is used and who it was communicated to.
  • Rectification of information that is inaccurate, incomplete or ambiguous.
  • Portability: receive your information in a structured, commonly used technological format. Signed-in workers can do this instantly with “Download my data” in Settings.
  • Withdrawal of consent at any time.
  • De-indexation and cessation of dissemination: ask us to stop disseminating information about you, or to de-index a link to your name, when dissemination breaches the law or causes you serious injury.
  • Deletion: delete your account yourself in Settings, or ask us.
  • Complaint: to us first, then to a regulator (section 11).

To exercise a right, use the privacy request form or write to [email protected]. We answer within 30 days and may ask you to confirm your identity. Requests are free.

10. Security and confidentiality incidents

Uploaded files and sensitive documents are encrypted at rest (AES-256-GCM); all traffic uses TLS; passwords are stored only as salted scrypt hashes; administrator access requires two-factor authentication. If a confidentiality incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned promptly, and we record every incident in our register.

11. Complaints

Write to the person in charge at [email protected] or use the request form (type “complaint”). If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec, or, outside Quebec, to the Office of the Privacy Commissioner of Canada. In the EEA or the UK you can contact your local supervisory authority.

12. Cookies

Essential cookies keep you signed in (meritus_session) and remember your language (meritus_locale). Our first-party analytics (Panoptikon, hosted on our own servers) load only after you accept them in the cookie banner. No advertising cookies.

13. Children

The Service is not intended for people under 16. We do not knowingly collect their information; contact us and we will delete it.

14. Changes

We will post any change here with a new date and email registered users about material changes.