Privacy Policy

Meshanics ("Meshanics", "we", "us") builds zero-trust over-the-air update and fleet-management infrastructure for industrial and edge-AI devices. This Privacy Policy explains what personal data we collect, why, how we handle it, and the rights you have. It covers our public websites (meshanics.com and docs.meshanics.com), our operator console (panel.meshanics.com), and our APIs.

A principle runs through everything below, and it is built into the product, not bolted on: we handle metadata, never the contents of your artifacts or the data your devices process. We do not collect, store, or transmit the payloads you ship to your fleet.

Who we are

Meshanics operates this platform and is the data controller for the personal data described in this policy, except where we act as a processor on behalf of a customer (see "Customer data and our role"). For any privacy question, or to exercise your rights, contact us at hello@meshanics.com.

Information we collect

Account and contact data. When you create an account or contact us, we collect your name, work email, company name, and the password you set (stored only as an argon2id hash, never in plain text).

Billing data. For paid plans we collect billing-profile details such as company legal name, billing address, and tax identifiers. We invoice manually; we do not store full payment-card numbers.

Device and fleet metadata. To run the service we process operational metadata about your devices: device identifiers, hardware profile (SoC, architecture, accelerators), agent version, update and rollback status, health-probe results, and the append-only audit events that record fleet activity. We do not collect the contents of the containers, models, or configs you deliver, nor the data your devices capture or process.

Usage and technical data. When you use the console or APIs we record technical logs such as IP address, browser and device type, timestamps, and the actions taken, for security, debugging, and abuse prevention.

Marketing-analytics data (public sites only). On meshanics.com and docs.meshanics.com we use privacy-conscious web analytics to understand how the sites are used. Analytics run only with your consent and never on the operator console. See "Cookies and analytics" below.

Information you send us. Support tickets, emails, and any content you choose to share with us.

How we use your data

We use personal data to:

• provide, operate, secure, and maintain the platform;
• authenticate you and protect accounts and fleets from abuse;
• process invoices and manage paid plans;
• respond to support requests and communicate about the service;
• meet legal, regulatory, and compliance obligations;
• improve the product and, with your consent, measure marketing.

Legal bases (GDPR)

Where the EU/UK General Data Protection Regulation applies, we rely on: the performance of our contract with you (providing the service); our legitimate interests (securing the platform, preventing abuse, and improving the product), balanced against your rights; your consent (marketing analytics and non-essential cookies); and compliance with legal obligations.

Cookies and analytics

The operator console uses a single strictly necessary cookie: an httpOnly session cookie that keeps you signed in. We do not use it for tracking, and the console loads no third-party scripts.

Our public marketing sites use Google Analytics 4 with Google Consent Mode v2. Analytics and any non-essential cookies stay disabled until you opt in through the cookie banner, and you can change your choice at any time using the "Manage cookies" link in the site footer. If you decline, no analytics cookies are set and no analytics data is sent.

Customer data and our role

For your account and billing details, Meshanics is the data controller. For the device and fleet metadata we process on your behalf to deliver updates, Meshanics acts as a data processor and you are the controller; that processing is governed by our Data Processing Agreement, available to customers on request at hello@meshanics.com.

Sharing and subprocessors

We do not sell personal data. We share data only with service providers who process it on our behalf under contract, and only as needed to run the platform:

• Cloud hosting - infrastructure that runs the managed service. (Self-hosted and air-gapped deployments keep all data within your own environment.)
• Google Analytics - marketing-site analytics, consent-gated, public sites only.
• Resend - delivery of transactional and notification emails.

We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety, and security of our users and the public. A current list of subprocessors is available to customers on request.

International transfers

Where personal data is transferred outside your region, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Customers who require data residency can run Meshanics on-premises or air-gapped, in which case data stays within their own infrastructure.

Data retention

We keep personal data for as long as your account is active and as needed to provide the service, then for the period required to meet legal, tax, and compliance obligations or to resolve disputes. Audit and update-history records are retained to support compliance reporting (for example, EU CRA evidence) for the periods those frameworks require. When data is no longer needed, we delete or anonymize it.

Security

We are part of our customers' supply chain and treat it accordingly. Measures include mutual TLS between services and devices, per-device cryptographic identities, signed and verified update metadata, encryption of secrets at rest, argon2id password hashing, scoped API keys, and a hash-chained, tamper-evident audit log. No system is perfectly secure, but security is the core of what we build. For details see meshanics.com/security.

Your rights

Subject to applicable law, you may request to access, correct, delete, restrict, or port your personal data, and object to certain processing. Where we rely on consent, you may withdraw it at any time without affecting prior processing. To exercise any right, email hello@meshanics.com; we will respond within the time the law requires. You also have the right to lodge a complaint with your local data-protection supervisory authority.

Children

The platform is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

We may update this policy as the service evolves or the law changes. We will post the revised version here and update the effective date above; material changes will be communicated through the service or by email.

Contact

Questions, requests, or concerns about this policy or your data: email hello@meshanics.com.