Privacy Policy
Effective Date: 05.03.2026 | Last Revised: 28.06.2026
This Privacy Policy explains how MERAKI HR SRL collects, uses, stores, and protects personal data when you access or use the LIMEN website, applications, and services. For the purposes of this Privacy Policy, "LIMEN" or the "Platform" refers to the LIMEN brand and its products, including LIMEN Energy, LIMEN Align, LIMEN Threshold (Before Commitment, Before Parenthood, Before Separation), and related tools operated by MERAKI HR SRL.
1. Data Controller Information
MERAKI HR SRL — Bucharest, District 6, Romania Trade Register: J2024005188408 CUI: 49743547 | VAT: RO49743547 | EUID: ROONRC.J40/5188/2024 Email: limen@merakihr.ro
For all data protection inquiries, please contact: limen@merakihr.ro
Supervisory authority: ANSPDCP — Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (dataprotection.ro).
2. Scope of This Policy
This Policy applies to:
- The LIMEN website (limen.systems)
- LIMEN Threshold (Before Commitment, Before Parenthood, Before Separation)
- LIMEN Energy
- LIMEN Align
- Any related mobile applications
- Any future LIMEN products operated by MERAKI HR SRL
It applies to users located in the European Union, the United States, and internationally.
3. What Data We Collect
We collect only data necessary to operate the Platform.
3.1 Website Data
When you visit our website, we may collect IP address, browser type, device information, pages visited, cookies and usage analytics.
3.2 Account Information
If you create an account: email address, password (encrypted), first name, age range (selected during onboarding), gender (optional, selected during onboarding), subscription plan and status, billing information (processed by payment provider — see Section 8). We do not store full payment card details.
3.3 LIMEN Threshold
LIMEN Threshold presents structured reflective questions only. It does not collect, store, or process personal relational responses.
3.4 LIMEN Energy & LIMEN Align
If you use these tools, we process self-reported interaction reflections, time-based entries, user-provided responses, interaction categorizations, structured summaries derived from user input.
Important: LIMEN does not request medical diagnoses, clinical mental health data, or legal records. Users are responsible for avoiding inclusion of identifiable third-party personal data without consent.
3.5 Technical & Security Data
Collected for security and service improvement: login activity, device type, session data, error logs.
4. Legal Basis for Processing (EU Users)
For users in the European Union, processing is based on:
- Article 6(1)(b) GDPR — Contract performance
- Article 6(1)(a) GDPR — Consent (where applicable)
- Article 6(1)(f) GDPR — Legitimate interest (security, fraud prevention)
- Article 6(1)(c) GDPR — Legal obligation (tax, accounting, regulatory compliance)
We do not intentionally process special categories of personal data under Article 9 GDPR.
5. Purpose of Processing
We use personal data to provide access to the Platform, organize and display user-reported reflections, manage subscriptions and payments, improve service functionality, ensure security and prevent misuse, and communicate service-related updates.
We do not sell personal data. We do not use personal data for automated decision-making that produces legal or similarly significant effects.
6. Marketing Communications
If you choose to subscribe to updates, waiting lists, or early access notifications related to LIMEN products, we may use your email address to send product updates, early access invitations, feature announcements, research participation invitations, and limited promotional communications related to LIMEN products and services.
Marketing communications are sent only where the user has provided consent or where otherwise permitted by applicable law. You may withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in our emails or by contacting limen@merakihr.ro.
7. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected:
- Email and marketing contact data: retained until unsubscribe or withdrawal of consent
- Research participation data: duration of the relevant study plus 24 months
- Purchase and transaction records: retained for 10 years in accordance with Romanian fiscal law
- Technical logs and security data: retained for up to 12 months
- Account data: retained while the account is active, or until the user requests deletion
Inactive accounts may be deleted after a defined inactivity period (from 12 to 24 months). Users may request deletion at any time by contacting limen@merakihr.ro. Upon verified request, personal data will be deleted or anonymized within 30 days, subject to any overriding legal retention obligations.
8. Data Sharing and Third-Party Processors
We share personal data only with service providers acting as data processors on our behalf, strictly for the purposes described in this Policy. All processors are contractually bound by data processing agreements consistent with GDPR Article 28. We do not sell personal data. We do not share personal data with advertisers or data brokers.
Processor Register
| Processor | Role | Country | Transfer Mechanism | DPA Status |
|---|---|---|---|---|
| Lovable Technologies | App platform | US/EU | SCCs (pending written confirmation) | DPA |
| HubSpot Inc. | CRM & email marketing | US | SCCs per EU Decision 2021/914 | DPA |
| Anthropic, Inc. | AI processing (Claude) | US | SCCs per EU Decision 2021/914 | DPA |
| Stripe Payments Europe Ltd. | Payment processing | IE (EU) | EU-based processing | DPA |
| Microsoft OneDrive | Cloud storage | IE (EU) | EU-based processing | DPA: microsoft.com/licensing |
| Google Drive / Analytics | Cloud storage & analytics | IE (EU) | EU-based processing | DPA |
| Meta Platforms Ireland Ltd. | Advertising (conditional) | IE (EU) | EU-based processing | Policy |
| Google Analytics; Google Tag Manager | Analytics | IE (EU) | Google Ireland Ltd, Dublin | Policy |
| Supabase | Database hosting | EU | EU operations via AWS Frankfurt | Privacy |
8.2 AI Processing
LIMEN integrates Claude, developed by Anthropic, Inc., for AI-assisted features including reflection summaries and CRM workflow automation via HubSpot. When AI-assisted features are active, user-submitted data may be processed by Anthropic. Transfer mechanism: Standard Contractual Clauses (SCCs) under EU Commission Decision 2021/914.
