Privacy Policy

01Scope of this policy

This policy explains how Mesh Suite collects, uses, shares, stores and protects personal information when you visit www.meshsuite.in, create a workspace, or use any Mesh Suite product, including MeshPOS and MeshCRM.

It covers information about the people who use Mesh Suite: business owners, their staff, and visitors to our website. It also explains, separately, how we handle the records a business puts into its own workspace, including information about that business's own customers.

It should be read together with the Terms of Service.

02Who is responsible for what

For information about the people who sign in to Mesh Suite, and about visitors to our website, Mesh Suite decides how and why that information is used. In data protection terms we are the data fiduciary, also described as the controller.

For the business records inside a workspace, including a store's own customer names, phone numbers, purchase history and loyalty balances, the business that owns the workspace decides how that information is used. We process it on that business's instructions in order to provide the service. That business is the data fiduciary; we are a data processor acting for it.

If you are a customer of a store that uses Mesh Suite and you want your information corrected or removed, contact that store directly. They control it. We will support them in acting on your request, but we cannot act on it without their instruction.

03Information we collect

We collect the following, and no more than we need to run the service:

• Account information: your name, email address, and a password if you set one. Where you sign in with Google we receive the information described in the next section instead of a password.
• Workspace information: your store or business name, city, and GSTIN where you choose to provide it, along with the plan and subscription state of the workspace.
• Staff and role information: the users you create, the roles you assign, and the products each user may open.
• Business records you enter: your product catalogue, customers, invoices, payments, stock movements, settings, and similar operational data.
• Billing information: your plan, billing period, the invoices we raise, and limited payment metadata such as the last four digits and card type where our payment provider supplies it. We never receive or store your full card number, CVV, UPI PIN or net banking credentials.
• Technical and usage information: IP address, browser and device type, pages and features used, timestamps, and error diagnostics. On the MeshPOS terminal this includes an installation identifier for the terminal itself and synchronisation status.
• Security records: sign-in attempts, verification and password reset events, and similar authentication activity, which we use to detect and investigate abuse.
• Support correspondence: what you send us when you contact support, and our replies.

04Information received through Google sign-in

Where you choose to sign in to Mesh Suite with Google, Google asks for your permission and then sends us a limited set of information about your Google account. We request only the basic sign-in scopes: your name, your email address, your email verification status, your Google account identifier, and your profile picture where one exists.

We use that information for one purpose: to create or identify your Mesh Suite account and to sign you in. Your name is used as the display name on your workspace and can be changed by you. Your email address identifies the account and receives service email. Where a verified Google email address matches an existing Mesh Suite account, signing in with Google resolves to that same account rather than creating a second one.

Mesh Suite does not request access to your Gmail, Google Drive, Contacts, Calendar, or any other Google service, and cannot read them.

Mesh Suite's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the sign-in feature you asked for; we do not transfer it to others except as necessary to provide that feature, to comply with applicable law, or as part of a merger or acquisition where the same commitments continue to apply; we do not use it for advertising; we do not sell it; and no human reads it except with your explicit consent, for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymised.

You can withdraw Mesh Suite's access at any time from your Google account permissions page. If you do so and your Mesh Suite account has no password, add a password first, or you will not be able to sign in.

05How we use information

We use the information described above to:

• Create and administer your account and your workspace, and to sign you in.
• Provide the products in your plan, including billing, inventory, synchronisation between your terminal and the cloud, and messaging where you enable it.
• Send service communications: verification codes, password resets, security notices, billing notices, and changes to these documents. These are not marketing and cannot be turned off while you hold an account.
• Take payment for a paid plan and keep the records of it that we are required to keep.
• Keep the service secure: detect, investigate and prevent fraud, abuse, automated attacks and unauthorised access.
• Provide support when you ask for it.
• Understand how the product is used in aggregate so we can improve it, fix defects, and plan capacity.
• Comply with legal obligations and to establish or defend legal claims.
• Send marketing about Mesh Suite, only where you have opted in. Every marketing message carries an unsubscribe link, and unsubscribing never affects service communications.

06Our basis for using it

We process personal information in accordance with the Digital Personal Data Protection Act, 2023 and other applicable Indian law.

For most processing our basis is the performance of our agreement with you: we cannot provide a workspace without an account, a plan, and the records that make it work. Some processing rests on our legitimate interest in keeping the service secure and improving it, balanced against your interests. Some, such as retaining financial records, rests on a legal obligation. Where we rely on consent, such as optional marketing, you may withdraw it at any time.

07Cookies and similar technologies

We use a small number of cookies, and they are functional rather than commercial.

The most important is the session cookie that keeps you signed in. It is scoped to meshsuite.in and its subdomains so that one sign-in covers the suite home and every product you have access to. It is required: without it you cannot stay signed in.

We also use short-lived cookies during sign-in to complete the authentication exchange securely, and our bot-protection provider may set a cookie to distinguish a person from an automated script.

