Legal

Privacy Policy

Last updated: 15.10.2026 · Effective: 15.10.2026 · Version 2.25 (self-hosted; replaces the policy previously hosted by iubenda)

1. Who we are and what this policy covers

Meridian SEO, LLC ("Meridian", "we") is a New York limited liability company at 157 Columbus Ave Floor 4, New York, NY 10023. We design websites, do search and AI-search optimization, and build custom business systems mainly for businesses in Harlem and across New York. Those systems are a CRM with AI agents, a booking calendar and an AI receptionist.

This policy covers: the website meridianseo.ai and its pages; the Meridian platform you sign in to; the $1,000 Website AI Assessment; the creative jobs we consider or take on through a freelance marketplace (today, Upwork); our own "Questions? Ask us" concierge, including the Telegram chat behind it; and the email, text and phone conversations you have with us.

It does not cover websites we build or host for other businesses. Those sites carry their own privacy policy, and that business, not Meridian, decides how its customers' information is used. Section 12 explains what we do for them.

2. What we collect

When you visit our website

• Technical data your browser sends with every request: IP address, browser and device type, language, the page you asked for, the page you came from, and the time. Our hosting provider keeps standard server logs.
• Company-level visit data from our own visitor tag, after you accept analytics: it sends the page path and the referring page, with no cookies. We resolve the IP address to a company in memory and discard the address; residential, mobile and VPN addresses are dropped, so an individual at home is not identified. What we keep is the company name and domain, the pages viewed and the visit count.
• A visitor-identification service, a third-party service that identifies visiting businesses. It loads only after you accept analytics, and it collects your IP address, browser details and the pages you view under its own privacy policy.
• AI-crawler detection. We record when an AI search engine's crawler (for example GPTBot, ClaudeBot, PerplexityBot) fetches a page, and when a person arrives from an AI search result. We keep the engine name, the page and the user agent.
• Referral cookie. If you arrive through a referral link, a first-party cookie (meridian_ref) remembers the referrer for 30 days so we can credit them.
• Embedded videos. A video on our site, such as the before-and-after on our production page, loads nothing from its host until you press play. Pressing play sends your IP address and browser details to that host (YouTube, using its privacy-enhanced address, or our video host), which may set its own cookies and acts under its own privacy policy.
• Your choices: your language (EN/ES/FR) and your analytics answer, stored in your browser.

When you fill in a form, book, or message us

• Contact and enquiry forms, "Book a call", the waitlist, the Done-For-You intake, the Product Photo Pack inquiry form: your name, email, phone, business name and website, your answers, and preferred times. Some forms save what you have typed as soon as you enter an email address, so we can follow up if you do not finish; those rows are marked as partial.
• Signing a written agreement on the agreement page: your name, title, email, phone, business name and address, the website address you give us if you already have one, the name you type as your signature, your confirmation that you agree, which version of the agreement text you signed, and your IP address, browser details and the time you signed. We keep it as the record of what you signed, for as long as we need it to enforce or defend the agreement and to meet our tax and accounting duties, and we email a signed copy to you and to us.
• The concierge and chat: the messages you write, the language you wrote them in, and an automatic translation if the person answering reads another language. If you open the chat on Telegram, we store your Telegram chat id so replies reach you; Telegram processes the messages under its own policy.
• Voice notes you leave on the contact page are transcribed to text by a speech-to-text service; we keep the text, not the audio.
• The $1,000 Website AI Assessment: your website address, your name and email, the language of the page you ordered on, up to 3 competitor domains if you name them, the IP address and browser your order came from, and the report we generate about your site. We also note how you reached the order form: which of our own links you used (our flyer or business card's QR code, a walk-in handout, a Revenue Leak Report, an affiliate's page or one of our emails), recorded as that label and nothing more, and the affiliate code if an affiliate referred you. If you choose to pay in two parts, we record when each part arrives. For the two reports included with it, we also collect details of your Google Business Profile and the public Google reviews of your business, which we fetch through a web-scraping service to build the Revenue Leak Report. Those reviews include the reviewer names Google displays alongside them. For the Google Business Profile Report, we may also read details of your profile through a Google Business Profile data service (see "When we prepare a Google Business Profile Report" below). If the month's limit on assessments has already been reached when you send the order form, no order is created; we keep your name, email, website address and IP address on a waitlist instead, so that we can email you personally when we can take your order.
• QR codes we print for our own materials: when you scan one, we record the country, region, city and postal area of the connection, the device type, a salted hash of the IP address (not the address itself), and the referring page.

