Effective Date: 05.03.2026

This Privacy Policy explains how MERAKI HR SRL collects, uses, stores, and protects personal data when you access or use the LIMEN website, applications, and services ("Platform", "LIMEN", "LIMEN Brand", "LIMEN Energy", "LIMEN Align", "LIMEN Threshold").

For the purposes of this Privacy Policy, “LIMEN” or the “Platform” refers to the LIMEN brand and its products, including LIMEN Energy, LIMEN Align, LIMEN Threshold, and related tools operated by MERAKI HR SRL.

The data controller is: MERAKI HR SRL Bucharest, District 6, Romania Trade Register: J2024005188408 CUI: 49743547 VAT: RO51271373 EUID: ROONRC.J40/5188/2024 Email: limen@merakihr.ro

For all data protection inquiries, please contact: limen@merakihr.ro

This Policy applies to:

It applies to users located in the European Union, the United States, and internationally.

We collect only data necessary to operate the Platform.

3.1 Website Data

When you visit our website, we may collect:

3.2 Account Information

If you create an account:

We do not store full payment card details.

LIMEN Threshold presents structured reflective questions only. It does not collect, store, or process personal relational responses.

3.4 LIMEN Energy & LIMEN Align

If you use these tools, we process:

Important: LIMEN does not request medical diagnoses, clinical mental health data, or legal records. Users are responsible for avoiding inclusion of identifiable third-party personal data without consent.

3.5 Technical & Security Data

Collected for security and service improvement.

For users in the European Union, processing is based on:

We do not intentionally process special categories of personal data under Article 9 GDPR.

We use personal data to:

We do not sell personal data.

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

If you choose to subscribe to updates, waiting lists, or early access notifications related to LIMEN products (including LIMEN Align, LIMEN Energy, and LIMEN Threshold), we may use your email address to send:

Marketing communications are sent only where the user has provided consent or where otherwise permitted by applicable law.

You may withdraw your consent and unsubscribe from marketing communications at any time by clicking the unsubscribe link in our emails or by contacting limen@merakihr.ro .

We retain personal data:

Inactive accounts may be deleted after a defined inactivity period (from 12 to 24 months).

Users may request deletion at any time by contacting limen@merakihr.ro.

MERAKI HR SRL does not store personal data on proprietary servers. All personal data collected through the Platform is processed exclusively by trusted third-party service providers acting as data processors on our behalf.

Each processor is engaged under contractual obligations that require them to maintain appropriate data protection standards consistent with GDPR and applicable law.

8.1 CRM and Email Marketing

Personal data including name, email address, and user-submitted responses (such as reflection answers and research participation interest) are processed by:

Transfer mechanism: Standard Contractual Clauses (SCCs) under EU Commission Decision 2021/914

Privacy policy: legal.hubspot.com/privacy-policy

DPA: legal.hubspot.com/dpa

Operational and administrative data may be stored and processed using:

8.3 Platform Infrastructure

The LIMEN Platform is developed and hosted in part through:

Platform infrastructure:

Base44 Inc. (base44.com). Base44 and its sub-processors operate servers primarily located in the United States and Israel. Sub-processors include MongoDB (data storage), Render (server infrastructure), Google Cloud Platform (analytics), Anthropic and OpenAI (AI processing), SendGrid (email), and DataDog (logging), all located in the United States; Wix.com Ltd. (Israel); Langfuse (Germany); and Logfire (United Kingdom).

Transfer mechanism for EU personal data: Standard Contractual Clauses and/or equivalent lawful safeguards — confirmation pending written response from Base44 Inc. This entry will be updated upon receipt of formal confirmation. Sub-processors directory: base44.com/security.

Base44 — platform infrastructure and application development services.

Base44 is SOC 2 Type II certified and ISO 27001 certified.

Data processing terms: Data Processing Addendum (DPA) | Base44

8.4 Payment Processing

If you make a purchase, payment data is processed by Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

MERAKI HR SRL does not store payment card details. Stripe operates as an independent data processor under its own privacy and security standards.

8.5 Analytics

We use Google Analytics, operated by Google Ireland Ltd, to understand how users interact with the Platform. Analytics data is anonymized where technically possible. For EU users, analytics cookies are activated only after consent.

8.6 Advertising and Remarketing

If Meta Pixel is active, interaction data may be processed by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for the purpose of measuring advertising effectiveness and remarketing. For EU users, this is activated only after explicit consent.

8.7 General Obligations All third-party processors are:

We do not sell personal data to any third party under any circumstances.

As a Romania-based company, data is primarily processed within the European Union. If data is transferred outside the EU/EEA:

We implement appropriate technical and organizational measures including:

However, no system can guarantee absolute security.

If you are located in the EU/EEA, you have the right to:

If you are a US resident, including California residents, you may have the right to:

LIMEN does not sell personal information. To exercise rights, contact: limen@merakihr.ro

Under applicable US privacy laws, including the California Consumer Privacy Act (CCPA), we may collect the following categories of personal information:

We do not sell personal information to third parties.

Users may request disclosure or deletion of personal data as described in this Privacy Policy.

We use cookies and similar technologies. Details are provided in our separate Cookie Policy. Users may withdraw consent for non-essential cookies at any time.

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that data from a minor has been collected, we will delete it.

AI-assisted tools are used:

Users remain responsible for interpretation.

Details are provided in our separate AI Transparency.

We may update these Privacy Policy or related policies from time to time.

If material changes are made that significantly affect user rights or obligations, we will provide reasonable notice through the Platform or via email where appropriate.