通知の当日朝、Meridian の「design partner 40%引き」に付いた学習用データ条項を外し、11:00 UTC までに書面の確認を取る

Thanks for making time, Marcus, Lena. Let me be upfront about our timing, because it shapes what I can say yes to today. We want Meridian for the validation layer — that hasn't changed. What has changed is the clock: if a sub-processor notice goes to our customers, it goes today, and it will describe what Meridian does with our telemetry. So everything we agree this morning has to fit one sentence: Meridian processes our telemetry solely to provide the probe service. By 11:00 UTC I need three things in writing — that limitation, a date for the signed amendment, and a notice period on your own sub-processors that we can live with. What I'm not here to do is negotiate price first. I have a budget, and I'll tell you where it is when we get there.

I appreciate that, and two of those three I can work with. The roadmap session is easy — my team would ask for it anyway. The logo isn't mine to give; that's our CEO's call, and I won't promise it on a call. The third one is where we stop. Training your models on our telemetry, de-identified or not, is Meridian using our customers' data for Meridian's purposes. That's a different relationship from the one we may be describing to forty-one customers today. So if the paper genuinely can't be carved, then the design partner paper isn't the right paper for us — and I'd much rather find that out at 9:40 than at 11:59.

Those are two separate questions, so let me take them in order. On the second: I won't characterize our counsel's advice — to you or to anyone. What I can tell you is what any notice from us would say, because that's a fact, not advice. On the first: you may well be right under GDPR, and I'm not going to argue anonymization with a privacy lawyer. It still doesn't get us there. Our customer contracts limit use of Customer Data to providing the services — not just personal data. And the error samples in that feed carry end-user IP addresses until we build the stripping, which we haven't. Whether stripped data is anonymous is a debate. I need a sentence that doesn't need a debate.

Understood on both, and I'm not asking for a redline today. I'm asking for an email by 11:00 UTC from someone who can bind Meridian — you'd do — confirming three things: the purpose limitation, no training on our telemetry in any form, and a signed amendment within your five business days, so by Friday, October 23. Here's what makes that safe for you: the October 23 test is synthetic traffic only, and production telemetry stays switched off on our side until both signatures are on the page. You won't be holding anything you haven't papered.

Twenty-five works — I won't spend this call chasing the other fifteen points. And thank you for the email; that's the piece that matters this morning. The thirty days I do need to move, and here's why it's arithmetic, not haggling. We owe our customers thirty days' notice of any new sub-processor, including yours. If you give us thirty, we have zero days to assess a change and draft the notice — so any change you make would put us in breach by default. Forty-five gives us fifteen days to do our job. If forty-five is genuinely impossible, the fallback is thirty plus our right to stop sending telemetry, without fees, if one of our customers objects. I'd rather have the forty-five.

Let me read back what I have — stop me if any word is wrong. One: by 11:00 UTC today, Marcus emails confirming that Meridian processes our telemetry solely to provide the probe service, and won't use it to train or improve its products in any form, de-identified included. Two: a signed amendment by Friday, October 23, and no production telemetry before then. Three: twenty-five percent off list for two years, plus a quarterly roadmap session. Four — still open: forty-five days' notice on your sub-processors, or the fallback. Lena, could I have your answer by Tuesday, October 20? Five: the logo is open; I'll raise it with our CEO after we're live, with no promise. I'll send this recap within thirty minutes.