Privacy policy

This policy explains what personal data Meris Design collects through this website and the client dashboard, why it is collected and what your rights are.

Who is responsible for your data

Meris Design is the controller of the personal data described here.

What I collect

When you send an enquiry

Your name, email address and message, plus anything optional you add such as your business name, phone number or current website.

When you have a client account

• Your name, email address, password (stored only as a secure hash) and, if you add them, your company name and phone number.
• Two factor authentication settings and passkeys if you turn them on.
• Bug reports, feature requests, messages and any screenshots or files you upload.

When you pay for a service

Payments are handled by Stripe. This website never sees or stores your full card number. I keep a record of your Stripe customer reference, the card brand and last four digits, your subscriptions and your invoices.

Technical data

Like most websites, the server records basic request data such as IP addresses in its logs to keep the service secure and working. See the cookie policy for the small number of cookies this site uses.

Research on local businesses

To find businesses that may want a new website, I look at publicly available sources such as OpenStreetMap, Google business listings and business websites. This can include a business name, address, phone number, email address and details about its website. Where a business is run by a sole trader, some of this is personal data. You can ask me at any time to delete it or to stop using it.

Why I use it, and the lawful basis

• Providing your services and account, including billing and support: performing a contract with you.
• Replying to enquiries and taking steps before a contract: legitimate interests, or steps at your request.
• Keeping the service secure and preventing misuse: legitimate interests.
• Researching local businesses to offer relevant services: legitimate interests. You can object at any time.
• Keeping financial records: legal obligation.

Who I share it with

I only share data with providers that help run this service, under contracts that protect it:

• Stripe for payments and invoices.
• My hosting provider, which stores the website and its database.
• An email delivery provider, to send account and support emails.
• Telegram, which I use to receive notifications about new enquiries and requests.
• Anthropic, whose AI models help analyse publicly available business websites for the research described above. Client account data is not sent for this.

Some of these providers are based outside the UK. Where that happens, transfers are protected by safeguards recognised under UK data protection law, such as the International Data Transfer Agreement or standard contractual clauses.

I never sell personal data.

How long I keep it

• Enquiries are deleted once they are no longer needed to reply or follow up.
• Account data is kept while you have an account. When you delete your account, your profile is removed. Messages on a website's support history stay with that website but are no longer linked to you.
• Billing records are kept for as long as UK tax law requires.
• Business research records are deleted when they are no longer useful, or straight away if you ask.

Your rights

You have the right to access your data, to correct it, to have it deleted, to restrict or object to how it is used, and to receive a copy in a portable format. You can delete your account at any time from the settings page in your dashboard.

If you are unhappy with how your data is handled, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

If this policy changes in a way that matters, I will update the date at the top and tell clients through the dashboard or by email.