© 2026 Medoya LLC
Powered by voilamia
Subscribe to receive new insights
Legal
Effective September 21, 2026
Medoya LLC ("Medoya", "we", "us") is an AI security consultancy based in Doylestown, Pennsylvania. This policy explains what personal information we collect through medoya.com, how we use it, who we share it with, and the choices and rights you have. Client engagements are governed by their own written agreements, which take precedence over this policy where they differ.
We collect what you choose to give us, plus a small amount of technical data needed to run the site:
Please do not send us protected health information (PHI), patient data, passwords or other sensitive information through our forms or by email. This website is not designed to receive it. When a client engagement involves regulated data, we handle that data under a separate written agreement, such as a business associate agreement where HIPAA applies.
Medoya.com is intended for business professionals and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us and we will delete it.
When you book a call, you do so on Calendly, which opens in a new tab. Calendly collects the details you enter, such as your name, email address and any answers you give, and shares them with us so we can hold the meeting. Calendly's own privacy policy governs how it handles that information. The call itself takes place on the video platform named in your invitation, whose privacy policy applies to the session.
We use your information to:
We do not sell your personal information, we do not share it for targeted advertising, and we do not use it to train AI models. We do not make automated decisions about you that have legal or similarly significant effects.
We send our newsletter only to people who subscribed. Every issue includes an unsubscribe link, and unsubscribing takes effect right away. We do not track whether you open our emails or click the links in them.
We keep cookies to a minimum. We do not use advertising cookies, cross-site tracking cookies or third-party analytics cookies.
If we ever add optional analytics or marketing tools, they will load only after you allow them in the cookie banner. We honour Global Privacy Control: if your browser sends a GPC signal, we record it as a refusal of all optional cookies. You can also block cookies in your browser settings; the site will keep working.
We look at how the site is used in aggregate, such as page views, countries, browser types and referring sites. These statistics come from Cloudflare, which delivers our site, and we only ever see them as totals. We do not use Google Analytics, advertising pixels or session recording.
When a page fails to load or a feature breaks, our error monitoring service (Sentry) receives a technical report so we can fix it. These reports can include your IP address, browser details and the page you were on.
We do not sell, rent or trade your personal information. We share it only with the service providers that help us run the site and our business, and only as far as each one needs:
We may also disclose information when the law requires it, for example in response to a valid court order, or when necessary to protect the rights, property or safety of Medoya, our clients or others. If Medoya is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction, and this policy will continue to apply to it.
Medoya is based in the United States. Our website and main database are hosted in Canada (Toronto), and some of the providers listed above process data in the United States. If you visit from another country, your information will be transferred to and processed in Canada and the United States. Where the law requires it, for example for visitors from the European Economic Area or the United Kingdom, we rely on our providers' data protection terms, which include recognised transfer safeguards such as the EU Standard Contractual Clauses.
As an AI security consultancy, we hold our own website to the standard we recommend to our clients:
No method of transmission or storage is completely secure. If a security incident affects your personal information, we will notify you and the relevant authorities as required by applicable law.
We keep personal information only as long as we need it for the purpose it was collected for, then delete or anonymize it:
Wherever you live, you can ask us to:
Depending on where you live, you may have further rights under local law, such as the GDPR in the European Economic Area and the United Kingdom, or the privacy laws of California and other US states. If you are in the EEA or the UK, you may also object to processing based on our legitimate interests and lodge a complaint with your local data protection authority.
To make a request, email us at eric@medoya.com. We will respond within 30 days and may need to confirm your identity first. We will not treat you differently for exercising your rights.
Where the GDPR applies, we rely on the following legal bases:
Our site links to other websites, such as LinkedIn, Calendly and the sources cited in our articles. We are not responsible for their privacy practices, and we encourage you to read their policies.
We may update this policy as our website or practices change. The effective date at the top of this policy shows when it last changed. If we make a material change, we will say so on this page and, where appropriate, tell our subscribers by email.
For any question about this policy, or to exercise your rights, email eric@medoya.com. Eric St-Pierre, Principal AI Security Architect, is responsible for privacy at Medoya.
Medoya LLC, Doylestown, Pennsylvania, USA