Privacy

Last updated 15 October 2026

Who is responsible

MeshMarkup is a 3D review tool online for designers. For the models and comments in your account, we are the data processor and you are the controller — it is your client’s work, and your relationship with them. For your own account and billing details, we are the controller.

Questions, requests or complaints: hello@meshmarkup.com. A person answers.

What we store, and why

Your account. Email address, display name, and a profile picture if you sign in with Google. Needed to have an account at all.

Your work. The models you upload, their versions, and every note and reply on them. Needed to provide the service.

Reviewers. Someone opening a review link gives a display name, which is stored with their comments so you know who said what. An email address only if they tick the box asking to be told about replies. No account is created, and the name is remembered in their own browser, not tied to an identity.

People you email a link to. If you use “Send by email”, we send your link and note to the address you enter, and keep that address in our email log (with the date and whether it was delivered) to enforce sending limits and investigate abuse. We don’t add them to any list or email them again.

Billing. If you subscribe, Stripe holds the payment method and we hold the customer and subscription identifiers, your plan, and its status. We never see or store card numbers.

Usage. Page views and product events through Vercel Analytics, which is cookie-less and does not identify anyone. Event payloads deliberately exclude emails, model names and record identifiers — a model name can be your client’s unreleased product.

Advertising. Only if you say yes: the Meta Pixel, the Google Ads tag and the Reddit Pixel on our public pages (home, pricing, the free viewer, help, sign-in) record which pages you visited, so we can see whether our ads bring people here. They are never loaded on review links or invitations. Inside the app, the Google tag and the Reddit Pixel load only at the moment you sign up or subscribe (and, for Reddit, send your first review link), to count that one conversion, and only if you allowed Advertising.

If you allowed it and then create an account, our server also tells Meta about a few milestones — signing up, your first upload, your first review link, your first client note, starting checkout and subscribing (with the price) — so we can see which ads bring customers rather than visits. Those reports carry a one-way hash of your email and account id, Meta’s own cookie ids, and your IP address and browser; never a model name, a file, a studio or client name. If you didn’t allow it, or withdraw, none are sent.

What we don’t do

We don’t sell your data, we don’t use your models to train anything, we don’t place advertising cookies without asking first, and we don’t look at your files except when you ask us to help with a specific problem.

Who else processes it

These companies handle data on our behalf, under contract. Listed with what each one sees, so you can check it against your own obligations rather than take our word for it.

Where a processor is outside the EEA, transfers rely on the European Commission’s Standard Contractual Clauses.

How long it is kept

Your models and notes stay until you delete them or delete your account. Deleting a model removes its versions, its comments and its stored files. Deleting your account removes everything a studio you solely own holds, including the files themselves, and is immediate — there is no grace period to change your mind, so export first. We keep only an anonymous note that an account was deleted: the date, the plan, how long it existed and how many models it had, with nothing that says whose it was.

Invoices are kept for as long as tax law requires, which in Portugal is ten years. Email delivery logs are kept for 30 days so a bounce can be diagnosed.

Security

Files are stored privately and have no public address; a review link opens them through a signed URL that expires. Review links are stored hashed, so a copy of our database is not a set of working links. Studios are separated at the database level rather than by careful application code, so a bug in a page cannot show you someone else’s models. Nothing is indexed by search engines.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, and take it elsewhere. Two of those are buttons rather than emails: Settings → Profile has a full export of everything in your studio as one JSON file, and account deletion you can do yourself.

For anything else, email us. If you think we have got it wrong you can complain to your national data-protection authority — ours is CNPD in Portugal.

Cookies

One cookie keeps you signed in. It is needed for the app to work, so it doesn’t ask.

On our public pages we ask once whether we may load the Meta Pixel, the Google Ads tag and the Reddit Pixel. If you allow it, Meta sets its own cookies (_fbp, and _fbc when you arrive from an ad), Google sets _gcl_au (and _gcl_aw when you arrive from a Google ad), Reddit sets _rdt_uuid, and each receives your visit. If you say no, or never answer, nothing from Meta, Google Ads or Reddit is loaded. Your choice is kept in your browser, and Cookie settings at the foot of every public page lets you change it at any time. Withdrawing removes those cookies from this site.

Analytics are cookie-less, as described above.

The free viewer

Files opened in the free viewer never leave your computer. They are read in your browser, there is no server copy, and nothing to delete afterwards. The same is true of format conversion: an FBX or a zip is turned into a GLB in your browser before anything is uploaded.

Children

MeshMarkup is a tool for professional work and is not intended for anyone under 16. We don’t knowingly collect their data.

Changes

If this policy changes in a way that matters, we’ll email account holders rather than quietly change the date at the top.