Privacy Policy

 

Effective Date: July 30, 2026

1. Introduction

Meridian Thinking LLC ("we," "us," or "our") respects your privacy and is committed to protecting any personal information you provide through our website (meridianthinking.com), as well as through other means such as email, phone, or in person. This Privacy Policy explains how we collect, use, and safeguard your information.

Meridian Thinking LLC is the data controller of the personal data collected through our website and our own research and marketing activities. As a data controller, we are responsible for determining the purpose and means of processing your personal information in accordance with applicable data protection laws. When we carry out research for a client, our role under data protection law (controller, joint controller, or processor) is defined in our agreement with that client.

2. Information We Collect

We may collect personal information in the following ways:

  • Directly from you when you contact us via our website, email, phone, or in person
  • Through our contact forms, where you may provide: name, email address, company & job title, phone number, and any other information you choose to share
  • Through research activities such as surveys, interviews, and studies, where you may provide demographic information, behavioral insights, opinions, or preferences, and photos, videos, or audio clips (if applicable)
  • Automatically, through cookies and similar technologies, when you use our website (see Section 6)
  • Through select third-party services such as LinkedIn, Lusha, or similar

In the course of certain research studies, you may be asked to provide information considered "special category data" under the GDPR. This may include details about your health, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. We will only collect this data with your explicit consent, and you are free to decline or withdraw consent at any time. Where we collect special category data, we apply additional safeguards: access is limited to team members who need it, the data is stored separately in encrypted form, and it is anonymized or deleted once the research purpose is complete.

3. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data based on:

  • Consent - When you submit a contact form, accept non-essential cookies, or share information voluntarily
  • Legitimate Interests - To improve our services, conduct research, or promote our offerings, provided it does not override your rights
  • Contract - Where necessary for the performance of a contract or pre-contractual steps
  • Legal Obligation - To comply with legal and regulatory requirements

4. How We Use and Store Your Information

We use the information you provide to respond to inquiries, conduct consumer research and market analysis, communicate about our services, and improve our offerings through analytics. Where we rely on legitimate interests, these include understanding user behavior, conducting market research, maintaining system security, and managing business operations.

Survey and study responses may be aggregated and anonymized for analysis. We may also use anonymized responses, quotes, or visuals as part of case studies, whitepapers, or client examples. We will never publish identifying details without your explicit permission.

5. Third-Party Service Providers

We use trusted third-party providers to operate our business and website, including Microsoft 365 (including Microsoft Teams, which we use to record and transcribe research sessions where participants have agreed), QuickBooks Online, HubSpot (website, forms, live chat, and email), Google (Analytics and Ads), Microsoft Clarity, LinkedIn, Anthropic (Claude, our AI assistant), and survey platforms such as SurveySparrow or Typeform. These providers may process your data outside your home country. We ensure all transfers comply with applicable laws, such as GDPR-approved Standard Contractual Clauses (SCCs).

Where we use AI tools to support our work, we limit the personal data we enter and rely on business terms that do not permit the provider to use your data to train their models.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to run our website, understand how it is used, and support our marketing. When you first visit, our cookie consent banner lets you accept or decline non-essential cookies. Until you accept, analytics and advertising technologies are held off through Google Consent Mode, and only cookies strictly necessary for the site to function are set. You can change your choice at any time (see Section 8).

We group cookies and tracking into the following categories:

  • Strictly necessary - Required for the website to function and to remember your cookie preferences. These are always active.
  • Analytics - Google Analytics and Microsoft Clarity, used to understand how visitors use the site. Microsoft Clarity may record session activity such as mouse movement, clicks, and scrolling to produce anonymized heatmaps and session replays; form fields and other sensitive content are masked and not captured.
  • Advertising - Google Ads and the LinkedIn Insight Tag, used to measure the performance of our campaigns and to show relevant advertising. Where you have submitted a form, Google Ads "enhanced conversions" may share a hashed (irreversible) version of your email address with Google solely to measure ad performance. This only occurs where permitted by your consent settings.

You can also control cookies through your browser settings. Blocking some cookies may affect how the site works.

