# Mesh privacy policy

Version 1.0, in force from October 13, 2026

[Français](https://meshapps.io/fr-sn/confidentialite)

## In short

Mesh creates links and QR codes that send each visitor to the right app store. To do this, we keep your email address, your links and visit counters per day and per platform. We measure your use of the console with PostHog, under an internal identifier, without your email address. We do not track the visitors of your links: no cookie, no profile, no network address kept in clear. Our technical providers are located in Europe and the United States. You can view, correct or delete your data at any time.

## Who is responsible for your data

The data controller is Nascent Tech, a SARL registered in Côte d'Ivoire under RCCM number CI-ABJ-03-2025-B12-05167. Its registered office is at Abidjan Cocody Angré 7e Tranche, Abidjan, Côte d'Ivoire. The data controller is the company that decides why and how your data is used.

For any question about your data, write to [hello@nascent-tech.co](mailto:hello@nascent-tech.co). Nascent Tech is the data controller; no named data protection contact has been appointed at this time.

## Who this policy covers

This policy covers three groups of people:

-   **publishers**, meaning people who have a Mesh account and create links;
-   **visitors**, meaning people who open a Mesh link or scan a Mesh QR code;
-   **website visitors** of meshapps.io, which presents the service.

## What we collect, why and on what basis

The "legal basis" is the reason that allows us to use a piece of data. The main ones are the contract (the service you ask us for), a legal obligation and legitimate interest (a reasonable need of Mesh that must not outweigh your rights).

| What we use | Why | Legal basis |
| --- | --- | --- |
| Your email address, the country you declare and the account opening date | Open and manage your account, write to you about the service | Contract (terms of use) |
| The date of your last sign-in | Detect an inactive account, warn you, then delete it | Contract |
| A sign-in code sent by email, kept as a digest, and the time of each sending | Check that you receive the emails of this address, without a password | Contract |
| A session cookie, with no network address and no description of your device | Keep you signed in for at most 30 minutes of inactivity | Contract |
| A digest of your email address and a digest of your network that changes every day, linked to sign-in attempts | Detect and block abuse, such as mass sending of codes | Legitimate interest: protecting accounts and the service |
| The name of your apps and the addresses of their store pages | Make your links and QR codes work | Contract |
| The number of openings of each link, per day and per platform | Show you your statistics | Contract |
| The console pages you open, the actions you take there (for example creating or deleting a link) and the errors encountered, with the internal identifier of your account | Understand how the console is used, improve it and fix its errors | Legitimate interest: improving the service and making it reliable |
| Email notices when a destination changes, when a payment succeeds or fails, or when our team takes a moderation measure on your account | Warn you of what affects your links and your account | Legitimate interest: security of your account; contract for payment notices |
| Actions taken by our team and by our automatic tasks on your account (for example a suspension, or the deletion of an inactive account), with their reason | Prove what was done, by whom and why | Legitimate interest: evidence and defence of our rights |
| Your messages to support and your reports | Answer you and handle reported content | Legitimate interest; legal obligation where a law requires it |
| Your acceptance of the terms of use and your statement that you have read this policy, with the version of each text, the account creation date and a digest of your email address; then the date on which you accept a new version of the terms, or close the notice of a new version of this policy | Prove your acceptance, even after the account is deleted | Legitimate interest: evidence and defence of our rights |
| At sign-up, a Cloudflare anti-bot challenge (Turnstile): your network address, a fingerprint of your encrypted connection, the description of your browser, and the key and address of our page | Prevent sign-ups by automated programs | Legitimate interest: protecting the service |

In Côte d'Ivoire, processing is carried out in accordance with Ivorian law No. 2013-450 and the legal bases stated above. At sign-up, we ask you to read and accept this policy and the terms of use.

We do not check any identity document. We collect no sensitive data, such as health, religion or opinions.

## Visitors of your links

When someone opens a Mesh link, their browser sends, as with any website, its network address and a short description of the device (the "user-agent"). Mesh reads this description to choose the right app store, then forgets it. It adds one to the day's counter for the recognised platform: iPhone, Android, computer or unknown.

Mesh sets no cookie on the visitors of your links. It keeps neither their network address in clear, nor the full address of the page they came from, nor their location. To limit abuse, the network address may be turned into a keyed digest that changes every day. Each opening is also counted at PostHog as a separate event: it carries a randomly drawn identifier, the link, the platform and the chosen store, with no network address and no description of the device. Legal basis: legitimate interest of Mesh and of publishers, who need a working link and simple statistics.

