PRIVACY
POLICY.

1. Who We Are

Mei Ventures LLC ("Mei Ventures", "we", "us", "our") operates meiventures.group. This policy explains what personal information we collect, why, who it is shared with, and what rights you have over it. For data protection purposes, Mei Ventures is the controller of the information described here.

2. What The Contact Form Collects

When you submit the form on our Inquiries page, we receive and store exactly the following:

• Full name and email address — both required, so we can identify and reply to you.
• Company — optional.
• Services of interest — required; which of our four areas your inquiry relates to.
• Budget range and timeline — both optional.
• Project details — required; the free-text message you write.

Alongside those fields we record the date and time of submission, an internal status flag we use to track whether we have replied, and a verbatim copy of the submission exactly as it was sent. That copy is capped in size; if a submission arrives unusually large, we store the first portion of it and a note that the rest was discarded.

The form also contains a hidden field that is invisible to people and only ever filled in by automated bots. If it arrives with anything in it, the submission is discarded and nothing is stored.

We do not ask for special category data — health, biometric, racial, religious, or political information — and we ask that you do not send it to us. Please also do not send confidential business material through the form before we have a confidentiality agreement in place.

3. Collected Automatically

This website sets no cookies and stores nothing in your browser. We do not run analytics, advertising pixels, session recording, or fingerprinting of any kind.

Two things do happen automatically, and we would rather state them plainly than leave them unsaid:

• Server logs. Our host, Vercel, records standard request data including IP address, user agent, and the pages requested. This is used for security, abuse prevention, and reliability.
• Rate limiting. To stop the contact form being flooded, Vercel counts recent requests to it by IP address and temporarily refuses further ones past a threshold. This is a short-lived count used only to protect the form; it is not linked to your submission, not used to identify you, and not retained as a profile.
• The intro video is served from our own site, not from YouTube, Vimeo, or any other embed, so no third party learns that you watched it.
• Third-party asset requests. Our pages load fonts and code libraries from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), Cloudflare (cdnjs.cloudflare.com), and unpkg (unpkg.com). Because your browser requests those files directly, those providers receive your IP address and user agent. We do not control that, and we receive nothing back from them about you.

4. Client Engagement Data

If an inquiry becomes a project, we will hold the business contact details, project materials, credentials, and billing information needed to deliver and invoice the work. What that includes is defined by the engagement itself, and where we process personal data on your behalf we will agree on the terms of that processing in writing.

5. How We Use It

• Replying to your inquiry and discussing a possible engagement.
• Preparing proposals, estimates, and statements of work.
• Delivering, supporting, and invoicing agreed-upon work.
• Keeping records required for accounting and tax purposes.
• Protecting this website and our systems against abuse.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use it for automated decision-making that produces legal or similarly significant effects, and we will not add you to a marketing list on the strength of a contact form submission.

6. Legal Bases

Where data protection law requires a legal basis for processing, we rely on:

• Legitimate interests — responding to inquiries, and running and securing our business.
• Performance of a contract — delivering work you have engaged us for.
• Legal obligation — retaining accounting and tax records.
• Consent — where we ask for it explicitly. You can withdraw consent at any time.

7. Cookies And Tracking

We set no cookies of any kind, and use no local storage, session storage, or tracking technologies. There is no cookie banner on this site because there is nothing to consent to.

If we add analytics in future we will update this policy first and, where the law requires it, ask for your consent before any non-essential cookie is set.

8. AI Processing

Artificial intelligence tools are central to the work we deliver, so we want to be specific about how that intersects with your data.

• Contact form submissions are never sent to AI providers. They go to our database and to our own inbox, and nowhere else.
• Where a client engagement requires data to be processed by a third-party AI provider, we agree to that with you in writing before it happens.
• Where we do use such providers, we select ones that contractually commit not to train their models on submitted data.

