Privacy Policy

• When you request a quote: your name, email address, the brief you write, and the configuration you selected.
• During a project: messages, revision notes, and any files you upload as reference or concept material.
• When you buy a catalog asset: the checkout email and name supplied by Stripe, any business name, the purchased product, selected price tier, and package version, payment identifiers and status, the accepted legal version, and download dates/count. Stripe retains billing addresses and tax IDs; MESHCORP does not copy those values into its catalog-order database.
• When you request a free catalog asset: your email, the product and frozen package version, accepted license version, whether the delivery email was sent, and download dates/count.
• When you submit a managed Dreadnought project: your name, email, project name, one or more private source uploads, each asset description, requested output and triangle target, rights and service-term acceptances, automatic safety and technical-analysis status, derived mesh and texture counts, warnings, eligibility result, itemized price, payment and refund/dispute state, production and QA events, and delivery/download record.
• When you use the Asset Library: a normalized email identity, email-verification date, hashed one-time login tokens, and hashed, revocable browser sessions with creation, expiry, and recent-use dates.
• When you request marketing updates: your email, signup source, the consent wording and version shown, confirmation status and date, and any later unsubscribe date. A pending or unsubscribed address is not eligible for marketing.
• Automatically: a salted, one-way hash of your IP address, used only to rate-limit quote, free-delivery, and email signup forms against abuse.
• On public website pages: Vercel Web Analytics records anonymous page views, referrers, broad location, device, browser, and a small set of named actions such as opening the build form, viewing a catalog product, visiting Fab, or successfully submitting a quote request.

We never store your raw IP address. The hash is one-way — it can check whether two submissions came from the same place, and nothing else.

• No advertising or marketing trackers, cross-site tracking, session replay, or behavioral profiles.
• No names, email addresses, work-order numbers, uploaded-file information, or private project links are sent to website analytics.
• No tracking in our emails — no open tracking, no click tracking, no remote images.
• No payment card details. Stripe hosts checkout and processes the payment; card data never touches this site.
• No profiling and no automated decisions with legal or similarly significant effects.

The site uses essential session cookies only: one when a member of our team signs in to the internal operations area, and one after a customer verifies access to the Asset Library. The customer cookie is HTTP-only, expires after 90 days, and can be revoked without deleting purchases.

Vercel Web Analytics does not use cookies. Because we set no analytics or advertising cookies, there is no analytics consent banner to click through.

Reference images, concept art, and video you send are stored in a private bucket. They are not publicly accessible: every view is authorised by our servers first, and the links our pages generate expire within minutes.

Managed Dreadnought source files are used only to run file-safety and technical checks, calculate the requested service scope and price, and perform the requested processing service. They are not published, used to market MESHCORP, or added to a training dataset. The customer receives the processed output, not MESHCORP's private tools, credentials, or internal processing files.

We process your information to perform the contract you asked for (quoting and building your commission or delivering a catalog purchase), and — for the rate-limit hash and our internal records — because we have a legitimate interest in keeping the service working and defensible. We send marketing only after your specific consent, which you may withdraw at any time without affecting a purchase, quote, download, or support. We use anonymous public-site measurements under our legitimate interest in understanding whether the site works and which services visitors find useful.

We use a small number of service providers, each holding only what their function requires:

• Vercel — hosting and delivery of this site, plus anonymous, cookie-free Web Analytics for public pages.
• Supabase — the database holding quotes, projects, catalog orders, free-delivery claims, subscriber preferences, entitlements, and messages.
• Cloudflare R2 — storage for uploads, proofs, and delivered files.
• Resend — sending transactional delivery email, signup confirmations, and any future marketing email you confirmed.
• Stripe — hosted checkout, payment, tax and business identity fields, receipts, refunds, and disputes.
• Google Workspace — our own email inboxes.

These providers are based in the United States, so your information is processed there. We do not sell your information, share it for advertising, or hand it to anyone outside this list — except where the law requires it.

• Quote requests that never become projects: up to 12 months, then deleted.
• Project records — scope, approvals, and the event history: seven years, because they are the record of what was agreed and paid for.
• Catalog order and entitlement records: seven years as the purchase, license, payment, refund, and download record.
• Free catalog delivery records: up to three years after the latest request or download, so the private release can be recovered and abuse can be investigated.
• Asset Library login tokens: short-lived and single-use; expired token records and browser-session records may be retained for up to one year as security evidence. Browser sessions expire after 90 days unless revoked sooner.
• Confirmed marketing subscriptions: until you unsubscribe. Pending confirmations may be removed after 30 days; unsubscribed addresses are retained on a minimal suppression list so they are not accidentally re-added.
• Uploaded reference material: for the life of the project, then on request at any time.
• Managed Dreadnought source files: scheduled for removal 30 days after delivery; an intake we decline may be removed sooner. The commercial scope, acceptance, payment, QA, and audit record may be kept for seven years.
• Managed Dreadnought delivery ZIPs: scheduled for removal 90 days after delivery. Download and keep your own backup.
• Delivered asset packs: at least 90 days after delivery.
• Anonymous website analytics: available to us for up to 12 months and never joined to quote or customer records.

Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send you a copy. If you are in the EU or UK you also have the right to object to processing, restrict it, and complain to your data protection authority. If you are in California, you have the right to know and delete — and note that we do not sell or share personal information, so there is nothing to opt out of.

Every marketing email provides an unsubscribe route. Unsubscribing stops marketing without stopping operational messages needed for a quote, purchase, support request, or file delivery.

Email us and we'll action it within 30 days. We may keep the minimum needed for tax and legal records even after a deletion request, and we'll tell you exactly what that is.

Traffic is encrypted in transit. Uploaded files sit in a private bucket behind authorisation checks. Catalog assets require a verified customer session and every R2 file URL expires within minutes. Custom project pages are still reached through an unguessable private link — treat that project link like a password, and tell us if it gets out so we can replace it.

This service is for adults. We don't knowingly collect information from anyone under 18; if we learn we have, we delete it.

Meshcorp LLC is responsible for the personal information described in this policy. If the policy changes materially we will say so here and update the date at the top. Questions, requests, or complaints: email us.