Privacy
Meridian Photographers Pty Ltd operates Meridian Photographers from Australia. This notice explains what we hold, why, and what you can ask us to do about it.
If anything here is unclear, or you want something done with your data, raise a ticket — that is how you reach us, and it means your request is tracked and answered rather than lost in a mailbox.
Who is responsible
Meridian Photographers Pty Ltd (ABN 54 703 666 086, 240 Iodide Street, Broken Hill NSW 2880) is the data controller for everything described here.
If you host a site with us, you are the controller for whatever your own visitors and clients send you through that site, and we are your processor. We only touch that data to run the service, never for our own purposes.
What we hold, and why
| What | Why | Lawful basis (UK/EU) |
|---|---|---|
| Your email address and name | To send your licence, answer tickets, and manage your account | Contract |
| Order and payment records | To fulfil the order, and because tax law requires it | Contract; legal obligation |
| Licence keys and activated domains | To make updates work and stop one licence being shared endlessly | Contract; legitimate interests |
| Support tickets and replies | To answer you, and to remember what was said | Contract; legitimate interests |
| What you type to the help assistant | To answer your question from the help guides, and to attach the conversation to a ticket if you raise one | Legitimate interests |
| Hosted sites: your files and database | To run the site you pay us to run | Contract |
| Page views on this shop | To see which pages work | Legitimate interests |
We never sell your data and never share it for advertising. There is no advertising on this site and no third-party tracking.
Payment details
We never see your card. Payments go directly to Stripe, who are the controller for card data under their own policy. We store only what Stripe tells us: that a payment succeeded, the amount, and a reference.
Analytics, and why there is no cookie banner
We count page views without identifying anyone. No cookie is set, no fingerprint taken, and your IP address is never stored. Repeat visits are approximated with a hash of IP and browser that is re-salted every day, so yesterday's records cannot be linked to today's and nothing can be reversed into an IP address.
That is why there is no cookie banner: there is nothing to consent to. The only cookies we set keep you signed in and protect forms from cross-site submission — strictly necessary, and exempt from consent requirements.
This applies to our own site. A photographer's website hosted with us can have Google Analytics added by the photographer; if it does, that website sets Google's cookies, and the photographer's own privacy notice (and any request for consent) covers it, not this one.
How long we keep things
| What | Kept for |
|---|---|
| Orders, invoices and licences | Seven years, as Australian tax law requires |
| Support tickets | Three years after closing |
| Hosted site content | While your subscription runs |
| A deleted hosted site | 30 days, then permanently purged, together with its encrypted backups |
| Page view records | Fourteen months |
| Help assistant conversations | Thirty days, then deleted — unless you raise a ticket from one, when the conversation is kept with the ticket |
| Anonymous demo copies and anything uploaded into one | Thirty minutes after last use |
| Licence download log: the IP address, browser and time of each licence download, used to spot shared or stolen licences | Fourteen months, then deleted |
| Early-access list: your email address and when you confirmed it | Until you leave the list or we launch |
| Linked sign-in accounts (Google, Apple): the provider's account id and email address | While your account exists |
| Our own staff's admin activity log: staff email addresses and IP addresses | Two years, then deleted |
Your rights
Wherever you live, you can ask us to:
- Show you what we hold about you.
- Correct anything wrong.
- Delete what we hold, where we are not required to keep it. Tax records are the usual exception — we cannot delete an invoice for seven years, and will say so rather than pretend otherwise.
- Export your data. For a hosted site that is a complete backup of your database and every photograph, restorable onto any Meridian install. You are never locked in.
- Object to or restrict how we use it.
- Withdraw consent where consent was the basis.
Raise a ticket. We will acknowledge it within two business days and complete the request within 30 days, which is the limit the Privacy Act sets. There is no charge and no need to explain why you are asking. If a request will take the full 30 days we will tell you that when we acknowledge it, rather than at the end.
UK and EU: you may also complain to your national data protection authority. Australia: to the Office of the Australian Information Commissioner at oaic.gov.au.
If you are in California
You have the right to know what we collect, to delete it, to correct it, and not to be treated differently for asking. **We do not sell or share personal information** as the CCPA/CPRA define those terms, and have not in the past twelve months. There is no "Do Not Sell" link because there is nothing to opt out of.
Where your data goes
We are in Australia, and every server holding your data is in Sydney. Nothing is stored or processed outside Australia except card payments, which Stripe handles in Ireland and the United States under their own terms — we never receive the card number.
If you are in the UK or EU, your data is therefore transferred outside your region. Australia is not currently covered by a UK or EU adequacy decision, so those transfers rely on the safeguards and derogations in Articles 46 and 49 — principally that the transfer is necessary to perform your contract with us.
Our subprocessors — everyone who touches your data on our behalf, and nobody else:
| Who | For | Where |
|---|---|---|
| Amazon Web Services | The servers, and the backups | Sydney (ap-southeast-2) |
| Backblaze | Photograph and file storage | United States (Backblaze has no Australian region) |
| Cloudflare | Our domain names, and delivering photographs quickly | Its worldwide network, nearest to each visitor |
| Stripe | Taking payments | Ireland and the United States |
| Amazon Simple Email Service (Amazon Web Services) | Sending email | Sydney (ap-southeast-2) |
| Anthropic | Writing help assistant answers, only when that option is switched on. It is sent your question and the help text that matches it, and nothing else — no name, email or account details. | United States |
Twilio sends text reminders where a studio has turned them on, but under that studio's own Twilio account rather than ours — we never hold those messages or those numbers.
We do not add a subprocessor without adding it to this list first. If you want to be told when that happens, raise a ticket and say so.
Security
Passwords are hashed with bcrypt and never stored in a readable form — we cannot read yours, and a reset link is the only way back into an account.
Two-factor authentication is available on every account, and on ours it is switched on. We recommend it on yours, and we will never turn it off for you or ask you for a code.
Every hosted site keeps its data in its own database file and its own folder, and every request is checked against the site it belongs to, so one site's pages and panel cannot reach another's data. The sites share one web server process, so this separation is enforced by our code rather than by the operating system.
Backups are encrypted before they leave the server, and are kept in storage separate from the server itself. The thirty most recent backups of each site are kept; when a deleted site is purged, its backups are deleted with it.
If we suffer a data breach that is likely to put you at serious risk, we will tell you and the Office of the Australian Information Commissioner **within 72 hours** of becoming aware of it, and we will tell you what was taken rather than that "an incident occurred". Australia's notifiable data breaches scheme allows up to 30 days to assess; 72 hours is our own commitment and the shorter of the two.
Children
This is a service for professional photographers. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.
Changes
If we change this notice materially we will say so here and, where it affects you, tell you directly.
Last updated: 28 October 2026