Scope
This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit meanwhile.is, contact us (including by phone or SMS), or engage us for services. If you provide client documents or data to us, see Section 10 (Client Documents).
1A) Important Limits & Non-Contractual Nature
This Policy describes our privacy practices but is not a contract and does not create any legal rights or obligations beyond those required by applicable law. If we provide a plain-English summary elsewhere, this Policy controls in case of any conflict.
Employment/Contractor/Applicant data: This Policy does not cover information collected in our capacity as an employer, contractor manager, or for recruiting. Those activities are governed by our Workforce Privacy Notice (available upon request). Business-to-business contact information collected for our client relationships is covered by this Policy unless a separate notice applies.
Legal Stuff:
2) Quick Notice at Collection (California & Global)
We collect the categories below for the listed purposes. Where exact retention periods aren’t practical, we state the criteria used. We do not “sell” personal information, and we do not “share” it for cross-context behavioral advertising. If that changes, we will update this Policy, provide a “Do Not Sell or Share” mechanism, and honor recognized opt-out preference signals such as Global Privacy Control (GPC).
- Category: Identifiers
Examples: name, email, phone, IP address, cookie or device identifiers
Purposes: provide services; communicate; security and fraud prevention; compliance
Retention/Criteria: for the life of the account/client relationship or business need, then deletion or de-identification
- Category: Commercial/Contract Information
Examples: proposals, project scope, invoices, payment records (limited), records of services
Purposes: deliver services; billing; accounting; compliance
Retention/Criteria: project life + legal/recordkeeping needs (e.g., tax and accounting)
- Category: Internet/Device Data
Examples: pages viewed, timestamps, referral URLs, general location derived from IP, log data, cookies/pixels/tags (see Cookies & Tracking)
Purposes: site operation; analytics; performance and security; if enabled, advertising measurement
Retention/Criteria: shortest practical period (typically 12–25 months) or per provider tools/settings
- Category: Communications
Examples: emails, web forms, SMS content and delivery metadata, voicemails/call recordings (if recorded with notice/consent)
Purposes: support; operations; recordkeeping; compliance; quality assurance
Retention/Criteria: open-ended unless deletion is requested or required; we periodically review to ensure continued business need
- Category: Sensitive Personal Information (California)
Examples: only if you intentionally provide such data (e.g., ID for vendor onboarding, limited financial record fragments visible to us)
Purposes: verification; fraud prevention; legal compliance
Retention/Criteria: minimum necessary for stated purpose; then delete, de-identify, or restrict access
- Category: Aggregated/De-Identified Information
Examples: site or service usage totals; datasets that cannot reasonably be linked to a person or household
Purposes: analytics; service improvement; security and reliability; reporting
Commitments: we will maintain and use such information in de-identified form; will not attempt to re-identify it except to test our de-identification; and will require recipients to do the same where applicable
Retention/Criteria: retained as needed for the purposes above or as permitted by law
2A) Information We Ask You Not to Provide
Please avoid sending us sensitive information unless we specifically request it in writing for a legitimate purpose. This includes: protected health information (PHI), Social Security numbers, government ID numbers, full payment card or bank account numbers, precise geolocation, biometric identifiers/templates, or similar high-risk data. We are not a HIPAA covered entity or business associate. If we discover PHI or other sensitive data sent contrary to this request, we will delete or restrict it where feasible and lawful.
3) Sources of Information
- Directly from you (forms, email, phone/SMS, meetings).
- Automatically via our website (logs, cookies, tags, pixels, SDKs).
- Service providers (hosting, analytics, communications) and public sources.
4) How We Use Information
- Deliver and improve services; project management and support.
- Communicate with you (operational/transactional; marketing only if you opt in where required).
- Detect, prevent, and respond to fraud, abuse, and outages; secure our systems.
- Fulfill legal, tax, accounting, and contractual obligations.
- Run analytics and measurement; and, if enabled, advertising measurement/retargeting (see Section 7).
- We do not use your personal information to train general-purpose AI models unrelated to providing or securing our services.
4A) Payments & Card Data
If we accept card payments, they are processed by third-party payment processors. We do not store full payment card numbers or CVV codes on our systems. Your payment information is handled by those processors under their own privacy and security policies.
