Privacy Policy
This site collects very little, and nothing at all until you say yes. Below is the whole of it: what is collected, why, who else sees it, and how to make us stop.
Last updated 10 August 2026
Who we are
Meiseki is a trading name of Social Three, established in India. Social Three is the data controller for personal data collected through meiseki.co — under India's Digital Personal Data Protection Act 2023, the equivalent term is data fiduciary.
Questions about this policy, about the personal data we hold, or any grievance about how we have handled it, go to [email protected]. We aim to reply within five working days, and we will always respond to a formal rights request within one month.
Which law applies to you
We work with clients worldwide, and a visitor to this site could be almost anywhere. Rather than run a different policy per jurisdiction, we apply the strictest standard that plausibly reaches us — UK and EU GDPR — to everyone, wherever you are. Where your own country's law gives you more than that, your law wins.
In practice that means:
- analytics stay switched off until you consent, including for visitors in countries where no consent is legally required;
- the rights listed further down are honoured for every visitor, not only those in the UK or EEA;
- as an organisation established in India, we are additionally bound by the Digital Personal Data Protection Act 2023.
The short version
- There is no contact form on this site and no account to create. If you want to reach us, you email us.
- No analytics run until you accept them. Decline, and no analytics cookies are set and no analytics data is collected.
- We run no advertising and no profiling, on this site or anywhere else. We do not build visitor profiles, and we never sell or rent personal data.
- Fonts and JavaScript are served from our own domain, so simply loading a page does not hand your IP address to a font or script CDN.
What we collect, and why
1. Analytics — only with your consent
We use Google Analytics 4 to understand which pages people actually read. It is switched off by default. Nothing is collected until you choose Accept in the cookie banner, and choosing Decline keeps it off.
When enabled, Google Analytics collects:
- pages viewed, and how long you spent on them;
- approximate location (country or city level), derived from your IP address;
- device, browser and screen size;
- the site or search engine that referred you.
Google Analytics 4 does not log or store your full IP address. We have not
enabled Google Signals, advertising features, or any form of ad personalisation:
the ad_storage, ad_user_data and
ad_personalization consent signals are set to denied
permanently, including for visitors who accept analytics.
Lawful basis: your consent (UK GDPR Art. 6(1)(a); PECR reg. 6 and the EU ePrivacy Directive for the cookies themselves). We ask everyone, not only visitors in the UK and EEA. You can withdraw it at any time — see Your choices.
2. Server logs — to keep the site up
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address, the time of the request, the page requested and your user-agent string in order to deliver the page, mitigate attacks and prevent abuse. This happens for every visitor, including those who decline analytics, because a web server cannot send you a page without knowing where to send it.
Lawful basis: our legitimate interests (Art. 6(1)(f)) in keeping the site available and secure.
3. Page content — loaded from our CMS
The homepage loads some of its text (service descriptions and FAQs) from Sanity, our content management system, when the page opens. That request necessarily discloses your IP address to Sanity. No cookies are set and no analytics are performed by this request; it exists only to fetch text.
Lawful basis: our legitimate interests (Art. 6(1)(f)) in serving current content.
4. Email you send us
If you email [email protected], we hold your email address, your name if you give it, and whatever you write, for as long as needed to deal with your enquiry and to keep a record of our dealings with you.
Lawful basis: taking steps at your request before entering a contract (Art. 6(1)(b)), or our legitimate interests (Art. 6(1)(f)) in responding to enquiries.
Cookies and local storage
Only two cookies can ever be set on this site, both by Google Analytics, and only after you accept. We also store your cookie choice itself in your browser so we can stop asking.
| Name | Type | Purpose | Expires | Set when |
|---|---|---|---|---|
| _ga | Cookie | Google Analytics — distinguishes one visitor from another | 2 years | Only after you accept |
| _ga_JRRN3R9VMR | Cookie | Google Analytics — maintains session state | 2 years | Only after you accept |
| mk-consent | Local storage | Remembers whether you accepted or declined, so the banner does not reappear on every page | Until you clear your browser storage | When you choose |
mk-consent is strictly necessary — it exists only to record the
choice you made — so it is stored whichever way you choose, and no consent is
required for it under PECR. It holds a single word, granted or
denied. It is never sent to us or to anyone else; it stays in your
browser.