## The meshapps.io website

The website sets a single cookie, `mesh_locale`, when you choose a language. It remembers this choice for one year. This cookie only serves to display the website in your language; it is not used to track you.

The website measures its audience with PostHog, without analytics cookies or advertising profiling, in its European region. Measurements are pseudonymised and used to improve the website. The website may use the technical `mesh_locale` cookie to remember the language.

## The Mesh console

The console measures its use with PostHog. When you open a page or take an action, such as creating, correcting or deleting a link, the Mesh server sends an event to PostHog. It also sends the errors encountered during your visit. Opening and deleting the account, activating a Pro Link and the result of an order (amount, currency, result) are also sent.

Each event carries the internal identifier of your account, the name of the page and, where relevant, the identifier of the link or order. It contains neither your email address, nor your name, nor your phone number. Events leave from our server, not from your browser: PostHog receives neither your network address nor the description of your device, and does not locate you. The console sets no measurement cookie.

PostHog keeps these events in its European region for 12 months, including after your account is deleted. After deletion, the internal identifier is no longer linked to your email address at Mesh. If you ask us, we erase these events at PostHog earlier.

Legal basis: legitimate interest, understanding how the console is used, improving it and fixing its errors. You can object by writing to us (see "Your rights and how to use them").

## Paying for a Pro Link

Pro Link sales are not open yet. This section will apply when they open, together with the terms of sale.

To pay by mobile money, you give the payment method and the phone number that pays. This number is stored encrypted and displayed masked. For Orange Money, you enter a payment code that Mesh passes to its provider without keeping it. Mesh never collects your mobile money secret code or any bank card data. We also keep a contact email address for the order, the order itself and the invoices.

Legal basis: contract for the order; legal obligation for invoices and accounting records.

## How long we keep your data

Data in our database is erased by automatic tasks, every day, or every month for proofs of acceptance and actions of our team. Data may therefore remain up to one day, or one month, after its period. Support messages are erased by hand. At our providers, the period is set in their service and appears in the table.

| Data | Retention period |
| --- | --- |
| Email address, declared country, account opening date, last sign-in date | As long as the account exists; an account with no sign-in for 24 months and no active link is deleted, after an email warning 30 days before |
| Sign-in codes and sending times | 24 hours |
| Console session | 30 minutes of inactivity; deleted after 24 hours at the latest |
| Team invitations | 37 days after they are sent |
| Proof of your acceptance of the texts (version and account creation date) | As long as the account exists, then 5 years |
| Digests linked to sign-in attempts | 6 months |
| Actions of our team and of our automatic tasks on your account | 5 years. The oldest entries may contain your email address in clear; they are erased at the same deadline. |
| Link statistics | 30 days, or 90 days for a Pro Link during 12 months |
| Notices sent by email | 90 days |
| Copy of emails at our sending provider (Resend) | 30 days |
| App names and store page addresses, after account deletion | 30 days; 12 months if the link was suspended for abuse, as proof of the report |
| Log of deletions and address changes, kept outside the database so that a restore does not undo them | 12 months at most |
| Support messages and reports | 12 months after the case is closed, unless a dispute is ongoing |
| Payer number and order email | 13 months after the order is resolved |
| Invoices and accounting records | 10 years, as required by OHADA accounting law |
| Database backups | 7 days at AWS; 30 days at Cloudflare (R2 service) |
| Console usage events, error reports and technical logs at PostHog | 12 months |
| Website language cookie | 1 year |

Deleted data may remain in our backups until they are replaced, at most 30 days. It is only used there to restore the service after an incident. After a restore, we redo the deletions and address changes recorded in this log.

## Who receives your data

Your account is visible only to you and to the members of our team who need it. We do not sell or rent your data to anyone. Our providers, called processors, handle data on our behalf and on our instructions.

| Provider | Role | Location |
| --- | --- | --- |
| Amazon Web Services (AWS) | Hosting of the service, the database, invoices, 7-day backups and the log of deletions and address changes | Frankfurt, Germany (eu-central-1 region) |
| Cloudflare (R2 service) | Encrypted daily backup of the database, outside AWS; Cloudflare cannot read it | European Union, no specific country published by Cloudflare; company established in the United States |
| Cloudflare | Network, protection against attacks, website hosting and the sign-up anti-bot challenge. For the challenge, Cloudflare also uses the data on its own account, to improve its bot detection | Global network; company established in the United States |
| Resend | Sending emails, including sign-in codes; keeps a copy of each email for 30 days | Declared Europe region; company established in the United States |
| PostHog | Website audience measurement, without cookies; measurement of console use and link openings; server error reports and technical logs | European region; company established in the United States |
| PayDunya | Mobile money payment, when sales open | Côte d'Ivoire; the provider terms will be checked before sales open |

We may also pass data to an authority that requests it under the law.

