This Privacy Policy explains how MERAKI HR SRL collects, uses, stores, and protects personal data when you access or use the LIMEN website, applications, and services. For the purposes of this Privacy Policy, "LIMEN" or the "Platform" refers to the LIMEN brand and its products, including LIMEN Energy, LIMEN Align, LIMEN Threshold (Before Commitment, Before Parenthood, Before Separation), and related tools operated by MERAKI HR SRL. This policy also covers any future LIMEN products or services launched under the MERAKI HR SRL brand.

MERAKI HR SRL

Bucharest, District 6, Romania

Trade Register: J2024005188408

CUI: 49743547 | VAT: RO51271373 | EUID: ROONRC.J40/5188/2024

Email: limen@merakihr.ro

For all data protection inquiries, please contact: limen@merakihr.ro

Supervisory authority: ANSPDCP — Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (dataprotection.ro)

This Policy applies to:

It applies to users located in the European Union, the United States, and internationally.

We collect only data necessary to operate the Platform.

When you visit our website, we may collect:

If you create an account:

We do not store full payment card details.

LIMEN Threshold presents structured reflective questions only. It does not collect, store, or process personal relational responses.

If you use these tools, we process:

Important: LIMEN does not request medical diagnoses, clinical mental health data, or legal records. Users are responsible for avoiding inclusion of identifiable third-party personal data without consent.

Collected for security and service improvement:

For users in the European Union, processing is based on:

We do not intentionally process special categories of personal data under Article 9 GDPR.

We use personal data to:

We do not sell personal data.

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

6.1 If you choose to subscribe to updates, waiting lists, or early access notifications related to LIMEN products (including LIMEN Align, LIMEN Energy, and LIMEN Threshold), we may use your email address to send:

Marketing communications are sent only where the user has provided consent or where otherwise permitted by applicable law.

You may withdraw your consent and unsubscribe from marketing communications at any time by clicking the unsubscribe link in our emails or by contacting limen@merakihr.ro.

We retain personal data only for as long as necessary for the purposes for which it was collected. Specifically:

Inactive accounts may be deleted after a defined inactivity period (from 12 to 24 months).

Users may request deletion at any time by contacting limen@merakihr.ro. Upon verified request, personal data will be deleted or anonymized within 30 days, subject to any overriding legal retention obligations.

We share personal data only with service providers acting as data processors on our behalf, strictly for the purposes described in this Policy. All processors are contractually bound by data processing agreements consistent with GDPR Article 28. We do not sell personal data. We do not share personal data with advertisers or data brokers.

Each processor is engaged under contractual obligations that require them to maintain appropriate data protection standards consistent with GDPR and applicable law. The table below is our living processor register, updated as our technology stack evolves.

Where a DPA has been formally requested but not yet received (marked "DPA requested — awaiting response"), MERAKI HR SRL has documented the request in its Records of Processing Activities (ROPA) and relies on the processor's published terms and independently verified security certifications as interim safeguards. This reflects a documentation gap being actively pursued — not an absence of legal protection on the processor's side. Users will be notified of material changes to processor arrangements via email or prominent notice on limen.systems.

MERAKI HR SRL reserves the right to change platform providers without requiring a full policy revision, provided the replacement processor offers equivalent or stronger data protection safeguards, the processor register above is updated within 30 days, and users are notified of material changes.

LIMEN integrates Claude, developed by Anthropic, Inc. (anthropic.com), for AI-assisted features including reflection summaries and CRM workflow automation via HubSpot. When AI-assisted features are active, user-submitted data may be processed by Anthropic.

Anthropic, Inc., San Francisco, CA, USA

Transfer mechanism: Standard Contractual Clauses (SCCs) under EU Commission Decision 2021/914

DPA: anthropic.com/legal

If you make a purchase, payment data is processed by Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

MERAKI HR SRL does not store payment card details. Stripe operates as an independent data processor under its own privacy and security standards. DPA: stripe.com/ie/legal/dpa

Romanian fiscal law requires 10-year retention of invoice records, for that, MERAKI HR SRL uses i-Tom Solutions SRL (FGO)

i-Tom Solutions SRL (FGO)

Role: Data processor — Romanian fiscal invoicing and e-Factura reporting (RO SPV)

Address: Romania Data transferred: Name, email, subscription amount, invoice details (as required by Romanian fiscal law) Legal basis for processing: Legal obligation (Article 6(1)(c) GDPR) — Romanian fiscal legislation requires invoice issuance and e-Factura reporting via ANAF SPV Data residency: EU (Amazon AWS EU servers) Certifications: ISO 27001, ISO 9001; registered personal data operator no. 18584 Note: Invoice data is retained for the legally required fiscal period (minimum 10 years under Romanian accounting law) and cannot be deleted upon user request, as retention is a statutory obligation. More information: fgo.ro/termeni/confidentialitate.