We do not use advertising cookies, and we do not allow third parties to track you across other websites through Mesh Suite.

08How we share information

We do not sell personal information, and we do not share it for anyone else's independent marketing.

We share it only with service providers who help us run Mesh Suite, each under a contract that limits them to our instructions:

• Cloud hosting, database and authentication infrastructure, which stores your workspace and runs the sign-in system.
• Application hosting and content delivery for our websites and web applications.
• Email delivery, for verification codes, password resets and service notices.
• Bot protection, to keep automated abuse off the sign-in screens.
• Payment providers, to take payment for paid plans.
• Messaging platforms, including the WhatsApp Business Platform, where you enable customer messaging. Messages you send travel through that platform under its own rules.
• Identity providers, where you choose to sign in with Google.
• Professional advisers, and authorities where the law requires disclosure or where we need to establish or defend a legal claim.

09Where information is stored and how it is protected

Workspace data is stored on managed cloud infrastructure. Some of our service providers operate outside India, so information may be processed outside the country. Where that happens we rely on contractual protections with those providers and transfer only what the service requires.

The MeshPOS terminal application keeps a local copy of the data it needs on the machine in your store, so that billing works without an internet connection. That copy sits on hardware you control, and physical and operating-system security for it is your responsibility.

We protect information with encryption in transit, access controls, database-level isolation between workspaces so that one business cannot read another's records, hashed passwords that we cannot read or recover, and restricted internal access on a need-to-know basis.

No system is perfectly secure and we do not claim otherwise. If a personal data breach affects you, we will notify you and the relevant authority as required by law.

10How long we keep information

We keep workspace data for as long as the workspace is open, because it is the record of your business.

After a workspace is closed, we delete or irreversibly anonymise its data within ninety days, except where a law requires us to keep specific records for longer. Financial and tax records, including the invoices we raise to you, are kept for the statutory retention period under Indian law.

Security and authentication logs are kept for a limited period appropriate to investigating abuse. Backups are held on a rolling cycle and expire on their own schedule after deletion from the live system.

Support correspondence is kept for as long as needed to handle the matter and for a reasonable period afterwards.

11Your rights and choices

Subject to applicable law, you may ask us to do any of the following. Write to meshsuite.work@gmail.com from the email address on your account, and see the last section for how to escalate if you are not satisfied with our answer.

• Confirm what personal information we hold about you and give you a copy.
• Correct information that is inaccurate, incomplete or out of date.
• Delete information we no longer have a lawful reason to keep.
• Withdraw consent where our processing rests on it, including opting out of marketing.
• Nominate another person to exercise these rights on your behalf in the event of death or incapacity.

12Deleting your account and your data

You can close your workspace at any time. Export anything you need first: closure is intended to be final, and it removes access for every user of that workspace.

To request deletion of your account and the personal information associated with it, write to meshsuite.work@gmail.com from the email address on the account, or use the account settings in your workspace where that option is available. We will confirm your identity, act within the period required by law, and tell you what has been deleted and what we are required to keep.

If you signed in with Google, deleting your Mesh Suite account does not delete your Google account. Withdrawing Mesh Suite's access from your Google account permissions page stops future sign-in but does not by itself delete the Mesh Suite account or its data. Ask us to delete it as described above.

13Information about a store's own customers

When a business uses Mesh Suite to record its customers, that business decides what to collect and why. Typically it is a name, a phone number, purchase history, loyalty points and store credit.

We process those records only to provide the service to that business. We do not use them for our own purposes, we do not market to those customers, and we do not share them with other businesses using Mesh Suite.

Businesses using Mesh Suite are responsible for having a proper basis to hold their customers' information, for telling those customers how it is used, for obtaining consent where messaging requires it, and for responding to requests from their own customers.

14Children

Mesh Suite is a business tool and is not directed at children. We do not knowingly create accounts for anyone under eighteen. If you believe a child has provided personal information to us, write to meshsuite.work@gmail.com and we will delete it.

15Changes to this policy

We will update this policy as Mesh Suite develops, as new products are released, and as our service providers change. The date at the top of this page shows when it last changed.

Where a change materially affects how we use your information, we will give notice in the product or by email before it takes effect. Continuing to use the service after that date means the updated policy applies.

16Contact us and how to complain

For any question about this policy, to make a request about your information, or for anything else about Mesh Suite, write to meshsuite.work@gmail.com.

Mesh Suite operates from Gurugram, Haryana, India. Full registered entity details, the postal address, and the name of our designated grievance officer under the Digital Personal Data Protection Act, 2023 will be published on this page as they are finalised. Until then, requests and grievances sent to meshsuite.work@gmail.com reach the person responsible.

We aim to acknowledge a request within seven working days and to resolve it within the period the law allows. If you are not satisfied with our response, you may complain to the Data Protection Board of India.