## Transfers outside Côte d'Ivoire and the European Union

Your data is hosted in Germany, and its encrypted backup in the European Union. Some of it passes through companies established in the United States: Cloudflare, Resend and PostHog. A transfer to a third country is governed by the law of each country.

-   **Côte d'Ivoire**: an information request was filed with ARTCI under reference ARTCI-DI-20261013-0012; this filing is not an authorisation, and the regime applicable to the precise flows is being confirmed.
-   **European Union**: transfers to the United States rely, depending on the provider and flow, on the applicable contractual or regulatory safeguards. Detailed safeguards may be requested from [hello@nascent-tech.co](mailto:hello@nascent-tech.co).

You can obtain a copy of these safeguards by writing to us.

## How we protect your data

-   Exchanges with Mesh are encrypted.
-   Sign-in uses a one-time code, valid for 10 minutes and five attempts.
-   The payer number is encrypted in the database.
-   Sensitive actions, such as deleting the account, require a recent proof of identity.
-   Our team signs in with a second factor.

If a data breach puts you at risk, we notify the competent authority and, where the law requires it, the people concerned.

## Your rights and how to use them

You have the right:

-   **of access**: to know what data we hold about you and receive a copy;
-   **to rectification**: to correct inaccurate data;
-   **to erasure**: to have your data deleted, except data the law requires us to keep;
-   **to object**: to refuse a use based on our legitimate interest, on grounds relating to your situation;
-   **to restriction**: to freeze the use of data while a dispute is examined;
-   **to portability**: to receive your account data in a machine-readable format, for example the CSV export of your statistics;
-   **to set instructions** about your data after your death, where the law of your country provides for it.

To use a right, write to [hello@nascent-tech.co](mailto:hello@nascent-tech.co) from your account address. We answer within one month at most. If we cannot grant your request, we tell you why.

## Deleting your account

You can delete your account from the console, on the "Mon compte" (My account) page, button "Supprimer mon compte" (Delete my account). For your security, the console first asks for a code sent by email. If a payment order is in progress, deletion waits until it is resolved, at most 48 hours; the console tells you so.

Deletion immediately closes your access and your links: QR codes already printed then show "Link unavailable". Your short addresses are never reassigned to anyone else. If you placed an order, we separately keep the minimal financial file and invoices for the period required by law.

## Supervisory authorities

If you believe your rights are not respected, you can contact the authority of your country:

-   **Côte d'Ivoire**: Telecommunications/ICT Regulatory Authority of Côte d'Ivoire (ARTCI), data protection authority, [autoritedeprotection.ci](https://www.autoritedeprotection.ci/);

We invite you to write to us first: we answer most requests quickly.

## Minors

Mesh is intended for people who publish apps. Accounts are reserved for people aged at least 18 years old. If you learn that a minor has opened an account, write to us: we will delete it.

## Changes to this policy

We may change this policy, for example when sales open. For a significant change, we notify you by email at least 30 days in advance. The date of the current version appears at the top of this page.

## Contact us

-   Personal data: [hello@nascent-tech.co](mailto:hello@nascent-tech.co)
-   Mail: Nascent Tech, Abidjan Cocody Angré 7e Tranche, Abidjan, Côte d'Ivoire

## Terms used

-   **ARTCI**: Telecommunications/ICT Regulatory Authority of Côte d'Ivoire, also in charge of data protection.
-   **CDP**: Personal Data Protection Commission of Senegal.
-   **Cookie**: small file that a website stores in your browser.
-   **CSV**: simple spreadsheet file format, readable by most software.
-   **ECOWAS**: Economic Community of West African States.
-   **Keyed digest**: value computed from a piece of data and a secret; it does not reveal the data without the secret, but it is still personal data.
-   **Network address (IP address)**: number that identifies an Internet connection.
-   **OHADA**: Organisation for the Harmonisation of Business Law in Africa.
-   **Processor**: provider that handles data on behalf of Mesh.
-   **QR code**: square of dots that a phone scans to open an address.
-   **User-agent**: text sent by the browser that describes the device and software.

## Version history

-   Version 1.0, in force from October 13, 2026

[Back to home](https://meshapps.io/en-sn)