We use Google Analytics, operated by Google Ireland Ltd, to understand how users interact with the Platform. Analytics data is anonymized where technically possible. For EU users, analytics cookies are activated only after consent.

If Meta Pixel is active, interaction data may be processed by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for the purpose of measuring advertising effectiveness and remarketing. For EU users, this is activated only after explicit consent.

Each processor listed above bears independent legal obligations under applicable data protection law. Where a data incident, breach, or compliance failure originates with a third-party processor rather than with MERAKI HR SRL, liability is shared in accordance with GDPR Article 82 and the terms of the relevant processor's published or contracted obligations. MERAKI HR SRL maintains documented evidence of due diligence in processor selection, including DPA requests, security certifications reviewed, and formal correspondence records. This documentation is available to ANSPDCP upon request. Users who believe their data has been mishandled by a third-party processor may contact limen@merakihr.ro to receive information about the relevant processor's contact details and complaint mechanisms.

LIMEN is built on modular third-party infrastructure. MERAKI HR SRL reserves the right to change platform providers without requiring a full policy revision, provided that:

— The replacement processor offers equivalent or stronger data protection safeguards

— The processor register in §8 is updated within 30 days of the switch

— Users are notified of material changes by email or prominent notice on limen.systems

All third-party processors are:

We do not sell personal data to any third party under any circumstances.

As a Romania-based company operating within the European Union, we prioritise EU data residency wherever possible.

US-based processors with SCCs: The following processors are based in the United States. All transfers are governed by Standard Contractual Clauses (SCCs) adopted under EU Commission Decision 2021/914, and where applicable, certification under the EU-US Data Privacy Framework:

You have the right to request information about the specific safeguards applied to your data transfers at any time by contacting limen@merakihr.ro.

Where written DPA confirmation is pending, MERAKI HR SRL relies on the processor's published privacy terms and independently verified security certifications as interim assurance, with formal requests on record in our ROPA.

We implement appropriate technical and organizational measures including:

However, no system can guarantee absolute security.

If you are located in the EU/EEA, you have the right to:

To exercise any of these rights, contact limen@merakihr.ro. We will respond within 30 days. Where a request involves data held by a third-party processor, we will assist in directing the request to the appropriate party.

If you are a US resident, including California residents, you may have the right to:

LIMEN does not sell personal information. LIMEN does not share personal information with third parties for cross-context behavioral advertising.

To exercise rights, contact: limen@merakihr.ro. We will respond within 45 days.

Under applicable US privacy laws, including the California Consumer Privacy Act (CCPA), we may collect the following categories of personal information:

We do not sell personal information to third parties.

Users may request disclosure or deletion of personal data as described in this Privacy Policy.

We use cookies and similar technologies. Details are provided in our separate Cookie Policy. Users may withdraw consent for non-essential cookies at any time.

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that data from a minor has been collected, we will delete it promptly.

AI-assisted tools are used within the Platform:

Details are provided in our separate AI Transparency Policy.

In the event of a personal data breach likely to result in high risk to the rights and freedoms of users, MERAKI HR SRL will notify affected users without undue delay in accordance with GDPR Article 34, and will notify ANSPDCP within 72 hours in accordance with GDPR Article 33.

Where a breach originates with a third-party processor, MERAKI HR SRL will notify users of the breach and the identity of the processor involved as soon as reasonably practicable following notification from that processor.

We may update this Privacy Policy or related policies from time to time.

Where changes materially affect user rights or obligations, we will provide at least 14 days' notice by email before the change takes effect.

Non-material changes such as updates to the processor register in §8 will be reflected in this document with the revision date updated, without individual notice.

Continued use of the Platform after such updates constitutes acceptance of the revised Policy.