Privacy Policy

1. Introduction

TwelveSides Technologies Ltd ("TwelveSides", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use Meridian Cloud ("the Service").

TwelveSides Technologies Ltd is the data controller for the personal data we collect about you. We are registered in England and Wales. You can contact us at hello@meridiancloud.tech.

This policy is compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We collect the following categories of personal data:

2.1 Information you provide

• Account information: Name, email address, company name, job title, and password when you register.
• Billing information: Payment card details (processed by Stripe; we do not store full card numbers), billing address, and VAT number.
• Communications: Any messages, feedback, or support requests you send to us.

2.2 Information collected automatically

• Usage data: Pages visited, features used, actions taken, timestamps, and session duration.
• Device and browser data: IP address, browser type, operating system, device type, and screen resolution.
• Cookies and similar technologies: See Section 9 for details.

2.3 Customer Data

You may upload, submit, or transmit data through the Service ("Customer Data"). This may include personal data belonging to your employees, customers, or end users. You are the data controller for your Customer Data, and we process it on your behalf as a data processor.

3. How We Use Your Data

We use your personal data for the following purposes:

Purpose	Legal Basis
Providing and maintaining the Service	Performance of contract
Processing payments and billing	Performance of contract
Sending account-related communications	Performance of contract
Providing customer support	Performance of contract
Improving and developing the Service	Legitimate interest
Analysing usage trends and patterns	Legitimate interest
Detecting and preventing fraud or abuse	Legitimate interest
Sending marketing communications (with consent)	Consent
Complying with legal obligations	Legal obligation

4. Data Sharing

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service providers: Third-party companies that help us operate the Service, including cloud hosting (Microsoft Azure), payment processing (Stripe), email delivery, and analytics providers. These providers are contractually obligated to process your data only on our behalf.
• Legal requirements: We may disclose your data if required by law, regulation, legal process, or governmental request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction. We will notify you of any such change.

5. International Data Transfers

Your data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA). Where we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office.
• Transfers to countries with an adequacy decision from the UK Government.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

• Account data: Retained for the duration of your account and for 30 days after account deletion.
• Billing data: Retained for 7 years after the end of the financial year in which the transaction occurred, as required by UK tax and accounting regulations.
• Usage data: Retained for up to 24 months, then anonymised or deleted.
• Customer Data: Retained for the duration of your subscription and for 30 days after termination, after which it is permanently deleted.
• Support communications: Retained for up to 3 years after your last interaction.

7. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your personal data in certain circumstances.
• Right to restriction: You can ask us to restrict the processing of your data in certain circumstances.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.
• Right to lodge a complaint: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at hello@meridiancloud.tech. We will respond within one month of receiving your request.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Access controls and role-based permissions.
• Regular security assessments and penetration testing.
• Secure development practices and code review.
• Incident response procedures and breach notification processes.

While we take all reasonable precautions, no method of transmission over the internet or method of electronic storage is 100% secure.

9. Cookies and Tracking

We use cookies and similar technologies to enhance your experience. The types of cookies we use include:

• Strictly necessary cookies: Required for the Service to function (e.g., authentication tokens, session cookies). These cannot be disabled.
• Functional cookies: Remember your preferences and settings (e.g., language, theme).
• Analytics cookies: Help us understand how the Service is used so we can improve it. We use privacy-focused analytics.

We do not use third-party advertising cookies. You can manage cookie preferences through your browser settings.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data promptly.

11. Data Processing Agreement

Where we process Customer Data on your behalf, we act as a data processor. We offer a Data Processing Agreement (DPA) that sets out the terms of our processing, including the subject matter, duration, nature, and purpose of processing, the types of personal data processed, and the categories of data subjects.

To request a DPA, please contact us at hello@meridiancloud.tech.

12. Third-Party Services

The Service may integrate with third-party services at your direction (e.g., Microsoft 365, Google Workspace, security tools). When you enable an integration, data may be shared with that third-party service in accordance with its own privacy policy. We are not responsible for the privacy practices of third-party services.

We encourage you to review the privacy policies of any third-party services you connect to Meridian Cloud.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email or through a prominent notice in the Service at least 30 days before the changes take effect.

The "Last updated" date at the top of this policy indicates when it was last revised. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy, please contact us at hello@meridiancloud.tech.