When you apply to the affiliate program

• Your application: your name, email, ZIP code, city or market, the page name you choose, the line you write about yourself, who referred you, and your photo if you send one. Your name, photo, line and market are what appear on your public affiliate page; nothing else on this list does.
• Your resume, which is required. It is stored privately, read only by Meridian, never published on your page or anywhere else, and never sent to an AI model.
• Payment and tax details: your PayPal address, your legal name, entity type, mailing address, and the signed W-9 you upload so we can issue a 1099 if you earn $600 or more in a year. We record only that a form is on file and who reviewed it. Your taxpayer ID number is never stored in our database, and the signed form itself is held in private, access-controlled storage.

When you hire us for creative work through a marketplace

• The job: the name we file it under (which may be your name on the marketplace), the marketplace's reference for it, your brief as you sent it, the language we write to you in (and the language you wrote in, if it is a different one), the deadline, the price, the marketplace's fee, what bidding on it cost us, what we were paid, the job's progress and dates, the checklist we tick ourselves before any work starts (for example, that you own the photos or have the right to use them), and our own notes on how the job went. We start this record when we first consider a job, so it also exists for a job you posted that we looked at or bid on but did not get.
• Your product photos, which we upload ourselves. Before a photo is saved, we remove the details a phone or camera stores in the file beside the picture, such as where and when it was taken and the camera's make, model and serial number. If a phone has attached a second picture or a short video to the end of the file, we remove that part entirely.
• Notes for a later job: so that a later job for you can start from what we learned, we may keep a short card with the name we use for you, your name or handle on the marketplace, the language to write to you in, notes about your brand, its colours, fonts and tone, what you turned down before, and our own notes.
• How it reaches us: we type these details in ourselves from what you post or send on the marketplace. Meridian does not connect to the marketplace or collect anything from it automatically. Messages between us are sent and kept by the marketplace, under its own privacy policy; apart from your brief and your photos, we do not keep copies of them.
• Payment goes through the marketplace, under its terms. Your card and bank details never reach us; we record only what was paid and when.

When you have an account

• Account data: email, a hashed password, sign-in sessions, your dashboard preferences, and the businesses you manage.
• Business data you enter: business details, hours, branding, photos, logos, products, pages, blog posts, keyword targets, prospect lists, campaigns and the settings for each tool.
• Connected accounts, only when you connect them: Google Search Console and Google Analytics (read-only), Gmail and Google Calendar (read and draft; we never request permission to send mail from your account; if you use our booking calendar, we read only the start and end of the times your Google Calendar shows you busy, never what an event is, so those times cannot be booked), YouTube, Google Business Profile, Shopify (read-only product, inventory, theme and content data). We store the access tokens encrypted. Social media accounts you connect for posting (Facebook Pages, Instagram, Threads, TikTok, Bluesky, and Pinterest later): we store the sign-in encrypted and delete it the moment you disconnect; we publish only a post you approved, or a post in a week you approved on the calendar, and nothing else; and we read back each post's public numbers (views or reach, likes, comments, shares, saves). Media made or edited with AI is labelled on the platform where it has a field for that, and the caption says so. Our booking calendar can also give you a private link that shows your bookings, with your customers' names and contact details, in your own calendar app; anyone who has the link can read them, so keep it private and tell us if it has been shared.
• Your own AI keys, if you bring your own provider key: stored encrypted and used only to call that provider on your behalf.
• Mailbox imports, if you use the email follow-up tool: the messages you export from your own inbox, including the names, addresses and text of the people who wrote to you.
• Usage: which dashboard pages you open and the actions you take, through a product-analytics service with session recording switched off, and error reports through an error-monitoring service with personal fields scrubbed.
• Payment records: what you bought, when, and the PayPal or card-processor customer and transaction ids. Card numbers never reach us.
• Support: the messages you send us from the dashboard and by email, and the replies.
• The no-cost QR code generator: if you sign up on that page, your business name and email address, the language of the page, and whether you ticked the box to hear from us and, if you did, the words beside the box and the time. We email you one sign-in link, which also confirms your address; there is no password. Your QR codes, the links they open and each scan of them are kept for you: the country, approximate city, device, browser, the page that sent the scanner, the time and, when the scanner is on an office network, the company. We keep a one-way scrambled form of the scanner's network address, never the address itself. We also add you to Meridian's own list of people to follow up with, and we write to you about Meridian only if you ticked the box.