7. Data Retention

  • Contact form submissions and general correspondence: retained for 24 months, or longer where needed to meet legal, tax, or contractual obligations
  • Research data: retained for up to 24 months unless deleted upon request; after this period it is deleted or irreversibly anonymized
  • Data may be retained longer if required by law

8. Your Privacy Choices

You control how your information is used:

  • Cookie preferences - Use the cookie banner, or the "Your Privacy Choices" link in our website footer, to review or change your consent at any time.
  • Global Privacy Control (GPC) - Our website recognizes and honors the Global Privacy Control browser signal. If your browser or extension sends a GPC signal, we treat it as a request to opt out of non-essential advertising cookies automatically.
  • Marketing emails - You can unsubscribe using the link in any marketing email.

We do not sell your personal data for money. We do use advertising and analytics partners (including Google and LinkedIn) that may receive online identifiers, such as cookie IDs or a hashed version of your email address, to measure and deliver advertising. Under some US state privacy laws this activity may be considered "selling" or "sharing." You can opt out at any time using the "Your Privacy Choices" link in our footer, by declining advertising cookies in our banner, or by enabling Global Privacy Control in your browser. For California residents, the "Your Privacy Choices" link also serves as our "Do Not Sell or Share My Personal Information" opt-out. We honor these opt-outs across our advertising tools.

9. Your Rights Under GDPR & US State Privacy Laws

Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, and to withdraw consent at any time. Residents of US states with comprehensive privacy laws (such as California, Virginia, Colorado, Connecticut, and Utah) may also request disclosures about the personal information we collect and how it is used, and may exercise these rights without discrimination. As described in Section 8, we do not sell your personal data for money, and you can opt out of any data "sharing" for advertising at any time.

To exercise any of these rights, contact us at hi@meridianthinking.com. We will respond within the timeframes required by law. If you are located in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

California's "Shine the Light" law (Civil Code Section 1798.83) allows California residents to request, once a year, details of any personal information we shared with third parties for those third parties' own direct marketing. We do not share personal information for third-party direct marketing, but you may contact us at hi@meridianthinking.com to confirm.

10. Children's Privacy

Our website and services are intended for a professional, business audience and are not directed to children. We do not knowingly collect personal information from children under the age of 16 (or under 13 where COPPA applies). If you believe a child has provided us with personal information, please contact us at hi@meridianthinking.com and we will delete it. Where a research study involves participants who are minors, we obtain verifiable consent from a parent or legal guardian before collecting any information.

11. International Data Transfers

Your data may be processed outside your home country, including in the United States. When transferring from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) with our service providers.

12. Data Security

We take reasonable precautions including secure servers, access controls, and encryption. However, no method of transmission over the internet is 100% secure.

13. Data Breach Notification

If a personal data breach occurs that is likely to affect your rights, we will notify the relevant supervisory authority and, where required by law, the affected individuals, without undue delay and within the timeframes set by applicable law.

14. Third-Party Links

Our website may include links to external sites. We are not responsible for their privacy practices and encourage you to review their policies separately.

15. Updates to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised effective date.

16. Governing Law

This Privacy Policy, and any dispute arising from or relating to it, is governed by the laws of the State of Florida, USA, without regard to its conflict of laws principles.

17. Severability

If any provision of this Privacy Policy is found to be unenforceable or invalid, that provision will be limited or removed to the minimum extent necessary, and the remaining provisions will remain in full force and effect.

18. Accessibility

We aim to make our website usable by as many people as possible. If you have difficulty accessing any part of our site, or would like this Privacy Policy in an alternative format, contact us at hi@meridianthinking.com and we will do our best to help.

19. Contact Us

Meridian Thinking LLC
7901 4th St N, STE 300
St. Petersburg, FL 33702, USA
Email: hi@meridianthinking.com
Website: meridianthinking.com

For privacy-specific questions, or to exercise any of your rights, you can also contact our privacy lead at hi@meridianthinking.com. We have not appointed a statutory Data Protection Officer, as we are not required to under the GDPR, but all privacy matters are handled directly by Meridian Thinking LLC.