9. Who We Share With

We share personal information only with the service providers that operate this website, and only as far as each needs. Those are:

• Vercel — hosting and serving this website, running the code that processes the contact form, and applying the rate limiting described in section 3.
• Supabase — the database where contact form submissions are stored.
• Resend — delivering the notification email. That email contains the full contents of your submission, so Resend processes all of it in order to send it.
• Google Workspace (Gmail) — hosts the inbox that receives the notification email, where it is stored like any other message.
• Google Fonts, Cloudflare, and unpkg — serving fonts and code libraries, as described in section 3.

Beyond those, we may disclose information where we are legally required to, or where necessary to establish, exercise, or defend legal claims. We do not rent or sell personal information to anyone.

10. How Long We Keep It

• Inquiries that do not become projects — up to 24 months, in case you come back to us, then deleted.
• Client project records — for the engagement and a reasonable period afterwards for support and reference.
• Financial records — for the period required by applicable tax law.

You can ask us to delete your inquiry sooner. See section 12.

11. Security

The site is served over HTTPS, and form submissions are transmitted encrypted. The database is not publicly readable: access requires a secret key held only by our server-side code, row-level security is enabled with no public read access, and the public API roles have had their permissions on the submissions table withdrawn entirely, so there are two independent barriers rather than one.

We also apply rate limiting to the contact form to prevent flooding, validate and size-limit every field on the server rather than trusting the browser, pin and integrity-check the third-party code our pages load so an altered copy cannot execute, and send a content security policy that blocks scripts, styles, and connections from anywhere we have not explicitly allowed.

No system is perfectly secure. If a breach affects your personal information and is likely to present a risk to you, we will notify you and the relevant authority as required by law.

12. Your Rights

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access — a copy of what we hold about you.
• Correction — fixing anything inaccurate or incomplete.
• Deletion — removing information we no longer need.
• Restriction and objection — limiting or stopping certain processing.
• Portability — receiving your information in a portable format.
• Withdrawing consent — where processing is based on consent.

To exercise any of these, email legal@meiventures.group. We respond within 30 days, and we will not charge you or treat you differently for asking. If you are in the UK or EU, you also have the right to complain to your local data protection authority.

13. US State Privacy Rights

Residents of California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws have rights to know, access, correct, delete, and obtain a portable copy of their personal information, and to opt out of its sale or of targeted advertising.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not process it for targeted advertising or profiling — so there is nothing to opt out of. The other rights can be exercised using the contact details in section 12.

Because we do not sell or share personal information, an opt-out preference signal such as Global Privacy Control has nothing to act on here. If that ever changes, we will honor those signals and say so in this policy first.

• Authorized agents. You may use an authorized agent to make a request on your behalf. We will ask for proof of their authority, and we may ask you to confirm it directly.
• Verification. We will ask for enough information to confirm you are who you say you are before we act on a request. Usually that is the email address used to contact us.
• Appeals. If we decline a request, we will tell you why, and you may appeal by replying to that decision. We will respond to an appeal in writing within 45 days. If we deny the appeal, you may refer the matter to your state's Attorney General.
• No retaliation. We will never deny service, charge a different price, or provide a lower quality of service because you exercised a privacy right.

14. International Transfers

We are based in the United States, and our service providers operate infrastructure in the United States and elsewhere. If you contact us from outside the US, your information will be transferred to and processed there.

Where personal data is transferred out of the UK or EEA, we rely on appropriate safeguards such as standard contractual clauses with the providers concerned.

15. Children's Privacy

This website and our services are intended for businesses and for adults aged 18 or over. We do not knowingly collect personal information from anyone under 18, and we do not direct any part of this website at children. If you believe someone under 18 has submitted information to us, contact us and we will delete it promptly.

16. Changes To This Policy

We may update this policy as the site or our practices change. The "last updated" date at the top of this page reflects the most recent revision. Where a change is significant — for example if we began collecting something new or added analytics — we will take reasonable steps to make that clear rather than changing it quietly.

17. Contact Us

Questions about this policy, or about the information we hold, are welcome at legal@meiventures.group. For anything else, see the contact page. Our Terms of Service govern use of this website.