Preview websites for businesses without one

When we build a preview website for a local business that has no website, we use the business's public Google listing: its name, category, address, phone number, opening hours, rating and number of reviews. We do not copy reviews or reviewers' names. The preview sits at a private link we send to the business. If the owner customises it, we keep their choices of colours, headline, the services they list and their booking link; the photos and logo they upload; and, when they approve the site's privacy, terms and refund pages, the date, the name they type, and a fingerprint of the text they approved. We remove location and camera details (EXIF/GPS) from every uploaded photo before we store it. Uploaded photos are public: they appear on the preview and, once the site launches, on the business's website.

When we prepare a Revenue Leak Report about your business

If you run a local business that has not bought from us, we may prepare a Revenue Leak Report about it to show you what we do, and give you a private link to the page. We build it from information that is already public:

• Your public Google reviews. We collect up to 60 of the newest reviews of your business through a web-scraping service, including the reviewer names Google displays. We keep them privately and do not add a reviewer's name to your page.
• Your public website. We may read your home page and up to nine more of its pages, directly from our own server, and send the words on those pages to an AI provider so that it can flag wording that points away from your business, such as the name of a different business. We keep only the exact phrases it flags, the page each one is on, and the title and main headings of your home page. We do not keep the rest of the page.
• Search phrases. We may also look at a list of search phrases that a keyword-research service estimates your website can appear for. We paste the list in ourselves, and an AI provider judges which phrases are about something else. We keep the list with your page.
• Contact details your website publishes, such as an email address and the names it lists, so that we can write to you. They are never shown on your page.

The page summarizes what we found. For one issue that we choose, it also shows up to two of your customers' review quotes (we do not add the reviewer's name), a dollar range with the math behind it, and a suggested fix. An AI provider translates the lines about that issue into Spanish and French. A person at Meridian checks anything about your website, and the issue shown in full, and approves it before it appears on your page. What we collect for this is stored in a record that only Meridian's administrators can open.

When you give us your mobile number in person

If you meet Garnett, Meridian's owner, in person, give him your mobile number and ask him to text you something, he may text you from his own phone. The text says who it is from, links to a private page about your business (see "When we prepare a Revenue Leak Report about your business" above), and ends by telling you how to stop. The link is a short one on meridianseo.ai.

We keep the number and the date and time he opened or copied the text in order to send it to you. If you reply STOP, we also record that with your number, so that we do not text it again. They are stored with that report, which only Meridian's administrators can open, and they are never shown on the private page. Our activity log records only the last four digits of the number.

Garnett sends the text himself, from his own phone and his own number. Our servers do not send it and we use no texting service for it, although, like any text, it travels over the phone networks.

The short link is one of our tracked links. Each one is made for a single business, so when it is opened we can see that it was opened and when, and we log the visit the way we log a scan of one of our QR codes (see "QR codes we print" above).

When we prepare a Google Business Profile Report

The Google Business Profile Report that comes with the Website AI Assessment grades your Google Business Profile against best practice. To fill in the answers it grades, Meridian's owner may use a back-office tool that reads Google Business Profile data through a Google Business Profile data service. Only Meridian's administrators can use the tool, which today means its owner alone; no customer and no affiliate can reach it. Meridian's owner signs in to the service with his own account, and that sign-in is stored encrypted on our server and is never shown or sent to a browser. The service acts for Meridian as a service provider.

For a business's report, the tool may read:

• Profile details: the categories, services, attributes, opening hours and description on the profile; how many photos and posts it has and when the latest post went up; how many reviews it has, its average rating and the share of reviews that have a reply; and, over a date range, how often it appeared in search and how many calls, clicks and direction requests it received.
• Local search position: where the business ranks in local Google search for the keywords we choose.

It reads a business in one of two ways. The first is a profile whose owner has given Meridian's owner access to it in the service. The second is the business's public listing, looked up by business name and location. The second way can cover a business that has not bought anything from us, so that we can prepare a report or an assessment for it.

The service receives the business name and the place being looked up, the keywords we check, and Meridian's owner's sign-in. Reviewer names and the text of review comments may be read, so that the reviews can be counted and rated, but they are not stored in the report draft. What we store in the draft is counts, rates, dates and ranking positions; the business's name and address as shown on its profile; and the date the data was read. No AI model reads this data. The score comes from the same fixed formula described in Section 4, with no AI involved, and Meridian's owner reviews every report before it is sent to anyone.

When we turn a client's long video into short clips

If a client hires us to cut a long video into short clips, Meridian's owner does the work in a back-office tool. Only Meridian's administrators can use it, which today means its owner alone; no customer and no affiliate can reach it. The client gives us the video file. It may show or record people who work for the client, its customers or other people. We hold the video and everything we make from it for the client, as Section 12 describes, and the client is responsible for having the right to give it to us, as our Terms of Service say. We use the same tool, in the same way, for Meridian's own videos. In the tool:

• The video and its sound. The video file is kept in private storage. We pull the audio out of it, cut the audio into pieces of up to 20 minutes and send the pieces to a speech-to-text service, which sends back the words with their timing. That service may be reached through our AI media provider, which passes the audio to the company that runs the speech model; then each piece is a temporary copy in our private storage, reached through a private link that stops working after 30 minutes, and we tell the provider not to keep the request. The audio we send is a temporary file, and we delete it after the call. We keep the text, not the audio. The service keeps data under its own terms.
• Choosing the moments. We send an AI provider the transcript (the words spoken), the business's researched keywords, a short profile of its customer and the moments the owner turned down before. It proposes which moments to clip, writes the text shown on screen, writes a title and a description to post with each clip, and translates the captions into Spanish and French. We wrap that text as data, so instructions hidden in it are not followed.
• Finding where the speaker is. We send an AI provider three small still pictures cut from a finished clip, for one purpose only: to tell which third of the frame the speaker's head is in (left, center or right), so that text on the screen can go on the other side. The provider is told not to identify or describe anyone. The pictures are temporary files that we delete straight after. All we keep from them is one word: left, center or right.

We do not identify the people in the video, we build no face data from it, and we do not use it to train anything. The tool posts nothing by itself, and Meridian's owner reviews every clip before a client sees it. When a client asks us to, we upload a finished video to the client's own YouTube channel by hand and show it on the client's website, and only when everyone who can be recognised in it has signed the client's written release (a parent or guardian signs for anyone under 18). What we keep, and for how long, is in Section 8.

When our software works for a business you deal with

If you fill in a form on a website we host, book an appointment, join a waiting list for an appointment, join a loyalty program, call or text an AI receptionist we run for a business, or chat with its concierge, we hold that information for that business: your name, contact details, message, appointment details, the days and times you said suit you and answers to the business's own questions, the transcript of the call or chat and, for phone calls, a recording. On a waiting list we keep your place until the business marks it booked or takes you off the list, and the business can have us email you, in the language you used, when a time opens. If you tick the box asking a business to email you when new dates open, or join its waiting list, we also keep your name, email address, language, the words you agreed to and when, and the business can have us email you its new dates; every such email has a one-click unsubscribe link that takes you off that business's list only. See Section 12.

