Legal
Privacy Policy
What we collect, why we collect it, and what you can do about it. We have tried to write this in plain language rather than in the usual defensive legalese.
Last updated
Before you publish this. This document describes how the software actually behaves, which makes it an accurate starting point — but it is not legal advice. Have a qualified adviser review it, and replace every [BRACKETED] placeholder with your real company details before going live.
01Who we are
Meridian Freight (“we”, “us”) is a freight forwarding and delivery company registered at 1400 Harbor Distribution Way, Long Beach, CA 90802. For data protection purposes we are the controller of the personal data described below.
Company registration number [REGISTRATION NUMBER]. Questions about this policy go to privacy@meridianfreight.com, or to our data protection contact at [DPO NAME AND ADDRESS].
02What we collect and why
We have deliberately kept this short, because the site genuinely collects very little.
| Data | Why we hold it | Lawful basis |
|---|---|---|
| Recipient name, delivery address, email and phone on a shipment | To carry the shipment and to let the recipient track it | Performance of a contract |
| Shipment metadata — weight, dimensions, declared value, your reference | To price, route and insure the consignment | Performance of a contract |
| Checkpoint scans — location and time of each handover | To show tracking history and to investigate delays and claims | Performance of a contract |
| Contact form submissions — name, email, company, phone, message | To answer your enquiry or quote request | Legitimate interests (responding to you) |
| A truncated, hashed fingerprint of your IP address on tracking lookups | Rate limiting, to stop someone guessing tracking numbers in bulk | Legitimate interests (security) |
| Operator account email and password hash | To secure access to the staff console | Legitimate interests (security) |
We do not collect special category data, we do not build advertising profiles, and we do not buy or sell personal data.
03The public tracking page
Anyone holding a tracking number plus the delivery postcode or the recipient’s email address can view a shipment. We ask for that second detail specifically so that someone guessing tracking numbers cannot browse other people’s deliveries.
Even then, the public page shows less than the operator console does. The recipient’s name is shortened to a first name and last initial, and the email address, phone number, street address, declared value and any internal notes are never sent to the browser at all.
Tracking links we send you contain a random token. Anyone with that link can see the shipment, so treat it like any other private link. Our operators can revoke a link at any time, which immediately breaks the old one.
04Who else sees your data
We use a small number of processors, and we would rather name them than gesture at “partners”.
| Processor | What it handles | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, the database holding shipment records, and network security | Global edge network |
| OpenFreeMap | Map tiles for the route map. Loading the map sends your IP address and the map area being viewed to their servers, as any map provider requires. | EU |
| Delivery and haulage partners | Recipient name, address and contact details where a leg of the journey is subcontracted | Varies by route |
We do not use Google Analytics, advertising pixels, social media trackers, session recording, or any other third-party tag. If that changes, this page changes first and the analytics category in your cookie preferences starts doing something.
We may disclose data where we are legally required to — for example customs authorities on a cross-border shipment, or a valid court order.
05How long we keep it
- Rate-limiting records are deleted automatically after 24 hours. This one is enforced in code, not just policy.
- Shipment and checkpoint records are retained for the period attached to your plan — 30 days on Starter, two years on Business, and the contract term on Enterprise — and then deleted.
- Contact enquiries are kept for
[RETENTION PERIOD]after the conversation ends. - Customs and accounting records are kept for as long as tax and customs law requires, which is typically longer than the above and overrides it.
06Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable format, and withdraw consent where consent is what we relied on.
Email privacy@meridianfreight.com and we will respond within one month. There is no charge. If you are unhappy with the outcome you can complain to your local supervisory authority — in the UK that is the Information Commissioner’s Office, and in the EU it is your national data protection authority.
If you are a California resident, you also have the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA.
07How we protect it
Traffic is encrypted in transit. Operator passwords are stored only as salted PBKDF2 hashes and are never recoverable, staff sessions are signed and expire after 12 hours, and tracking lookups are rate limited to frustrate bulk guessing.
Our security page goes into more detail. No system is perfectly secure; if we ever suffer a breach affecting your rights we will notify you and the relevant regulator as the law requires.
08International transfers
Shipping is international by nature, so recipient details necessarily travel to the destination country and to the partners handling that leg. Our hosting runs on a global edge network, which means data may be processed outside your country. Where data leaves the UK or EEA we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. Copies are available on request.
09Children
This is a business service and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
10Changes to this policy
If we make a material change we will update the date at the top of this page and, where the change affects how we use data you have already given us, tell you directly. Continuing to use the service after a change means you accept the updated policy.
Related: Privacy Policy · Cookie Policy · Terms of Service · Security