Privacy Policy
Effective 4 October 2026 · Last updated 4 October 2026
Merriweather Holdings ("Merriweather," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal information we collect through merriweatherholdings.com and related communications (the "Site"), how we use and share it, how we protect it, and the rights and choices you have. We collect only what we need, we do not sell or share personal information for cross-context behavioral advertising, and we use no advertising or analytics cookies.
1. Who we are and scope
Merriweather Holdings is a Virginia, USA business providing managed IT, cybersecurity, penetration testing, and AI integration services. For the personal information described here, Merriweather is the "controller" (GDPR) and "business" (CCPA/CPRA). This policy applies to the Site and to inquiries you send us. It does not apply to third-party websites we link to, or to information processed under a separate client engagement agreement, which is governed by that agreement.
2. Information we collect
a. Information you provide
- Contact-form data: your name, email address, the service scope you select, and the contents of your message.
- Correspondence: information you include when you email us or otherwise communicate with us.
b. Information collected automatically
Our hosting and security provider (Cloudflare) processes standard server and security data when you visit, including IP address, approximate location derived from IP, browser and device type, pages requested, referring page, and timestamps. This is used to deliver the Site and operate our web application firewall and rate limiting. The Site does not set advertising or analytics cookies and does not build advertising profiles.
c. Information from third parties
We generally do not obtain personal information about you from third parties. If you contact us through a referral or platform, we receive the information that service transmits.
3. How we use information
- To respond to your inquiry and provide the services or information you request.
- To operate, maintain, secure, and improve the Site, and to prevent and investigate fraud, abuse, and security incidents.
- To keep business records and to comply with legal obligations.
- To establish, exercise, or defend legal claims.
We do not use your information for targeted advertising, and we do not make decisions producing legal or similarly significant effects about you using solely automated processing.
4. Legal bases (EEA/UK)
If you are in the EEA or UK, we process personal information under these GDPR legal bases: consent (where you voluntarily submit a form), legitimate interests (operating and securing the Site, responding to inquiries, and running our business, balanced against your rights), performance of a contract (where we are taking steps at your request before entering an agreement), and legal obligation (where the law requires it). You may withdraw consent at any time without affecting prior processing.
5. Cookies and tracking technologies
The Site uses only the strictly necessary technical means to function and be served securely. It does not use advertising, marketing, or third-party analytics cookies, and it does not track you across other sites. Because we use no non-essential cookies, no cookie consent banner is required.
6. How we share information
We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose information only as follows:
- Service providers (processors): Web3Forms processes and relays contact-form submissions to us; Cloudflare provides hosting, content delivery, and security. They process data only to perform their service for us, under their terms.
- Legal and safety: when required by law, legal process, or to protect the rights, property, or safety of Merriweather, our clients, or others.
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
- With your direction or consent.
7. Data retention
We keep personal information only as long as needed for the purposes above: inquiry correspondence is retained while we respond and for a reasonable period for business records, then deleted or anonymized. Automatically collected security logs are retained for a limited period by our provider. You may request earlier deletion (Section 9).
8. Data security
We protect the Site with HTTPS and HSTS, a content security policy, an in-house web application firewall, and rate limiting, and we apply administrative and technical safeguards appropriate to the sensitivity of the data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Your privacy rights
Subject to your location and applicable law, you may have the right to: confirm whether we process your information and access it; correct inaccuracies; delete it; obtain a portable copy; and opt out of sale, sharing, targeted advertising, and certain profiling (we do none of these). You will not be discriminated against for exercising a right.
To exercise any right, email [email protected] with your request and enough detail to verify your identity. We will respond within the time applicable law allows (generally 45 days, extendable where permitted). An authorized agent may submit a request with proof of authorization.
Virginia residents (VCDPA)
You have the rights above. If we decline your request, you may appeal by replying to our response or emailing us with "Appeal" in the subject; we will inform you of the outcome. If the appeal is denied, you may contact the Virginia Attorney General at oag.state.va.us.
California residents (CCPA/CPRA)
In the past 12 months we collected the categories "identifiers" (name, email, IP) and "internet or network activity" (request/security logs), as described in Section 2. We collected them for the business purposes in Section 3, from the sources in Section 2, and disclosed them only to the service providers in Section 6. We have not sold or shared personal information and do not sell or share the personal information of consumers, including minors under 16. You have the rights to know, delete, correct, and to opt out of sale/sharing (not applicable, as we do neither), and the right not to receive discriminatory treatment.
EEA/UK residents (GDPR/UK GDPR)
You also have the right to object to or restrict processing and to lodge a complaint with your supervisory authority. Our legal bases are in Section 4.
10. International transfers
We operate from the United States, and our providers may process data in the US and other countries. Where personal information is transferred out of the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism.
11. Do Not Track
Because we do not track users across third-party sites or over time, we do not respond differently to browser "Do Not Track" signals; our behavior is the same for all visitors.
12. Children's privacy
The Site is intended for businesses and is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
13. Third-party links
The Site may link to third-party sites and services we do not control. Their privacy practices are governed by their own policies; review them before providing information.
14. Changes to this policy
We may update this policy to reflect changes in our practices or the law. We will post the updated policy here and revise the "Last updated" date; material changes will be prominently noted.
15. Contact us
Questions, requests, or complaints: Merriweather Holdings, Virginia, USA · [email protected]. Security reports: see our security.txt.