1. Who we are
MEER — Mirrors for Earth’s Energy Rebalancing (“MEER”, “we”, “us”, “our”) is an independent nonprofit scientific initiative. We are the data controller for personal information collected through meer.org.
For any question about this policy or how we handle your data, contact info@meer.org.
2. What personal information we collect
We collect only what we need to run the website, respond to enquiries, and support our research programme:
- Contact details you give us — name, email, message content, and (optionally) organisation.
- Newsletter details — name and email address.
- Portal account details — email, name, hashed password, and approval status for approved members.
- Donation confirmations — donations are processed by PayPal on their own site; we receive a transaction confirmation (donor name and amount) but never your card details.
- Technical data — IP address, user-agent, timestamp, requested URL, and referrer, held briefly in server logs for security and diagnostics. IP addresses in our own form submissions are stored only as a salted hash.
We do not run Google Analytics, advertising pixels, session-replay tools, or third-party marketing trackers on this site.
3. Why we collect it and our lawful basis
Under the UK GDPR we must have a lawful basis for every use of your personal information. Ours are:
| Activity | Purpose | Lawful basis |
|---|---|---|
| Newsletter sign-up | Send you research updates | Consent — Art. 6(1)(a) |
| Contact form / email | Reply to your enquiry | Legitimate interest — Art. 6(1)(f) |
| Members portal account | Operate a private members area | Legitimate interest — Art. 6(1)(f) |
| Donation processing | Acknowledge and account for gifts | Legitimate interest / legal obligation |
| Server logs & bot protection | Keep the site secure and available | Legitimate interest — Art. 6(1)(f) |
Where we rely on consent (the newsletter), you can withdraw it at any time — every mailing includes an unsubscribe link, or you can email info@meer.org.
4. Contact form submissions
When you use the form on our Contact page we collect your name, email, optional subject and organisation, and the content of your message. We use this only to reply and to keep a record of the correspondence.
To protect the form from automated abuse we run a Cloudflare Turnstile challenge and a hidden honeypot field. We also record a salted hash of your IP address (not the IP itself) with the submission for rate-limiting and security review.
5. Newsletter subscriptions
If you subscribe to the MEER Research Dispatch we store your name and email so we can send it. We do not share this list with third parties and we do not use it for advertising.
You can unsubscribe at any time using the link in any mailing, or by emailing info@meer.org. On unsubscribe we suppress your email so we do not re-add it in the future.
6. Donation processing
Donations are processed by PayPal (including PayPal’s guest checkout for card payments). When you click a Donate button you are handed off to PayPal’s own hosted checkout — we never see and never store your card number, CVC, or bank details.
PayPal shares back with us the confirmation and amount so we can record the gift for accounting and, where you have given us your email, thank you. PayPal’s handling of your data is governed by their own privacy statement.
If you make a Gift Aid declaration or ask for a donation receipt, we retain the necessary records for six years to meet HMRC requirements.
7. Email communications
We may reply to your enquiries from info@meer.org or press@meer.org. Emails are stored on our mail provider’s servers, protected by strong access controls, and retained for as long as is useful for the enquiry (see §9).
We do not send marketing emails other than the newsletter you opted in to. We do not use tracking pixels in our transactional emails.
8. Members portal accounts
If you request a MEER portal account we collect your email, name, and a password (stored only as a one-way hash by our authentication provider). New accounts are held in a pending state and must be approved by an administrator before they become active.
You can delete your account at any time by emailing info@meer.org.
9. How long we keep your data
| Data | Retention |
|---|---|
| Newsletter subscription | Until you unsubscribe (then suppressed indefinitely to avoid re-adding you) |
| Contact form / email enquiry | Up to 24 months after our last exchange |
| Members portal account | For the life of the account; deleted on request |
| Donation records (accounting) | 6 years (HMRC requirement) |
| Server request logs | Typically 30 days |
| Salted IP hashes on form submissions | Up to 90 days for abuse review |
10. Data security
The site is served exclusively over HTTPS with modern security headers (HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a Content Security Policy). Traffic passes through Cloudflare for DDoS mitigation and bot protection.
Portal passwords are hashed by our authentication provider — we never see plaintext passwords. Form submissions are protected by Cloudflare Turnstile and rate-limiting. Access to the database is scoped by row-level security rules so users can only see their own data unless they hold an administrator role.
No online service is 100% secure. If you believe your account has been compromised, please email info@meer.org immediately.
11. Third-party services we rely on
| Provider | Role | Data touched |
|---|---|---|
| Cloudflare | CDN, DDoS mitigation, bot protection, Turnstile | IP, request metadata |
| Lovable Cloud (Supabase) | Application hosting, database, authentication | Account details, form data |
| Sanity.io | Content delivery (articles, images, videos) | None from you |
| YouTube (privacy-enhanced mode) | Video embeds via youtube-nocookie.com | Only on play |
| Vimeo | Featured documentary hosting | Only on play |
| PayPal | Donation processing | Payment details (held by PayPal) |
12. International transfers
Some of the providers above process data outside the UK and EEA (for example in the United States). Where they do, transfers rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an equivalent lawful safeguard published by each provider.
13. Cookies
A full breakdown of the cookies and similar technologies used on meer.org is in our Cookie Policy. In summary: we set essential cookies for security, and functional cookies only for signed-in members; third-party cookies from YouTube, Vimeo, and PayPal are set only when you interact with those services.
14. Children
This site is not directed at children under 13 and we do not knowingly collect their personal information. If you believe we hold information about a child, please contact us and we will delete it.
15. Your rights under UK GDPR
You have the right to:
- Access — a copy of the personal information we hold about you.
- Rectification — have inaccurate information corrected.
- Erasure — have your information deleted (“right to be forgotten”).
- Restriction — ask us to limit how we use your information.
- Objection — object to processing based on legitimate interest.
- Portability — receive your data in a portable format where technically feasible.
- Withdraw consent — where processing is based on consent (e.g. the newsletter).
- Complain — to the UK Information Commissioner’s Office (see §17).
16. How to request access, correction or deletion
Email info@meer.org from the address associated with your data. We may ask a small number of verification questions to confirm your identity. We aim to respond within one calendar month, and always within the statutory deadline.
There is normally no charge for these requests unless they are manifestly unfounded or excessive.
17. Complaints to the ICO
If you are not satisfied with our response you have the right to complain to the UK Information Commissioner’s Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you are based in the EEA, you may also complain to your national supervisory authority.
18. Changes to this policy
We will update the “Last updated” date at the top of this page when we make changes. If a change is material — for example if we introduce a new analytics tool or a new type of data collection — we will announce it in the newsletter and, where required, ask for renewed consent.
19. Contact us
General privacy questions: info@meer.org
Press: press@meer.org
You can also use our contact form.