Privacy Policy
What personal data MeshyFlix collects when you browse the site, buy from the shop, use the 3D studio or write to us — why, on what legal basis, who else handles it, how long it is kept, and what you can ask of us.
1. Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is:
[Company legal name]
[Registered address]
[Commercial register and number] · VAT ID [VAT ID]
Represented by [Managing director / owner]
Email: info@meshyflix.com
Data protection officer: [name and contact, or delete this line if no officer is required]
2. At a glance
| Data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Server logs: IP address, time, page requested, referrer, browser | Deliver the site, find faults, block attacks | Legitimate interest, Art. 6(1)(f) | About 10 days |
| Account: email, username, password hash, display name, avatar, billing address | Provide your account | Contract, Art. 6(1)(b) | Until you delete the account |
| Orders and invoices: name, billing address, email, phone if given, items, amounts | Sell and deliver; bookkeeping | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | Statutory retention period |
| Studio: prompts, settings, uploaded images, generated files, job history | Generate the models you ask for | Contract, Art. 6(1)(b) | Until you delete the job or the account |
| Token wallet: every credit and debit | Keep and show your balance | Contract, Art. 6(1)(b) | Until you delete the account |
| Contact messages: name, email, subject, message | Reply to you | Consent, Art. 6(1)(a); contract, Art. 6(1)(b) where it concerns an order | Until the matter is closed |
| Visit source (order attribution) — only with Marketing consent | See which links lead to sales | Consent, Art. 6(1)(a) | With the order |
3. Visiting the site
Server logs. Our web server records each request: your IP address, the date and time, the page or file requested, the page you came from, your browser’s user-agent string and the response status. We use these records to deliver the site, diagnose faults and defend it against attacks. The log files are rotated daily and deleted after about 10 days. We do not combine them with other data.
Caching. To make pages fast, the server keeps copies of public pages for up to 10 minutes. Those copies contain no personal data: pages for signed-in visitors, the cart, the checkout, the account area, the studio and the contact page are never cached. Database results are also held briefly in memory (Redis) on the same server; they never leave it.
No third-party requests. Fonts, scripts and the 3D viewer are served from our own server. Browsing the site does not make your browser contact Google Fonts, a content delivery network, an analytics service or an advertising network.
4. Your account
When you register we store your email address, your username and your password — as a salted hash, which we cannot read. You can add a display name, a profile picture and a billing address. If you do not upload a picture, a neutral placeholder from our own server is shown; we do not use Gravatar. The account also holds your token balance and its ledger, your orders and your studio jobs. We use this to provide the account you asked for (Art. 6(1)(b) GDPR), and we email you about it: a welcome message, password resets and order updates.
You can delete your account yourself from the account settings in the studio. That immediately removes your profile, picture, studio jobs, generated files and token ledger. Orders and invoices are kept, detached from the account, because commercial and tax law require it (see section 11).
5. Orders and payment
At checkout we ask for your first and last name, billing address, country and email address, and your phone number if you choose to give it. We use them to conclude and carry out the contract, issue the invoice (generated as a PDF on our server), send order emails and unlock your downloads or tokens. With the order we record that you accepted the Terms of Service and, for digital content, the time and wording of your withdrawal waiver.
Payment is by bank transfer. We see the name, account details and reference that your bank sends with the transfer, and use them to match the payment to your order.
Order attribution. Only if you switched on Marketing in the cookie settings, the order also stores where your visit came from: the referring site, campaign (UTM) parameters, the page you arrived on, how many pages you viewed, the device type and the browser’s user-agent string. This is WooCommerce’s order attribution. Without that consent these fields stay empty. Nothing is sent to an advertising network.
6. The 3D studio
To generate a model we send your request to our processor Meshy AI (meshy.ai): the text prompt and the options you chose, the image or images you upload for an image-to-3D job, and — when you restyle or optimise an existing model — that model. We send it with our own API key. Meshy does not receive your name, your email address or any account details from us.
Images you upload are stored in our media library on our server for the job. When a job finishes we download the generated files — models, textures and thumbnails — to our server and serve them only to your account. Meshy’s own links to those files expire after about three days. Deleting a job deletes its files; deleting the account deletes all of them.
How long Meshy keeps requests on its side is governed by its data processing terms: [Meshy retention period, from the data processing agreement].
Moderation. Prompts and images pass through Meshy’s automated content filter. A blocked job is refunded to your wallet in full. This is an automated check of the content, not a decision about you with legal or similarly significant effects.
Public examples. Models and prompts shown on public pages such as Prompts and the homepage are ones a person at MeshyFlix reviewed and approved for publication; at the time of writing, all of them were generated by MeshyFlix itself. We do not publish a customer’s prompt or model without asking that customer first.
Please do not upload photographs of other people without their permission, or images that reveal sensitive information.
7. Contact form and email
The contact form sends your name, email address, subject and message to info@meshyflix.com, a mailbox on our own mail server. You tick a box to agree to this before sending (Art. 6(1)(a) GDPR); where your message concerns an order or a contract, Art. 6(1)(b) applies as well. If a submission is rejected — a missing field, say — what you typed is held on our server for 15 minutes so the form can be refilled, and then deleted. We keep correspondence until your request is settled, and longer only where commercial or tax law requires it. You can withdraw your consent at any time by email; that does not affect processing that has already taken place.
8. Cookies
By default the site sets only the cookies it needs to work: your cart, your sign-in and your cookie choice. Marketing cookies — the order attribution described above — are set only if you switch them on. No analytics tool is installed. The Cookie Policy lists every cookie with its lifetime; you can change your choice at any time from “Cookie settings” at the foot of every page.
9. Who else receives data
- Hosting — [hosting provider, and the country where the server is located], which operates the server holding the site, its database, the generated files and the mailbox. Processor under Art. 28 GDPR.
- Meshy AI — 3D generation, as described in section 6. Processor under Art. 28 GDPR.
- Banks — yours and ours, to carry out the bank transfer.
- Authorities and advisers — tax authorities, and [tax adviser / accountant, if one receives invoices], where the law requires it.
We do not sell personal data and we do not share it with advertising networks.
10. Transfers outside the EU
Meshy AI may process data outside the European Economic Area. [State where Meshy processes data and the safeguard relied on — for example the EU Standard Contractual Clauses or the EU–US Data Privacy Framework — and confirm a data processing agreement is in place]. Everything else described here stays on our own server.
11. How long data is kept
- Server logs: about 10 days.
- Cart sessions: 2 days, or 7 days when signed in.
- Account, studio jobs, files and wallet: until you delete them or the account.
- Orders, invoices and payment records: for the statutory retention period under commercial and tax law — [period, e.g. 8 or 10 years under German law; confirm with your tax adviser].
- Contact messages: until the request is settled, unless the law requires longer.
- Your cookie choice: 6 months, then you are asked again.
12. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where we rely on your consent you can withdraw it at any time, with effect for the future (Art. 7(3)). Write to info@meshyflix.com.
You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is [competent supervisory authority, e.g. the data protection authority of the federal state where the company is registered].
13. Security
The whole site is served over HTTPS. Passwords are stored only as salted hashes. Files you buy are kept outside the public web folder and released only to the account that bought them. Access to the administration area is restricted to staff.
14. Children
The site is not directed at children under 16, and we do not knowingly collect their data.
15. Changes to this policy
When what we do with personal data changes, this page changes with it; the date at the top shows the version in force.