Privacy Policy

1. Who We Are

MERDOT Technologies ("MERDOT," "we," "us," "our") is a company incorporated in India with its registered office in Ahmedabad, Gujarat. We build and operate MIOS — the MERDOT Narrative Intelligence Operating System.

For questions about this Privacy Policy or your personal data, contact us at contact@merdot.com.

2. Information We Collect

2.1 Website Visitors

When you visit merdot.com, we may collect:

• Standard server log data including IP address, browser type, referring URL, and pages visited
• Contact form submissions including name, email address, organization, and message content
• Any information you voluntarily provide when requesting platform access or a briefing

2.2 Platform Clients and Authorized Users

For institutional clients and authorized users of the MIOS platform, we collect:

• Account registration information including name, institutional email address, and role
• Platform usage data for security monitoring, audit logging, and service improvement
• Technical data including session tokens, access logs, and API request metadata

2.3 Information We Do Not Collect

We do not collect payment card data, government ID numbers, biometric data, or sensitive personal information categories through our website. We do not sell or rent personal data to third parties under any circumstances.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Responding to contact form submissions and access requests
• Processing and managing institutional deployment agreements
• Providing, maintaining, and improving the MIOS platform
• Security monitoring, threat detection, and fraud prevention
• Complying with legal obligations and lawful requests from authorized authorities
• Communicating service updates, security notices, and operational information to clients

We do not use your personal data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects without human review.

4. Legal Basis for Processing

We process personal data on the following legal bases under applicable Indian and international data protection law:

• Contract performance: Processing necessary to fulfill our agreements with institutional clients
• Legitimate interests: Security monitoring, fraud prevention, and service improvement
• Legal obligation: Compliance with lawful requests from Indian governmental authorities
• Consent: Where you have provided explicit consent, which you may withdraw at any time

5. Data Sharing

We do not sell personal data. We do not share personal data with third parties for marketing purposes. We may share personal data in the following limited circumstances:

• With infrastructure service providers who process data on our behalf under appropriate agreements
• With our employees and contractors who need access to fulfill their responsibilities
• When required by applicable law, court order, or lawful request from a governmental authority
• In connection with a merger, acquisition, or sale of substantially all assets, with prior notice to affected clients

6. Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, to maintain our contractual and legal obligations, and to resolve disputes. Specific retention periods include:

• Contact form submissions: 24 months from submission, unless converted to an active client relationship
• Client account data: Duration of the institutional agreement plus the period required by applicable law
• Platform audit logs: Minimum 12 months, configurable per deployment agreement
• Server logs: 90 days from collection

7. Security

We implement appropriate technical and organizational security measures including AES-256 encryption at rest, TLS 1.3 in transit, multi-factor authentication, role-based access controls, and regular security audits. Full details are available in our Security Architecture documentation.

No transmission over the internet is completely secure. While we take every reasonable precaution, we cannot guarantee absolute security. In the event of a personal data breach affecting your information, we will notify you as required by applicable law.

8. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Access: Request a copy of personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Erasure: Request deletion of your personal data where we have no overriding legitimate grounds to retain it
• Objection: Object to certain types of processing including direct marketing
• Grievance: Lodge a complaint with our Data Protection Officer or with the Data Protection Board of India

To exercise any of these rights, contact us at contact@merdot.com. We will respond within 30 days.

9. Cookies

The merdot.com website uses minimal cookies necessary for the website to function. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. Session cookies are used for security purposes and are deleted when you close your browser.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to review the privacy policies of any third-party site you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to active clients via email and announced on this page with an updated effective date. Continued use of our website or platform after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, data subject requests, or complaints, contact our Data Protection Officer: