1.Who we are
Merivane Inc. ("Merivane", "we", "us") operates the website merivane.ai. Merivane Inc. is incorporated in British Columbia, Canada.
We provide a B2B software service for computer system validation in regulated industries, such as pharma, biotech, and contract research organizations. This policy covers the merivane.ai website. It does not cover data that our customers process inside our product. Read the section "Customer data in our product" below.
Our Privacy Officer handles privacy questions and requests. Contact the Privacy Officer at [email protected].
2.Scope
This policy applies to:
- Visitors to merivane.ai.
- People who fill in our contact or demo form.
- People who email us, including with attached documents.
- Business contacts at current or prospective customers.
This policy does not apply to data our customers store or process inside our product, such as validation evidence, test records, or test account data. For that data, Merivane acts as a processor or service provider. The customer agreement and a data processing agreement between Merivane and the customer govern that data. If you are an end user of a customer's system and have a question about that data, contact the customer, not Merivane.
3.What we collect
We collect personal data in these ways.
Contact and demo form. When you fill in our form, we collect your name, work email, company name, the system you want to validate, and any message you write. The form has a consent checkbox. You must check it before you submit the form. The checkbox text states that we store your details only to reply to your request, and that we do not share them.
Direct email. If you email us at [email protected], we collect your email address, the content of your message, and any file you attach, such as a requirement document.
Server and hosting logs. Our hosting provider records standard technical data for every website visit. This includes your IP address, browser user agent, and the date and time of the visit.
Analytics. We use Google Analytics 4 (GA4) to understand website traffic. We load GA4 and set analytics cookies only after you give consent through our cookie banner. GA4 does not log or store IP addresses. See the Cookie policy for detail on cookies and consent choices.
We do not run a newsletter or a marketing mailing list. We do not collect payment data through this website.
4.How we use it
We use personal data only for these purposes.
| Purpose | Data used | Lawful basis (GDPR/UK GDPR) |
|---|---|---|
| Reply to a form or email enquiry | Name, email, company, message, attachments | Consent (form checkbox); legitimate interest in replying to unsolicited email |
| Keep a record of business contacts once a business relationship starts | Name, email, company, role | Legitimate interest in managing the business relationship; performance of a contract once one exists |
| Operate and secure the website | Server logs | Legitimate interest in website security and operation |
| Measure website traffic and improve content | Analytics data | Consent |
| Meet legal and regulatory duties, such as responding to a lawful request | Relevant data held | Legal obligation |
Under PIPEDA and BC PIPA, we rely on your consent for the purposes above, or on the limited exceptions these laws allow, such as replying to a message you sent us.
We do not sell personal data. We do not use personal data for automated decisions that produce legal or similarly significant effects on you.
5.Cookies and analytics
We use cookies and similar technology on merivane.ai. Strictly necessary cookies run without consent, because the site needs them to work. Analytics cookies, including GA4, run only after you give consent through the cookie banner, in places where the law requires consent. You can change or withdraw your consent at any time. Full detail on cookie types, retention, and how to manage your choices is in the Cookie policy.
6.Who we share it with
We share personal data with these categories of service provider, acting on our instructions:
- Website hosting provider, to host and serve the website.
- Transactional email provider, to deliver form submissions and email to [email protected].
- Analytics provider, Google LLC, to process GA4 analytics data, only after consent.
We will give you the names of our current service providers on request. We require every service provider to protect personal data and to use it only for the purpose we set.
We do not sell personal data to any third party. We do not share personal data with third parties for their own marketing use. We may disclose personal data if the law requires it, such as in response to a valid court order, or to protect the rights, safety, or property of Merivane or others.
7.International transfers
Our service providers may be located in Canada, the United States, or other countries. This means your personal data may cross a border and be processed outside your home country.
Canada holds an adequacy decision from the European Commission for organizations subject to PIPEDA. This means the EU treats a transfer of personal data to a PIPEDA-covered organization in Canada as offering a level of protection similar to the GDPR. Where we transfer personal data to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism.
8.How long we keep it
We keep personal data only as long as we need it for the purpose we collected it for.
| Data | Retention period |
|---|---|
| Contact/demo form and direct email enquiries, where no business relationship starts | 24 months after our last contact with you |
| Business contact data, once a business relationship starts | For the length of the relationship, plus a reasonable period after it ends, as set by the customer agreement or normal business record rules |
| Server and hosting logs | Up to 90 days |
| Google Analytics data | 14 months |
After the retention period ends, we delete the data or make it anonymous. We may keep data longer if the law requires it, such as for tax or accounting records.
9.How we protect it
We use technical and organizational measures to protect personal data, matched to the sensitivity of the data our website collects. This includes access controls, encryption in transit, and restricting access to the data to staff who need it to do their job. No system is completely secure. If we learn of a data breach that creates a real risk of harm to you, we will notify affected individuals and the relevant regulator as the law requires.
10.Your rights
Canada (PIPEDA, BC PIPA, and Quebec's Law 25). You have the right to access the personal data we hold about you, to ask us to correct it, and to withdraw consent where consent is our basis for using it. You can also ask us questions about how we handle your data, and file a complaint with us with the Office of the Privacy Commissioner of Canada, or with the Office of the Information and Privacy Commissioner for British Columbia. Quebec residents have further rights under Law 25, including the right to data portability for certain data.
EEA and UK (GDPR and UK GDPR). If GDPR or UK GDPR applies to you, you have the right to access your personal data, correct it, delete it, restrict or object to our use of it, and receive a copy of it in a portable format, where these rights apply to the data and purpose in question. Where we rely on consent, you can withdraw it at any time; this does not affect processing we already carried out. You have the right to complain to your local data protection supervisory authority.
Other regions, including US states. Depending on where you live, you may have further rights under local privacy law, such as the right to know what data we hold, to ask for a correction, or to ask for deletion. We respond to every rights request in line with the rights above, whether or not a local law applies to us.
How to exercise a right. Email the Privacy Officer at [email protected]. We will respond within 30 days. We may ask you to confirm your identity before we act on a request. We do not charge a fee for a normal request.
11.Customer data in our product
If you use our product as an authorized user of one of our customers, the data in that product, including validation evidence, test records, and test account data, is governed by the agreement between Merivane and that customer, not by this website policy. For that data, Merivane acts as a processor or service provider for the customer. Our customer chooses the hosting region for their tenant. Our security overview lists our sub-processors. We hold no standing staff access to tenant data. See the Trust and security page for detail. If you have a question about your data inside a customer's tenant, contact that customer directly.
12.Children
Our website and product serve businesses, not the general public. We do not knowingly collect personal data from anyone under 16. If you believe a person under 16 has given us personal data, contact us and we will delete it.
13.Changes to this policy
We may update this policy from time to time, for example to reflect a new service provider or a change in the law. We will post the updated policy on this page. If a change is material, we will take reasonable steps to bring it to your attention.
14.Contact
For any question about this policy, or to exercise a privacy right, contact our Privacy Officer at [email protected]. For terms that govern use of our website, see the Terms of service.