When you sign up on a funnel page

A funnel page is a single page, on a business's website or reached from a flyer or QR code, with one form for joining that business's mailing list. If you use one, we hold what you type for that business (Section 12): your name and email address, your phone number if the page asks for it, your answer to the one question the page may ask, the words of the consent line shown beside the box and the time you ticked it, whether you came from a QR code or a link, and the address of the page. We use your IP address only to limit repeated sign-ups, and we do not save it with your sign-up. The business sees your sign-up in its own dashboard, gets an alert by email, Telegram or browser notification, can download its list and can delete any sign-up. Our software lets the business send an email to everyone on its list; every email carries the business's name, a way to reply to the business and a one-click unsubscribe link. When you unsubscribe, we keep your name and email with the date you unsubscribed, so that the business's software does not email you again. If the page offers more than one language, we also keep the language you chose to fill the form in. If you type a free-text answer in Spanish or French, that answer is sent to an AI model provider to be translated into English so the business can read it (Section 4 describes how we use AI providers; we send only that text), and the business sees both your own words and the English version. Meridian's own waiting list also asks what type of business you operate, your website if you have one and who referred you, and keeps those answers with your sign-up in the same way. On Meridian's own waiting list, if you give us your website, we read that one public page to prepare an Answer-Ready Check for you (a score, three fixes and a headline from keyword research), we keep the result, and after a person at Meridian has reviewed it we show it to you at a private link that we email you. We do not change your website. If a referral link brought you, we also keep the code of the affiliate who referred you, so that person is credited if you buy; that affiliate can see your first name, the date you joined and whether you have been invited, and nothing else. If you agreed to it when you joined, we also send you a short series of emails while you wait, in your language, each with a one-click unsubscribe link. If the page is Meridian's own (on meridianseo.ai), Meridian is the business: we use what you give us to send you what you asked for and to write to you about Meridian, and this policy applies directly.

3. Why we use it

• To provide what you asked for: answer an enquiry, run and deliver an audit, book a call, build and host a website, do the creative work you hire us for, run the tools in your dashboard (including a business's funnel pages and mailing list), and bill you.
• To answer you quickly, including with an AI assistant that replies first when nobody is available (Section 4).
• To understand what works: which pages businesses read, which content brings enquiries, whether AI search engines cite us, and which creative jobs are worth bidding on.
• To keep the service safe: rate limits, fraud and abuse detection, audit logs of staff access, and detection of automated attacks.
• To tell businesses about our services: we send business-to-business email to companies we think we can help. Every such message carries our postal address and a working unsubscribe link, and we stop when you ask. We also text a business owner when the owner has given Garnett their mobile number in person and asked him to text them (Section 11). That text says who it is from and how to stop, and we stop when you ask.
• To meet legal obligations: tax and accounting records, responding to lawful requests, enforcing our terms.

Where a law requires a legal basis, ours are: performing our contract with you; your consent (analytics, marketing messages you opt into, connected accounts); our legitimate interests in running, securing and improving the service and in reaching businesses that may want it; and compliance with law.

4. AI and automated processing

We use AI models to do part of our work, and we say so wherever it happens:

• Chat, Telegram concierge, SMS and phone receptionist. If a person is not available within a short time, an assistant answers first, introduces itself as an assistant, and a person can take over the conversation at any moment. On the phone, the call itself is handled by a voice-call service, which transcribes and answers in real time and sends us the transcript, a recording and a summary.
• The $1,000 Website AI Assessment's report is 100% AI-generated, and the page you buy it from says so before you pay. Two more reports and an in-depth SEO audit come with it. The Revenue Leak Report is generated automatically, in the same run as the report: it uses an AI model to group the public Google reviews of your business into recurring complaints; every quote it keeps is checked word for word against the original review, and anything that does not match is dropped. The Google Business Profile Report is prepared by Meridian's owner within 72 hours of your report being delivered, and is scored against best practice by a fixed formula, with no AI involved. He may pre-fill the answers it grades from Google Business Profile data (Section 2); no AI model reads that data, and he reviews every report before it is sent to anyone. The in-depth SEO audit is prepared by hand by Meridian's owner, with AI tools assisting: an AI provider receives text from your website and from the public pages of the competitors you name, and a keyword-research service receives search terms. The audit may also include a short recorded video walkthrough of the critical areas of your website, in which the owner explains them in plain words. The recording shows your public website and carries the owner's voice, and it holds no personal information from you beyond what your website itself shows. We send it to you with the audit, by email or by a private link.
• Content and translations. Website copy, blog drafts, translations and summaries are produced with AI and reviewed by a person before they are published under our name.
• Preview websites. When a preview site launches, the headline and services the owner typed are translated into Spanish and French by an AI model once, so the site can be published in all three languages; everything else on the site was translated by hand.
• Owner answers. When an owner saves their answers to the questions customers ask, an AI model translates those answers into Spanish and French so the site can show them in all three languages. Only those answers are sent, the owner's words are scanned first, and the translation is reduced to plain text before it is stored. The answers appear on the site only the next time the site is updated.
• Revenue Leak Reports for businesses that have not bought. An AI model groups the public Google reviews of a business into recurring complaints; every quote it keeps is checked word for word against the original review, and anything that does not match is dropped. An AI model also reads the words on the business's own public website to flag wording that points away from the business, such as the name of a different business, and judges whether a list of search phrases is about something else. A flagged phrase is kept only if it appears word for word on the page. An AI model translates into Spanish and French the lines that were written about the one issue shown in full. A person at Meridian checks and approves the website findings, the issue shown in full and its Spanish and French lines before they appear on the page.
• Sorting and drafting. AI drafts replies to leads and follow-up emails, screens résumés for our own hiring, and summarizes competitor pages. Drafts are reviewed by a person; the email tool has no ability to send.
• Short clips from a client's long video. An AI model reads the transcript of a client's video and proposes which moments to clip, writes the text shown on screen and the title and description to post, and translates the captions into Spanish and French. It also looks at three small still pictures cut from a finished clip, only to tell which third of the frame the speaker's head is in so that text can go on the other side; it is told not to identify or describe anyone. Meridian's owner keeps or rejects every proposal and reviews every clip before a client sees it (see "When we turn a client's long video into short clips" in Section 2).

To do this, the text of your message, transcript or document is sent to the AI provider that produces the answer: AI model providers (including Google) and voice providers for speech. We send what the task needs and no more, we wrap outside text so that instructions hidden inside it are not followed, and we do not use your information to train AI models. We do not make decisions with legal or similarly significant effects on you by automated means alone; when a message mentions health, legal questions, a price dispute or a complaint, the assistant stops and a person reviews it.

5. Cookies and similar technologies

We keep this short because we use very little. There are no advertising cookies on meridianseo.ai.

Your choice. The first time you visit, a banner asks whether you accept analytics. Nothing analytic loads until you answer, and "Decline" keeps it off. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a decline and do not show the banner. You can change your answer any time from the Privacy choices link in the footer, or by clearing your browser storage.

6. Who we share it with

We share personal information only with the companies that help us run the service, each under a contract that limits what they may do with it. We do not sell personal information and we do not share it for cross-context behavioural advertising.

We also share information with the business you are dealing with when we act for it (Section 12); with our accountants, lawyers and insurers when they need it; with authorities when the law requires it; and with a buyer if Meridian is sold, who would have to honour this policy.

7. Where it is processed

We are in New York and our systems run in the United States. Some providers process data in other countries under their own safeguards. If you are outside the United States, your information will be transferred here.

8. How long we keep it

We keep information for as long as we need it for the purpose we collected it, then for as long as the law requires, for example seven years for tax and accounting records. In plain terms:

• Enquiries, audits and chats: kept while we might still be talking, and deleted when you ask.
• Accounts: kept while your account is open. When it closes or stays unpaid, your site is paused first; your data is kept at least 90 days after that, and we email you at least 14 days before deleting it.
• Visitor analytics: company-level records with no personal names; kept until the business that owns them deletes them or asks us to.
• Operational logs: 7 to 14 days.
• Affiliate applications: kept while the affiliate account is open. Tax forms are kept for seven years, as the law requires. A resume from an application we do not take forward is deleted when you ask.
• Creative work through a marketplace: the product photos you send, and the finished pictures we make from them, are deleted 90 days after the job ends, or sooner if you ask. That applies whether we finished the job, did not win it, or decided not to take it. The same dates apply to any copy of those files that we download to our own computer, or later move from there to an external drive: we delete those copies by the same day. Notes we keep about you and your brand for a later job are deleted 180 days after your most recent job ends in any of those ways, or sooner if you ask; each new job starts that period again, and notes made without a job count from the day we made them. The rest of the job record is kept while we might still be talking, and deleted when you ask, except what the job earned or cost us, and when, which is kept for seven years as a tax and accounting record, without your name, your brief or the marketplace's reference.
• Preview websites: preview sites expire 14 days after we build them unless the business becomes a customer. Photos and a logo uploaded to a preview that never launches stay stored until the owner asks us to delete them (info@meridianseo.ai), and we delete them within 30 days of the request.
• A mobile number you gave us in person: the number, and the date and time of the text to you, are kept while we might still be talking, and deleted when you ask. If you told us to stop, we keep your number and the date you said so on a do-not-text list, so that we do not text you again.
• A Revenue Leak Report about a business that has not bought: the reviews we collected, what we read on its website, the search phrases and the report itself are kept while we might still be talking, and deleted when you ask.
• A Google Business Profile Report draft: kept on the same terms as the assessment's other records (see "Enquiries, audits and chats" above): while we might still be talking, and deleted when you ask. A draft made for a business that has not bought is kept on the same terms. Nothing in the tool deletes on a schedule. The service may also keep its own record of a lookup in Meridian's owner's account with it, under its own terms.
• A client's video and the clips made from it: the video file, the transcript, the proposed moments and the owner's keep-or-reject decisions with his reasons, the cut clips, the pictures of on-screen text, and the subtitle files and posting text in English, Spanish and French are kept in private storage and in our database, where only Meridian's administrators can read them, until they are deleted at the client's request or when Meridian removes the project. Nothing in the tool deletes on a schedule, and we have set no deletion date. The audio sent for transcription and the still pictures sent to find the speaker are temporary files that we delete straight after.
• Call recordings and transcripts held for a business: kept until that business deletes them or asks us to.
• Social posts and their media references, the numbers read back, and the record of what you approved, edited or rejected: kept until you delete them or disconnect the account; a connected social account's sign-in is deleted the moment you disconnect it.
• The no-cost QR code generator: kept while your account is open, and deleted when you ask. A code's scan records are kept as long as the code exists and are deleted with it.
• Funnel page sign-ups: kept for the business until it deletes them (it can delete any sign-up, for example when you ask) or until its account closes, on the terms under "Accounts" above. If you unsubscribe, we keep your name and email with the date, so that you are not emailed again.

We do not yet run an automatic deletion schedule for customer records; deletion happens when you ask, when an account closes, or when a period stated above ends. Backups are cycled on our database provider's schedule.

9. How we protect it

• Every customer table is protected by row-level security, so one account cannot read another's rows.
• The job records, client notes and product photos from creative work can be opened only by Meridian's administrators, and the photos are kept in private storage. A copy of a photo or finished picture leaves that storage only when an administrator downloads it to our own computer, from where we may move it by hand to an external drive; nothing is copied automatically.
• Data is encrypted in transit and encrypted at rest by our database provider; stored API keys and connected-account tokens are additionally encrypted by us.
• The tool that reads Google Business Profile data can be used only by Meridian's administrators (today, its owner), and the sign-in it uses to the data service is stored encrypted and never sent to a browser.
• The videos, transcripts, clips and posting text from the clip tool can be read only by Meridian's administrators, and the files are kept in private storage.
• Public forms and AI features are rate-limited; inbound webhooks from phone, payment and email providers are signature-verified.
• Text from outside, such as a form, a scraped page or an email, is fenced before it reaches an AI model, and AI-written HTML is sanitized before it is stored or served.
• Meridian staff can open a customer account for support; every such session is logged with who, when and why.
• Error reports have cookies, tokens and secrets removed before they leave our servers.

