PRIVACY POLICY

01 Who We Are & Scope of This Policy

This Privacy Policy describes how Mesh Labs Cloud, Inc., a Delaware corporation having its mailing address at 2810 North Church Street, Wilmington, Delaware 19802, United States ("Mesh", "we", "us" or "our"), processes personal data in connection with MESH and any related websites, applications (including the MESH desktop application, the MESH mobile application, and the MESH IDE extensions for Visual Studio Code, Cursor, Antigravity and compatible editors), SDKs, browser-based grid nodes, control plane and APIs (collectively, the "Service").

For purposes of the EU and UK General Data Protection Regulations ("GDPR"), the Israeli Privacy Protection Law, 5741-1981 and its regulations ("PPL"), the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA") and similar laws, Mesh is the controller (or "business") of personal data we collect directly from you and technical telemetry generated by your use of the Service. Where the Service is embedded or administered by a third-party customer, Mesh may act as a processor (or "service provider") on that customer's behalf, as described in the applicable customer agreement or data processing addendum.

In this Policy, "personal data" includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual, as defined by applicable law.

You are generally not legally required to provide personal data to us, and providing it is voluntary. However, without information required for an account, device connection, payment, security or a requested feature, we may be unable to provide some or all of the Service.

This Policy supplements, and is incorporated into, our Terms & Conditions. Capitalized terms not defined here have the meanings given in those Terms.

02 Plain-Language Summary

• We collect account data (e.g., email), technical telemetry (e.g., IP, peer ID, GPU/backend capabilities, performance metrics), usage data (jobs you submit, models you use, contributions you make as a Provider) and, where you choose, payment data (handled by our payment processor).
• We use that data to operate the Service, match jobs to nodes, calculate Compute Units (CU), validate results, prevent fraud and abuse, comply with law, and improve the Service.
• The Service is decentralized: your inputs and intermediate results may be processed on third-party browser nodes that we do not control. You should treat any data you submit as visible to such nodes for the duration of the job.
• Personal AI conversations live on your devices by default. For multi-device access, if and when that feature is enabled, we may transmit them directly between your signed-in devices, relay them transiently through our servers without retaining them, or offer an opt-in service to store them on our servers so they follow your account across devices.
• If you enable Agentic Features, the desktop application may access resources you authorize and act through connected accounts, including changing or deleting files, executing commands, publishing or uploading content, sending messages or emails, and invoking third-party tools. Data is sent to a third party when the requested action requires interacting with that party.
• Global-network jobs may be processed by unrelated Provider nodes. Organization Cluster jobs are scheduled to participating devices in the applicable cluster, which may include devices operated by invited members or suppliers, while Mesh-controlled cloud infrastructure may still process metadata, inputs and outputs.
• We do not sell your personal data. We share data only with the sub-processors and partners listed below, with peer nodes assigned to your jobs, and where required by law.
• We are based in the United States. The Service connects users and Provider nodes globally, and your data may be processed in countries other than your own. Where required, we use contractual and other safeguards for international transfers.
• You have rights of access, rectification, erasure, restriction, portability and objection, subject to applicable law. See §13.

03 Categories of Personal Data We Process

04 Where the Data Comes From

We obtain personal data from the following sources:

• Directly from you, when you create an account, configure a node, submit a job, contact us or make a payment;
• Automatically, when your browser, desktop or mobile app, IDE extension, SDK client or node connects to the control plane, executes shards, exchanges signaling messages or completes jobs;
• From peer nodes, in the form of trustless validation reports, divergence measurements and reputation feedback;
• From third parties, including identity providers if you sign in using SSO, payment processors, anti-fraud and anti-abuse vendors, public IP-reputation feeds and, when you enable Agentic Features, websites, APIs, MCP servers, skills and connected account providers with which the agent interacts.
• From your device and your instructions, when you grant access to files, folders, commands, applications or browser sessions, configure permissions or schedules, approve an Agent Action, or ask an agent to interact with local or connected resources.

05 Purposes & Legal Bases for Processing

06 Peer-to-Peer Data Flows (Important)

Mesh does not control Provider devices. The Service is designed with the architectural assumption that nodes are untrusted, and we apply trustless validation, quorum acceptance and reputation-aware scheduling to mitigate that risk. Despite these measures, network execution is not appropriate for regulated or confidential content unless an applicable agreement and Service configuration expressly permit it. See the Acceptable Use and Requester-Specific Terms in our Terms & Conditions. Available controls may include:

• anonymizing or pseudonymizing inputs before submission; and
• using a local-only or other approved execution mode rather than the peer network when working with sensitive content.

Presigned artifact URLs are bearer capabilities rather than session-bound links. Possession of the complete URL may permit access without a further Mesh authentication check until the signature expires. Do not publish or forward such URLs, and treat them as confidential while valid.

