Privacy

Last updated 5 October 2026

Who we are

Meruit AI (“we”, “us”) operates this website and is based in the United Kingdom. We are the data controller for the personal data described in this policy, except where we act as a processor for client engagement data (see Client data below).

For any question about this policy, or about data we hold, use the enquiry form and say what it concerns. It reaches us directly, and we will reply to the address you give.

What this policy covers

This policy covers personal data we collect through this website and in the course of discussing or delivering an engagement. It does not form part of any contract, and where it conflicts with signed engagement terms, those terms take precedence.

Information we collect

Enquiries

If you complete the enquiry form, we collect your name, work email address, company, role (optional), an approximate annual third-party spend band, and whatever you tell us in the free-text field. We ask you not to send spend data, contract documents or other commercially sensitive material through the form.

Correspondence

If you email or call us, we keep a record of that correspondence and of any meeting notes necessary to respond to you.

Website usage

This website sets no cookies and runs no analytics or tracking. It is a set of static pages. Our hosting provider keeps standard server logs, which may include IP addresses, for security and operational purposes.

Client data

During an engagement we process accounts payable records, ERP spend data and contract documents belonging to our client. This is commercial information rather than personal data, but it can contain personal data incidentally — the name of a signatory or a supplier contact, for example. In relation to that material we act as a processor on the client’s instructions, under the engagement terms and a signed non-disclosure agreement. We ask clients not to send employee records, customer data or other material that is primarily personal data.

Why we use it, and on what basis

• To respond to your enquiry and assess whether a Discovery is worth running. Our lawful basis is your consent, given when you tick the box on the enquiry form, and our legitimate interest in responding to approaches from prospective clients.
• To negotiate and deliver an engagement. Our lawful basis is the performance of a contract with you, or steps taken at your request before entering one.
• To meet legal and regulatory obligations, including accounting and tax record keeping.

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not profile you.

Marketing

We do not operate a marketing list. Completing the enquiry form does not subscribe you to anything. If we ever introduce a mailing list, it will be opt-in and separate from this.

Who we share it with

We do not sell personal data, and we do not share it for anyone else’s marketing. We share it only with:

• Our form handler. The enquiry form is processed by a third-party form service, which receives the contents of the form and forwards it to us by email. [CONFIRM the provider and whether its servers are outside the UK — if so, this is an international transfer and the section below applies.]
• Our email, document and hosting providers, acting as processors on our instructions.
• Professional advisers and authorities where we are required to by law.

Where your data is held

Client engagement data — spend ledgers and contract documents — is hosted securely in the United Kingdom. It is not transferred outside the UK without the client’s written agreement.

Some of the general business services we use, such as the website form handler, may process limited data outside the UK. Where that happens we rely on appropriate safeguards recognised under UK data protection law, such as the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Enquiries that do not become engagements: kept while we are in contact and for a reasonable period afterwards, then deleted.
• Client engagement data: returned or destroyed when the engagement closes, or earlier on request, with written confirmation. Specific periods are set out in the engagement terms.
• Records we must keep by law, such as accounting records: retained for the period the law requires.

How we protect it

Access to client data is limited to the named engagement team identified in the engagement letter. It is not shared with a general pool of consultants, and it is not subcontracted without the client’s written agreement. We work under a signed non-disclosure agreement that is in place before any data moves.

Your rights

Under UK data protection law you have the right to ask us to give you a copy of your personal data; to correct it if it is wrong; to delete it; to restrict how we use it; to object to our using it on the basis of legitimate interests; and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time — that does not affect anything we did before you withdrew it.

To exercise any of these, use the enquiry form, saying which right you are exercising and giving an address we can reply to. We will respond within one month. There is no charge unless a request is clearly unfounded or excessive.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If we make a material change, we will say so clearly on this page.