5) How We Disclose Information
We do not sell personal information. We disclose limited data to:
- Service providers/processors (hosting, cloud storage, analytics, email/SMS, call handling, billing, security) under contract to use data only for our purposes;
- Professional advisors (legal, accounting), government authorities, or as required by law;
- In business transitions (e.g., merger, acquisition, financing, or asset transfer).
If we ever sell or share information for cross-context behavioral advertising, we will provide a “Do Not Sell or Share My Personal Information” link, honor GPC, and describe your opt-out rights.
6) Cookies & Tracking Technologies
We (and providers) use:
- Essential cookies (site operation, security);
- Functional cookies (preferences);
- Analytics cookies (traffic and performance);
- Advertising/retargeting cookies (only if enabled).
Your choices:
- Manage cookies via our Cookie Settings (if shown) or your browser; some features may not function without certain cookies.
- EEA/UK visitors: we will not set non-essential cookies until you give opt-in consent; you can withdraw consent as easily as you gave it.
- California visitors: we honor recognized opt-out preference signals such as Global Privacy Control (GPC) for “sale/share,” if applicable.
- Do Not Track (DNT) signals are not consistently supported; we respond to legally required signals (e.g., GPC).
6A) Third-Party Sites, Apps & Embedded Content
Our site may link to third-party websites or include embedded content and tools (for example, maps, video players, fonts, analytics tags, or CAPTCHA). These third parties may collect information about you in accordance with their own policies. We do not control their practices, and this Policy does not apply to them. Please review their privacy notices and cookie policies.
7) Ads, Analytics & Targeting (When Enabled)
If we enable advertising/retargeting, third parties may set or read cookies and device signals to measure performance and show relevant ads. We will update this Policy, provide the required opt-outs (including “Do Not Sell/Share”), honor GPC and, in the EEA/UK, run such tracking only with prior consent.
8) Your Rights (U.S. State Laws, including California)
Depending on where you live, you may have the right to:
- Know/Access the categories and specific pieces of personal information we hold about you;
- Delete personal information (subject to exceptions);
- Correct inaccurate personal information;
- Opt out of sale/share/targeted advertising (if applicable);
- Limit the use/disclosure of Sensitive Personal Information (if applicable);
- Non-discrimination for exercising your rights.
How to exercise rights: email privacy@meanwhile.is or write to our address. We will acknowledge California requests within 10 business days and respond within 45 days (up to 90 with notice). We will process opt-out/limit requests as soon as feasible and no later than 15 business days where required. You may use an authorized agent; we may need to verify identity and authority.
Authorized Agents & Identity Verification (California)
To protect your information, we must verify your identity before fulfilling access, deletion, or correction requests. If you use an authorized agent, we may require: (a) a signed, written authorization from you and (b) verification of your identity directly with us; or a valid power of attorney. For opt-out requests, a less stringent verification process may apply.
Appeals (Other U.S. States)
If we deny your request and applicable state law (e.g., Colorado, Virginia, Connecticut) provides a right to appeal, you may email privacy@meanwhile.is with the subject “Privacy Appeal.” We will respond with a written decision within 45 days (extendable as allowed by law) explaining our reasons and how you may contact your state attorney general if you remain unsatisfied.
Minors: We do not knowingly sell/share personal information of consumers under 16. We do not knowingly collect personal information from children under 13; see Section 16.
9) EEA/UK GDPR
Controller: Meanwhile Studio LLC is the controller for website and business data.
Legal bases: performance of a contract; legitimate interests (e.g., service improvement, security); consent (e.g., non-essential cookies/marketing); legal obligation.
Your rights: access; rectification; erasure; restriction; objection; portability; and withdraw consent at any time where processing is based on consent. You may lodge a complaint with your local supervisory authority.
EU/UK Representative: If we later determine we offer goods/services to or monitor behavior of individuals in the EEA/UK on more than an occasional basis, we will appoint an EU/UK representative and update this Policy with their contact details.
Cookies (EEA/UK): We obtain prior consent before setting non-essential cookies and make it as easy to withdraw consent as to give it.