07 Cookies & Local Device Storage

We use a small number of strictly necessary technologies on your device to make the Service work. These include:

• localStorage / sessionStorage for theme preferences, role (Requester / Provider), session JWTs, and node identifiers;
• Origin Private File System (OPFS) for caching downloaded model shards, auxiliary assets and integrity hashes (this can range from megabytes to many gigabytes depending on the models you load and remains under your browser's control; you may clear it via your browser's site settings);
• IndexedDB / Cache Storage for offline assets and the Service's service-worker (where used);
• Cookies, where used, are limited to authentication, security (e.g., CSRF tokens) and load balancing. We do not use cookies for cross-site advertising.
• Desktop application storage. Where you install the desktop application, equivalent data — model files, cache manifests, configuration, node identifiers and Personal AI conversation history — is stored in the application's data directory on your file system rather than in browser storage. This cache can likewise reach many gigabytes. You can remove it at any time using the clear-cache and conversation-deletion controls in the application or by uninstalling the application.
• Shared devices. Personal AI conversation history is kept separately for each signed-in user of the desktop application. Other users of the same device cannot open your conversations through the application's interface — they can see that data belonging to your account exists on the device and can delete it, but not read it in the app. However, locally stored conversation files are protected only by your operating system's file permissions and are not encrypted per user: anyone with file-system or administrator access to the device may be able to read them directly. Do not use Personal AI for sensitive conversations on a device you share with people you do not trust, and prefer separate operating-system user accounts on shared machines.
• IDE extension storage. Where you install a MESH IDE extension, model weights (which can reach several gigabytes) and a managed runtime environment used for local inference are stored in your editor's extension storage directory. You can remove downloaded models from the extension's dashboard or delete everything by uninstalling the extension.

Where applicable law requires consent for non-essential cookies or analytics, we will request and record that consent in-product before activating the applicable technology. You can withdraw consent and clear local data at any time through your browser settings or available in-product controls.

08 Agentic Features Data Flows

Agent processing may occur locally on your device, but enabling a website, connected account, API, cloud model, MCP server, skill or other network tool may transmit selected prompts, files, page content, command output, tool inputs, communications or other data to that third party. Information intentionally published, uploaded or sent by an Agent Action becomes available to the selected public audience, platform, account or recipient and may be copied or retained by them. Mesh cannot delete or retrieve copies held by those recipients.

The application may store agent transcripts, action and approval history, granted folders, capability settings, installed MCP servers and skills, schedules and a dedicated browser profile locally under your signed-in account profile. AI model files may be shared across accounts on the same device. Application-level separation does not prevent a person with operating-system or administrator access from accessing unencrypted local files or browser-profile data.

A dedicated in-app browser may retain cookies and authenticated sessions so connected sites remain signed in. Sensitive credentials entered during a human-takeover flow are intended to remain between you, the browser and the relevant site rather than being provided to the AI model. Access tokens and browser sessions are nevertheless sensitive data. You should grant the narrowest available permissions, review requested actions, disconnect integrations you no longer use and use available controls to stop Agent Actions and revoke grants.

Permission and action records are processed to enforce your choices, display an action history, investigate failures and abuse, and provide security and support. If an action is approved from a paired device, we may also process the approving device, time and decision as part of that record.

09 Disclosure to Third Parties & Sub-processors

We share personal data only as needed to run the Service, with the following categories of recipients:

• Other MESH users (peer nodes). As described in §06, your job content, tensors and peer/network metadata may flow to peer nodes assigned to your jobs.
• Cloud infrastructure and hosting providers (e.g., AWS), used to host the control plane, the relational database (PostgreSQL), the ephemeral state store (Redis), object storage (S3-compatible), CDN/CloudFront, and the marketing site.
• Signaling and connectivity providers, including PeerJS-style signaling servers and STUN/TURN servers used to establish WebRTC connections.
• Security and abuse-prevention vendors for IP reputation, bot detection and DDoS mitigation.
• Payment and payout providers, including Stripe and, where supported, stablecoin or banking providers, who handle payment instruments, identity verification, KYC, sanctions checks, transfers and payouts under their own terms and privacy notices.
• Analytics, error-monitoring and observability tools (for example, error-tracking and metrics services), configured wherever feasible to minimize personal data and to scrub or hash identifiers.
• Connected websites, account and API providers. When you enable an Agentic Feature to interact with a third-party service, that service receives the information and Agent Actions necessary to perform your instruction under its own terms and privacy notice.
• MCP servers, skills and tool providers. These third-party components may receive prompts, selected files, page content, tool arguments and responses needed to provide the enabled integration.
• Recipients and public audiences. People, organizations and platforms receive information that you instruct or permit an Agentic Feature to message, email, submit, upload or publish.
• Professional advisors (lawyers, accountants, auditors), bound by confidentiality.
• Authorities and other parties where required by law, to comply with legal process, to protect our rights or those of users or the public, or in connection with a corporate transaction (e.g., merger, acquisition or asset sale), in which case we will require recipients to honor this Policy.

We maintain a list of current sub-processors and will provide it on request to privacy@meshlabs.cloud. Where a service provider processes personal data on our behalf, we enter into contractual data-protection terms as required by applicable law. We do not sell personal data, and we do not share personal data for cross-context behavioral advertising.

10 International Data Transfers

Mesh is a Delaware corporation with its principal mailing address in the United States. Our infrastructure, service providers and peer nodes may be located throughout the world, including in destinations that may not provide the same level of data protection as your home jurisdiction. Peer-to-peer execution may transfer job content directly to the countries in which assigned Provider nodes are located.

Where the EU/UK GDPR or Swiss data-protection law requires a transfer mechanism, we rely as applicable on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, the Swiss adaptations to the Standard Contractual Clauses, adequacy decisions, or another lawful mechanism. We apply supplementary measures where appropriate, such as encryption in transit and at rest, access controls, minimization and transfer-risk assessments. You may request information about applicable safeguards by contacting privacy@meshlabs.cloud.

11 Data Retention

We keep personal data only as long as necessary for the purposes described in this Policy and to satisfy our legal, accounting and reporting obligations. Indicative retention windows (which may be adjusted to reflect operational and legal requirements):

• Account data: for the life of the account and up to 24 months after closure.
• Uploaded job inputs and transient artifacts: generally retained only for the operational life of the job and typically removed from object storage within approximately 24 hours, subject to retries, legal holds and exceptional incident or support requirements.
• Final generated outputs: output records and, where configured, downloadable artifacts may be retained for up to 12 months to provide job history and result delivery, unless you delete them earlier or a shorter storage lifecycle applies. Artifact files may become unavailable before the associated job record, so you should download outputs you wish to retain.
• Presigned artifact URLs: input download links are generally issued for up to 24 hours and output links are generally issued for shorter periods and may be refreshed while the underlying artifact remains available.
• Job and contribution metadata, CU ledger entries: up to 7 years for accounting, audit and tax compliance.
• Personal AI conversations: stored on your own devices under your control by default. If and when a transient multi-device relay is enabled, relayed copies are processed in memory and not retained as conversation storage. If you opt in to a server-side conversation-storage feature, the retention period and deletion controls presented with that feature will apply.
• Agentic Features data stored locally: agent transcripts, action and approval history, granted roots, capability settings, schedules, installed MCP servers and skills, and the per-account browser profile are retained on the device until you remove the applicable data, integration, account profile or application, subject to available product controls and operating- system behavior.
• Agentic data held by third parties: information sent to websites, connected accounts, MCP servers, skills, message recipients or public audiences is retained under those parties' policies and cannot necessarily be deleted through Mesh.
• Security and abuse logs: typically 90–365 days.
• Backups: rolled off on a defined backup-retention schedule (typically up to 35 days).

Where you exercise your right to erasure (§13), we will delete or de-identify personal data unless we are legally required or permitted to retain it.

12 Security Measures

We implement technical and organizational measures appropriate to the risks presented by our processing, including:

• encryption of data in transit (TLS) and at rest where applicable;
• role-based access control with the principle of least privilege, enforced at the API, service and database layers and segmented by organization (RBAC);
• cryptographic integrity verification of model assets (e.g., SHA-256 content addressing);
• trustless validation, redundancy and quorum acceptance for compute results;
• hardware-backed device attestation to mitigate Sybil attacks (where supported);
• logging, monitoring, intrusion detection and anomaly detection;
• for Agentic Features, permission scopes and revocation controls, folder boundaries, action and approval history, per-account browser profiles, and human-takeover flows for sensitive interactions, where applicable;
• secure-development practices, code review and dependency-vulnerability management;
• a documented incident-response process, including notifications to regulators and affected users where required.

No security measure is perfect. If you suspect a vulnerability or breach, please contact security@meshlabs.cloud promptly.

13 Your Privacy Rights

Subject to applicable law (including the EU/UK GDPR, Swiss and U.S. state privacy laws, and the CCPA/CPRA), you may have the following rights:

• Access. Confirmation of whether we process personal data about you and a copy of that data. See Article 15 GDPR.
• Rectification. Correction of inaccurate or incomplete data. See Article 16 GDPR.
• Erasure ("right to be forgotten"). Deletion of personal data, subject to exceptions (e.g., legal obligations, defense of claims). See Article 17 GDPR.
• Restriction. Restriction of processing in defined circumstances. See Article 18 GDPR.
• Portability. Receipt of personal data in a structured, commonly used, machine-readable format and transmission to another controller, where technically feasible. See Article 20 GDPR.
• Objection. Objection to processing based on legitimate interests, including profiling. See Article 21 GDPR.
• Withdrawal of consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Non-discrimination. We will not discriminate against you for exercising any of these rights.
• Lodging a complaint. You may lodge a complaint with your local data-protection authority.