No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

10. Your rights and choices

Whoever you are and wherever you live, you can ask us to:

• See the personal information we hold about you and get a copy in a common format;
• Correct anything that is wrong;
• Delete it, unless we must keep it (for example, a payment record);
• Stop marketing to you, through the unsubscribe link in any message or by telling us;
• Withdraw consent you gave for analytics, a connected account or a message channel.

Email info@meridianseo.ai with "Privacy request" in the subject. We will confirm it is you, usually by replying to the email address we hold, and answer within 30 days (45 days if a request is complex, and we will tell you). We will not treat you differently for asking.

United States state privacy laws

If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, New Jersey, Delaware, Iowa, Nebraska, New Hampshire, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island or another state with a privacy law, you have the rights above under that law, plus the right to opt out of targeted advertising, profiling and the sale of personal information. We do not sell personal information, we do not use it for targeted advertising, and we do not profile you. The categories we collect, the sources and the purposes are those described in Sections 2, 3 and 6. We treat a Global Privacy Control signal as an opt-out. You may use an authorized agent to make a request; we will ask the agent for proof of authority. If we refuse a request, you can appeal by replying to our answer and asking for a review.

European Union, United Kingdom and Switzerland

We serve businesses in New York and do not target these regions, but if you visit from them you have the rights above, the right to restrict or object to processing, and the right to complain to your data-protection authority. Our legal bases are listed in Section 3.

11. Messages from us

We message you about the service you bought or asked about by email (for creative work, through the marketplace), and by text or Telegram only if you started the conversation there. There is one other case: if you give Garnett, Meridian's owner, your mobile number in person and ask him to text you something, he may text you from his own phone, with a link to a private page about your business. That text says who it is from, and you can reply STOP and he will not text you again. Marketing email from Meridian goes to businesses, not to consumers, and every marketing message has an unsubscribe link and our postal address. A business that uses our software can also email the people who joined its own mailing list through a funnel page; those are that business's messages, not ours (Section 12), and each one carries the business's name and an unsubscribe link. Apart from that one case, text-message marketing is sent only to people who enrolled in a program and agreed to texts; reply STOP to end it.

12. When we work for a business you deal with

Our software runs websites, booking calendars, loyalty programs, receptionists and concierge chats for other businesses. When you use one of those, that business is responsible for the information: it decides why it is collected, how long it is kept and who sees it, and it must give you its own privacy notice. Meridian processes the information on the business's instructions, stores it in that business's account, and does not use it for our own marketing. To exercise your rights over it, contact the business; if you contact us instead, we will pass your request on and help the business answer it. Meridian staff may see the information when the business asks for support or when the law requires; that access is logged.

Businesses that use Meridian are responsible for their own notices and consents. That includes telling callers that a call may be recorded and getting agreement before sending marketing texts.

For a funnel page, the business decides what the page promises and what its consent line says. It is responsible for emailing only people who ticked that box, only about what they agreed to, and for honoring every unsubscribe. Our software stores the wording and time of each consent, puts the business's name and an unsubscribe link on every email, and does not email anyone who has unsubscribed. The business can download its list and delete sign-ups at any time.

13. Children

Meridian is for businesses and the adults who run them. We do not knowingly collect personal information from anyone under 13, and our services are not directed to them. If you believe a child has given us information, email us and we will delete it.

14. Changes to this policy

When we change this policy we change the date at the top, and we email account holders about material changes at least 14 days before they take effect. Earlier versions are available on request. This policy is published in English, Spanish and French; if the versions differ, the English version controls.

15. Contact

Meridian SEO, LLC
157 Columbus Ave Floor 4, New York, NY 10023
Email: info@meridianseo.ai