Privacy policy

The Meridian works as a team, but it is not a company or partnership. It is legally operated by Abi Ahmad Kavindra Hendika, an individual trading as "The Meridian", based in Surabaya, Indonesia, who is the controller of the personal data described here for this website (https://themeridianweb.com).

For anything about your data, email themeridianwebagency@themeridianweb.com. We aim to reply within one business day.

When you use the contact form, we collect:

• Your name and email address
• Your company name, if you give it
• The project type, any add-ons you pick, and where most of your customers are
• Your budget range, or the package estimate the form calculates
• What you tell us about the project

When you email us, we collect your email address and whatever you include in the message.

When you visit the site, our hosting and analytics tools record limited technical data: pages viewed, the referring site, browser and device type, country, and page-load performance. Your IP address is processed to deliver the site and to tell visits apart, but our analytics does not store it or use it to identify you.

If you become a client, we also keep project records, contracts, invoices and payment details needed for billing.

We use your data to:

• Reply to your enquiry and send a ballpark or quote. Legal basis: taking steps at your request before entering a contract.
• Deliver, invoice and support projects. Legal basis: performing our contract with you, and our legal obligations for tax and accounting records.
• Keep the site secure, block spam and understand which pages are useful. Legal basis: our legitimate interest in running a working, secure website, balanced against your rights.

We don't use your data for automated decisions about you, and we don't send marketing emails.

We only share data with the service providers that run our studio, and only what each one needs:

• Vercel (United States) hosts this website and runs the contact form. Vercel Web Analytics and Speed Insights give us anonymous visit counts and page-speed measurements.
• Resend (United States) delivers contact-form submissions to our inbox by email.
• Neon (United States) stores contact-form submissions in a database, so an email outage can't lose your enquiry.
• Google Workspace (United States) stores the emails you send us and our replies.
• Notion hosts each client's project dashboard, including feedback, comments and files shared during the project.
• Payoneer processes invoices and payments if you become a client.

We may also disclose data if the law requires it, or to protect our legal rights. We never sell or rent personal data, and we don't share it for advertising.

On a retainer, clients give us admin access to their own hosting, domain and analytics accounts. Any visitor data in those accounts belongs to the client: they are the controller, and we only access it on their instructions to run, monitor and improve their site. We stop accessing it when the retainer ends.

We work from Indonesia, and our providers store and process data in other countries, mainly the United States. When data leaves the EU, UK, Australia or Indonesia, we rely on our providers' standard contractual clauses or equivalent safeguards to protect it.

• Enquiries that don't become projects: deleted within 12 months of our last contact.
• Client records, contracts and invoices: kept for as long as tax and accounting law requires, then deleted.
• Analytics: aggregated and anonymous, kept under Vercel's standard retention.

This site sets no cookies, and it uses no advertising or cross-site tracking. Our analytics is cookieless, which is why there is no cookie banner.

The site stores one small value in your browser's session storage to remember that you've seen the intro animation. It contains nothing about you and is cleared when you close the tab.

Wherever you are, you can ask us to:

• Tell you what personal data we hold about you and send you a copy
• Correct anything that's wrong or incomplete
• Delete your data, unless we must keep it by law
• Stop or limit how we use it, or object to processing based on legitimate interests
• Give you your data in a portable format

To make a request, email themeridianwebagency@themeridianweb.com. We may ask you to confirm your identity. We'll respond within one month, or sooner where local law requires, and we won't charge you or treat you differently for asking.

These rights reflect the GDPR (EU and UK), the CCPA/CPRA (California), the Australian Privacy Act 1988, and Indonesia's Personal Data Protection Law (UU No. 27/2022). California residents: we don't sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information.

If you're unhappy with how we've handled your data, please contact us first. You can also complain to your local data protection regulator, for example your EU supervisory authority, the UK ICO, the Office of the Australian Information Commissioner, the California Privacy Protection Agency, or Indonesia's data protection authority.

The site is served only over HTTPS. Access to enquiries and client data is limited to our three-person team. No system is perfectly secure, but if a breach puts your data at risk, we'll tell you and the relevant regulator as the law requires.

Our services are for businesses and are not directed at anyone under 18. We don't knowingly collect data from children. If you think a child has sent us data, email us and we'll delete it.

If we change how we handle data, we'll update this page and the date at the top. If a change is significant, we'll tell current clients directly.