Who we are
MeshQu (“we”, “us”) operates meshqu.com. For the purposes of UK GDPR we are the data controller for personal data you submit through this site. To get in touch about privacy, email contact@meshqu.com.
What we collect
The marketing site is intentionally narrow in scope. We collect:
- Contact form submissions. When you use the form on /contact, we collect the name, email address, and any message you provide.
- Aggregate analytics (opt-in). We use Vercel Web Analytics, which records anonymous, aggregated pageviews. It does not set cookies, does not assign you an identifier, and does not record personal data. Analytics only loads after you click “Allow analytics” on the consent banner; until then no analytics requests are made.
- Server logs. Our hosting provider (Vercel) retains short-term request logs that may include IP addresses for security and abuse-prevention purposes.
We do not run advertising trackers, marketing pixels, session-replay tools, or third-party analytics. We do not sell or rent personal data.
Why we use it (lawful basis)
- Contact form data. Used to respond to your enquiry. Lawful basis: legitimate interests (responding to a request you initiated) or, where you ask for a demo, taking steps at your request prior to entering a contract.
- Aggregate analytics & logs. Used to keep the site secure and understand which content is useful. Lawful basis: legitimate interests in operating a secure, working website.
Where it goes
Contact form submissions are forwarded to a private MeshQu Slack channel over a secure webhook. We do not store them in a separate database, CRM, or marketing tool. The recipients are members of the MeshQu team.
Subprocessors — marketing site (meshqu.com)
These third parties may process personal data submitted through this marketing site:
Subprocessors — MeshQu platform
The list below covers the third parties that process data on behalf of MeshQu when you use the platform (the API, the console, the verifier). Tenant data is logically isolated per-tenant at the row level (RLS), and MeshQu does not share customer governance data with these subprocessors beyond what is necessary to operate the service.
| Subprocessor | Purpose | Region | DPA |
|---|---|---|---|
| Supabase | Managed Postgres, authentication, and storage for tenant data | EU (eu-west-2) by default; configurable per tenant | DPA |
| Vercel | Hosting for the console, demo, and marketing surfaces | United States (with appropriate transfer safeguards) | DPA |
| Railway | Container hosting for the MeshQu API and worker processes | United States (with appropriate transfer safeguards) | on request |
| Doppler | Secret management (encrypted at rest; not a recipient of customer data) | United States (with appropriate transfer safeguards) | DPA |
| OpenAI | AI-assisted rule authoring and summarisation. Each request opts out of OpenAI training and long-term retention via store:false; per OpenAI policy a short abuse-monitoring window (currently 30 days, per their data-controls docs) may still apply unless the deployment is on an approved Zero Data Retention (ZDR) project. Customer policy text is only sent when the tenant has explicitly enabled AI-assisted authoring. | United States (with appropriate transfer safeguards) | DPA |
We will update this list with at least 30 days’ notice before adding a new subprocessor that materially changes the data flow. To subscribe to changes, email contact@meshqu.com.
How long we keep it
- Contact submissions stay in Slack for as long as the conversation is useful and are deleted on request.
- Server logs follow Vercel’s default retention (typically a few days for runtime logs).
- Analytics aggregates are retained per Vercel’s Web Analytics policy and contain no personal data tied to you.
Your rights
Under UK GDPR you have the right to access, correct, delete, or restrict processing of your personal data, to object to processing based on legitimate interests, and to data portability. To exercise any of these, email contact@meshqu.com.
You also have the right to lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk.
Cookies & local storage
meshqu.com does not set tracking, advertising, or analytics cookies. Vercel Web Analytics (when enabled) is cookieless.
We store one item in localStorage to remember your consent choice:
meshqu.analytics-consent— value isallowedordeclined. Clear it from your browser’s DevTools to be asked again.
Strictly necessary cookies may be set in future for product features (for example, signed-in console sessions on the product domain); we will update this notice before that happens.
Changes to this notice
If we make material changes we will update the “Last updated” date at the top of this page. Substantive changes will be flagged on the homepage where appropriate.