Who your data is shared with
We do not sell, rent or trade personal data. We share it only with the providers that run the site:
| Provider | What they process | Where |
|---|---|---|
| Analytics data, if you accepted | Google Ireland Ltd, with transfers to the United States | |
| Cloudflare | Hosting and server logs, including IP address | Global edge network, including the United States |
| Sanity | IP address, when the homepage fetches its content | European Union and the United States |
We may also disclose personal data where we are legally required to, for example in response to a valid request from a law enforcement or regulatory body.
Where your data goes
We operate from India. Personal data collected through this site — anything you email us, and the analytics reports we read — is accessed from there. If you are in the UK or the EEA, you should know that India is not currently covered by a UK or EU adequacy decision, so your data leaves that protective perimeter when it reaches us. We apply the protections described in this policy to it regardless of where it sits.
Our providers also move data across borders. Google and Cloudflare are certified to the EU–US Data Privacy Framework and its UK Extension. Sanity processes in the European Union and the United States. Where a transfer relies on a contractual safeguard rather than an adequacy finding, it is covered by the Standard Contractual Clauses or the ICO's International Data Transfer Agreement, as applicable to that provider.
How long we keep it
- Analytics: Google Analytics is configured to retain user-level and event-level data for 14 months. Aggregated, non-identifying reports are retained by Google beyond that.
- Server logs: retained by Cloudflare for a short period, typically days, under their own retention policy.
- Email: kept for as long as we are dealing with your enquiry, and for up to two years afterwards so we have a record of the conversation. Longer only where we have to for tax or legal reasons.
Your choices
To change your cookie decision, use the Cookies link at the bottom of any page. It reopens the banner, and your new choice takes effect immediately.
To block analytics entirely, decline the banner, or use your browser's Do Not Track / tracking-protection settings, or Google's own opt-out browser add-on. Clearing your browser storage also erases your stored choice, and the banner will ask again on your next visit.
Your rights
These are the rights UK and EU GDPR give, and we honour them for every visitor, wherever you are. You have the right to:
- Access the personal data we hold about you;
- Rectify it, if it is wrong or incomplete;
- Erase it, in the circumstances the law allows;
- Restrict or object to our processing of it, including any processing based on legitimate interests;
- Portability — receive it in a machine-readable form;
- Withdraw consent at any time, without affecting anything done before you withdrew it.
To exercise any of these, email [email protected]. Exercising them is free, and we will respond within one month.
In practice, most of what this site collects is not linked to a name, so we may not be able to identify your data from an email address alone. Where we cannot identify you, we will say so rather than guess.
If you are in India, the Digital Personal Data Protection Act 2023 gives you a broadly similar set — access, correction, erasure, grievance redressal, and the right to nominate someone to exercise your rights if you die or become incapacitated. Use the same address, and treat [email protected] as our grievance contact.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first — we would rather fix it. You can also complain to your own regulator:
- United Kingdom — the Information Commissioner's Office, ico.org.uk/make-a-complaint, or 0303 123 1113.
- European Economic Area — the supervisory authority in the country where you live or work.
- India — the Data Protection Board of India, under the Digital Personal Data Protection Act 2023.
- Elsewhere — your national data protection authority, if your country has one. If it does not, write to us and we will deal with the complaint on the same terms as everyone else's.
Other things worth stating plainly
No automated decision-making. We do not use automated decision-making or profiling that produces legal or similarly significant effects.
Not aimed at children. This site sells business services and is not directed at children. We do not knowingly collect data from anyone under 18 — the threshold India's DPDP Act sets, which is stricter than the 13 UK GDPR uses, so it is the one we apply to everyone. We run no tracking or advertising aimed at children of any age.
External links. Pages here link out to other sites. Once you follow a link, that site's privacy policy applies, not this one.
Changes to this policy
If we change what we collect or who we share it with, we will update this page and move the date at the top. Where a change materially affects how your data is used, we will ask for consent again rather than rely on the old one.