To exercise your rights, email privacy@meshlabs.cloud from the address associated with your account, or use the in-product privacy controls. We may need to verify your identity before responding. We will respond within the time periods required by applicable law (typically 30 days under GDPR, extendable by 60 days for complex requests; 45 days under CCPA, extendable once).

14 Children

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 18 (or the age of legal majority in their jurisdiction, whichever is greater). If you believe a child has provided us with personal data, please contact privacy@meshlabs.cloud and we will take appropriate steps to delete it.

15 Automated Decision-Making & Profiling

The Service performs a number of automated processing operations that may affect you, including: scheduling jobs to peer nodes (using device capability, network locality, latency and reputation inputs), accepting or rejecting compute results based on quorum and divergence statistics, computing reputation and CU, and detecting fraud, abuse and Sybil behavior. If you enable Agentic Features, AI models also interpret your instructions, select tools and propose or perform actions within the permissions you configure. Those actions may affect files, accounts, communications, publications, purchases and third parties.

We endeavor not to engage in automated decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Where such decisions occur (for example, an account suspension based primarily on automated abuse signals), you have the right to obtain human review, express your point of view and contest the decision by contacting privacy@meshlabs.cloud.

This statement about decisions Mesh makes concerning you does not mean that an Agent Action you instruct or permit cannot have legal or similarly significant consequences. You should use human review and confirmation for consequential actions involving contracts, purchases, employment, finance, healthcare, government services or other people's rights.

16 Use of Data for AI Training & Improvement

We do not use the content of Requester prompts, source media, source code, Personal AI conversations (whether stored locally, relayed, or stored server-side at your request), agent transcripts, selected file or page content, command or MCP output, communications, Agent Actions or generated outputs to train Mesh's own foundation models without a separate, opt-in agreement with you. We may use de-identified or aggregated job metadata (for example, model identifiers, latency distributions, hardware-class distributions, average shard memory consumption) to evaluate, benchmark and improve the Service, including to recalibrate the deterministic complexity profile used by the Oracle Node, optimize job scheduling and node matching, plan network capacity and refine validation mechanisms. We do not describe data as anonymous unless it has been processed so that it no longer relates to an identified or identifiable person under applicable law.

17 Region-Specific Disclosures

17.1 European Economic Area, United Kingdom and Switzerland

The legal bases on which we rely are listed in §05. You may contact our team at privacy@meshlabs.cloud for any data-protection enquiry. Where Article 27 of the EU or UK GDPR requires us to appoint a local representative, the representative's identity and contact details will be published in this Policy.

17.2 Israel

Our processing is governed by the Israeli Privacy Protection Law, 5741-1981 and its regulations, including the Privacy Protection (Data Security) Regulations, 5777-2017. Subject to applicable law, you may have rights to access information about you in a database and to request correction or deletion of information that is inaccurate, incomplete, unclear or outdated, including under Sections 13 and 14 of the Privacy Protection Law. Contact privacy@meshlabs.cloud to exercise those rights.

17.3 United States, including California

Residents of U.S. states with applicable comprehensive privacy laws may have rights to access, correct, delete or obtain a copy of personal data; opt out of certain sales, targeted advertising or profiling; and appeal a denied request. To the extent the CCPA/CPRA applies, California residents may also request to know the categories and specific pieces of personal information we collect and limit certain uses of sensitive personal information. We do not sell personal information or share it for cross-context behavioral advertising. During the preceding 12 months, we may have disclosed the categories described in §03 for the business purposes and to the recipient categories described in §§05–09; we have not sold personal information or shared it for cross-context behavioral advertising. To exercise rights or submit an appeal, contact privacy@meshlabs.cloud. You may designate an authorized agent, subject to legally permitted verification, and we will not discriminate against you for exercising applicable rights.

17.4 Other Jurisdictions

We will honor applicable rights granted under other privacy laws (e.g., Brazilian LGPD, Canadian PIPEDA, Singapore PDPA). Where local law requires specific disclosures or additional rights, those will apply in addition to the rights listed in §13.

18 Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will provide reasonable notice (e.g., by email or in-product banner) and update the "Last Updated" date above. Your continued use of the Service after the effective date of the updated Policy constitutes acceptance of the changes.

19 Contact & Complaints

For questions, requests or complaints regarding this Policy or our data practices:

Mesh Labs Cloud, Inc.
Attn: Privacy
2810 North Church Street
Wilmington, Delaware 19802, United States
Privacy: privacy@meshlabs.cloud
Security: security@meshlabs.cloud
Legal: legal@meshlabs.cloud

If you have an unresolved concern, you may also contact your local data-protection authority or other competent regulator.