8.3 Payments & Billing
If you make a purchase, payment data is processed by Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. MERAKI HR SRL does not store payment card details. Romanian fiscal law requires 10-year retention of invoice records, for that, MERAKI HR SRL uses i-Tom Solutions SRL (FGO) (ISO 27001, ISO 9001; registered personal data operator no. 18584). Invoice data is retained for the legally required fiscal period (minimum 10 years under Romanian accounting law) and cannot be deleted upon user request, as retention is a statutory obligation.
8.4 Analytics
We use Google Analytics and Google Tag Manager, both operated by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (EU/EEA processing). Google Tag Manager manages the deployment and firing of all tracking scripts on the Platform, including analytics and advertising tags. Google Analytics collects anonymized interaction data including pages visited, session duration, device type, and approximate geographic location. IP anonymization is enabled. For EU users, all tags are activated only after explicit consent is obtained via the cookie consent mechanism. No tracking scripts fire before consent.
8.5 Advertising and Remarketing
The Meta Pixel is loaded only after the user grants marketing consent through the in-page cookie banner. Consent is required before any pixel events fire. Users may withdraw consent at any time via the "Cookie settings" link in the site footer.
8.8 General Obligations
All third-party processors are contractually bound to process personal data only on our documented instructions, required to implement appropriate technical and organizational security measures, prohibited from using personal data for their own independent purposes unless required by law, and subject to confidentiality obligations.
We do not sell personal data to any third party under any circumstances.
9. International Data Transfers
As a Romania-based company operating within the European Union, we prioritise EU data residency wherever possible.
EU-based processing: Application infrastructure (Lovable/Supabase) stored in Frankfurt, Germany (AWS eu-central-1) — no transfer outside EEA. Fiscal invoicing (FGO) stored on AWS EU servers within the EEA.
US-based processors with SCCs: Stripe Inc., HubSpot Inc., Anthropic Inc. All transfers are governed by Standard Contractual Clauses (SCCs) adopted under EU Commission Decision 2021/914, and where applicable, certification under the EU-US Data Privacy Framework.
Google Ireland Ltd acts as the data controller for EU users for Google Analytics and Google Tag Manager. Data may be processed on Google's global infrastructure. Transfer mechanism: SCCs under EU Commission Decision 2021/914 and the EU-US Data Privacy Framework.
10. Security Measures
We implement appropriate technical and organizational measures including SSL encryption, restricted access controls, secure hosting infrastructure, data minimization principles, and error telemetry handled via Lovable's platform infrastructure with a PII scrubber applied to all error payloads. No system can guarantee absolute security.
11. Your Rights — EU Users (GDPR)
If you are located in the EU/EEA, you have the right to:
- Access your data
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Restrict processing
- Object to processing based on legitimate interests
- Data portability
- Withdraw consent at any time
- Lodge a complaint with ANSPDCP (dataprotection.ro)
To exercise any of these rights, contact limen@merakihr.ro. We will respond within 30 days.
12. US Privacy Rights
If you are a US resident, including California residents, you may have the right to request access, deletion, or correction of personal information collected, to know whether personal data is sold or shared, to opt out of the sale or sharing of personal information, and to limit use of sensitive personal information (California — CPRA). LIMEN does not sell personal information. To exercise rights, contact limen@merakihr.ro.
13. Cookies & Tracking
We use cookies and similar technologies. Details are provided in our separate Cookie Policy. Users may withdraw consent for non-essential cookies at any time from the footer "Cookie settings" link.
14. Children's Privacy
The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that data from a minor has been collected, we will delete it promptly.
15. Automated Processing & AI
AI-assisted tools are used within the Platform. No automated decisions produce legal or similarly significant effects. Users remain responsible for interpretation of outputs. Details are provided in our separate AI Transparency Policy.
16. Data Breach Notification
In the event of a personal data breach likely to result in high risk to the rights and freedoms of users, MERAKI HR SRL will notify affected users without undue delay in accordance with GDPR Article 34, and will notify ANSPDCP within 72 hours in accordance with GDPR Article 33.
17. Changes to This Policy
We may update this Privacy Policy or related policies from time to time. Where changes materially affect user rights or obligations, we will provide at least 14 days' notice by email before the change takes effect. Continued use of the Platform after such updates constitutes acceptance of the revised Policy.