10) Client Documents (Storage, Roles & Confidentiality)
Role: For our own website/business data, we act as a controller. For client-provided content, we act as a processor/service provider and handle data only per written instructions and our agreement (or DPA).
Where we store (illustrative and subject to change): Google Workspace (Drive/Docs/Sheets/Gmail) for content and collaboration; Grasshopper for call handling/SMS logs; Namecheap for domain/DNS; meanwhile.is hosted by our chosen provider; and other comparable providers as needed.
Service provider locations may be outside your state or country. We require service providers to process personal information solely to provide services to us, implement reasonable security, not sell or share your personal information, and delete or return personal information at termination where required by law.
Security: encryption in transit (and at rest where supported), multi-factor authentication (MFA), least-privilege access, logging, and vendor access controls.
Retention: default open-ended while client relationship or legitimate business/legal needs continue; upon verified client request we will export and delete within a reasonable period (e.g., 30 days) except where retention is required by law.
Confidentiality: personnel and contractors are bound by confidentiality. We do not mine client content for advertising or unrelated model training.
11) Phone & SMS (Toll-Free Auto-Responder)
Texting our toll-free number (listed on our site) triggers an automated one-time reply (e.g., a link or office hours). We do not enroll you in recurring/marketing texts without a separate, explicit opt-in. Reply STOP to opt out; HELP for help. Message/data rates may apply. We keep basic SMS logs (number, timestamps, delivery metadata, and the message content you send) and protect them consistent with this Policy. Program intended for individuals 13+.
12) Communication Preferences
Transactional communications (project updates, billing, legal notices) are part of our services. Marketing communications are opt-in where required; unsubscribe anytime via our emails. We may communicate by email, phone, SMS, or client-approved collaboration tools. We may record meetings/calls with notice and consent where required.
13) Retention
Our default is open-ended retention for project materials and business records, not longer than reasonably necessary for the purposes described here or as required by law. Where specific dates are not practical, we apply criteria including: the life of a client account/project; legal/tax obligations (often up to seven years); security/audit needs; and technical limits of provider systems. On request, we will delete or de-identify data unless a legal exception applies.
13A) Backups & Residual Copies
When we delete data from active systems, residual copies may remain in backups for a limited period until those backups are overwritten during scheduled cycles. During that period, backed-up copies are segregated and used only for security, continuity, or legal purposes.
14) Security
We use appropriate administrative, technical, and organizational safeguards (MFA; least-privilege access; encryption in transit/at rest where supported; logging/alerting; vendor due diligence; and staff training). No method is 100% secure, but we work to materially reduce risk.
14A) Third-Party Security & Your Responsibilities
To the extent permitted by law, we are not responsible for the security of information you transmit over networks that we do not control. Please use unique, strong credentials; limit what you share in unencrypted channels; and notify us promptly of any suspected unauthorized access to your account or our communications.
15) International Data Transfers
If you are outside the United States, your information may be processed in the U.S. or other countries with different laws. Where required, we use Standard Contractual Clauses or other approved safeguards for cross-border transfers.
16) Children
Our services are not directed to children under 13, and we do not knowingly collect their data. If you believe a child under 13 provided data, contact privacy@meanwhile.is and we will take appropriate steps.
17) California “Shine the Light”
We do not disclose personal information to third parties for their direct marketing purposes. If that changes, we will provide the required disclosures and methods to request details.
17A) Financial Incentives (California)
We do not offer programs that provide financial incentives, price or service differences in exchange for personal information. If we introduce such a program, we will provide a Notice of Financial Incentive describing the material terms, categories of personal information implicated, how the value is calculated, and how you may opt in and withdraw at any time without retaliation.
18) Automated Decision-Making
If we ever use automated decision-making technology to make significant decisions about individuals, we will provide pre-use notice, enable any required opt-out, and explain the logic and outcomes consistent with applicable law.
19) Changes to This Policy
We may update this Policy periodically. We will post the updated version with a revised Effective Date and provide additional notice where required.
20) Contact
Questions or requests: privacy@meanwhile.is or mail Meanwhile Studio LLC, 506 S Spring St #13308, SMB#92166, Los Angeles, CA 90013.