Privacy Policy

1. Who we are

Meridian Glow Company, a Saudi company based in Riyadh, operates this pre-launch NayVella website and determines why and how personal data submitted through it is processed. For this website, Meridian Glow Company acts as the data controller.

2. Scope and current status

This policy applies only to the public pre-launch landing website. NayVella accounts, marketplace transactions, checkout, consultations, AI analysis, and virtual try-on are not currently offered through this website. Policies for future services will be provided before those services begin.

3. Personal data we collect

• Customer interest: name, email address, selected area of interest, consent record, form language, and the website page from which the request was submitted.
• Merchant interest: brand and contact details, email, mobile number, city, business type, product categories, website or social link, and business notes.
• Clinic or doctor interest: clinic and contact details, email, mobile number, city, specialties, and relevant business information.
• Beauty-specialist interest: name, email, mobile number, city or service locations, specialty, professional link, and related form selections.
• Security and technical data: request time, IP-derived one-way rate-limit hash, Cloudflare request identifier, browser, device, and traffic information made available through ordinary web delivery, and Turnstile verification results. We do not store the raw requester IP address in our lead tables.

Please do not submit identity documents, medical records, health information, passwords, payment data, or other sensitive information through these forms.

4. Why we process data

• To receive and respond to expressions of interest.
• To communicate about launch readiness, relevant NayVella services, and possible qualification steps.
• To organize leads by audience and understand demand.
• To secure the website, prevent spam, enforce consent, deduplicate submissions, and limit abuse.
• To meet applicable legal and regulatory requirements and protect lawful interests.

5. Legal basis and consent

Where consent is the applicable basis, the form records your affirmative agreement before a lead is stored. You may withdraw consent for future communications by contacting us. Withdrawal does not affect processing already lawfully completed. Certain limited processing may also be necessary to protect the website, establish or defend legal claims, or meet a legal obligation, where permitted by applicable law.

6. Data minimization and accuracy

We limit collection to information reasonably needed for the stated pre-launch purposes. You are responsible for providing accurate information and should not provide data about another person unless authorized to do so.

7. Service providers and recipients

Authorized Meridian Glow personnel and contracted service providers may process data only as needed for website hosting, security, database operations, communications, and technical support. Cloudflare provides website delivery, Pages Functions, D1 database services, and Turnstile security. We do not sell personal data or disclose it to third parties for their independent marketing.

8. International processing

Some technology providers may process or route technical data outside Saudi Arabia as part of global service delivery. Any cross-border transfer or disclosure is handled only where factually necessary and in accordance with the Saudi Personal Data Protection Law, its implementing regulations, and applicable transfer requirements. We do not claim that all processing occurs in a particular country.

9. Retention and destruction

We retain personal data only while it is reasonably needed for the purposes described, to manage an active expression of interest, to meet legal requirements, or to resolve disputes. Retention is reviewed according to purpose, data type, relationship status, security needs, and applicable law. When no valid need remains, data is securely destroyed or anonymized as appropriate. Anti-abuse deduplication records expire after 24 hours; rate-limit records are routinely removed after their operational window.

10. Your rights

Subject to the Saudi Personal Data Protection Law and its regulations, you may have rights to be informed, access your personal data, obtain a copy in a clear format, request correction or completion, request destruction when applicable, and withdraw consent where processing relies on consent. We may need to verify identity and may apply lawful limitations.

Send a request to hello@meridianglow.sa with the subject “Privacy Request”.

11. Security

We use proportionate administrative and technical safeguards, including encrypted transport, restrictive security headers, server-side validation, Turnstile, access controls, deduplication, rate limiting, and logging designed to avoid raw form payloads and contact details. No method of transmission or storage can be guaranteed completely secure.

12. Cookies and essential technologies

The website uses technologies necessary to deliver and protect the service. Cloudflare and Turnstile may set or read essential security data to distinguish legitimate requests from abuse. We do not currently use advertising cookies on this landing website. Browser controls may affect optional technologies, but disabling essential security features can prevent form submission.

13. Children and guardians

This pre-launch website and its interest forms are intended for adults aged 18 or over. A minor should not submit a form independently. If information about a minor must be provided for a lawful purpose, it must be submitted by or with the verified consent of the minor’s guardian as required by applicable law. Contact us if you believe a minor submitted data without proper authorization.

14. Complaints

Please contact us first so we can review your concern. You may also exercise any right to complain to the competent Saudi data-protection authority through its official channels, subject to applicable procedures.

15. Policy changes and language

We may update this policy when the website, processing practices, or applicable requirements change. The effective date and version identify the current policy. Arabic and English versions are intended to be consistent; if an interpretation difference arises, the Arabic version prevails to the extent permitted by applicable law.

16. Contact

Meridian Glow Company, Riyadh, Saudi Arabia
Privacy requests: hello@meridianglow.sa
Partnership inquiries: partnerships@meridianglow.sa