Sansa Group AB is the controller for account, service, security, and business administration data. When a business customer instructs Plotmesh to process personal data in creative content, that customer may be the controller and Sansa Group AB its processor.
Processing matrix
| Activity and data | Purpose and legal basis | Recipients | Retention |
|---|---|---|---|
| Account, email, session, workspace role | Provide and secure the account. Contract; legitimate interests. | Cloudflare; authorised support staff. | Account term; sessions up to 30 days. |
| Prompts, uploads, personas, model choice, outputs | Perform requested generation and store the workspace. Contract. | Cloudflare; selected model provider. | Until deletion, closure, or no longer needed. |
| IP, request, error, rate-limit, and Turnstile signals | Security, abuse prevention, diagnostics. Legitimate interests; legal obligations where applicable. | Cloudflare; authorised security staff. | Necessity-based, then deleted or anonymised. |
| Plan, credits, invoices, Stripe identifiers | Checkout, metering, accounting, fraud prevention. Contract; legal obligation; legitimate interests. | Stripe; Cloudflare; advisers where required. | Statutory accounting and dispute periods. |
| Support messages and feedback | Resolve requests and improve reliability. Contract; legitimate interests. | Cloudflare email; authorised support staff. | For the request and reasonable follow-up period. |
| Optional cookie choices | Remember consent and, if introduced, enable selected optional tools. Consent; legal obligation for the consent record. | Cloudflare; selected tool only after consent. | Until cleared, withdrawn, or replaced. |
| Voice recordings and transcripts (operational draft, pending qualified counsel review) | Produce a requested transcript or free-tier narration; store the result as a workspace source. Contract; consent where required for third-party voices. | Deepgram for transcription; Fish Audio for free-tier narration; Cloudflare for storage. | Until deletion, closure, or no longer needed. |
| BYOK key references, never raw keys (operational draft, pending qualified counsel review) | Bill provider work with fees and enforce budgets. Contract. | Vault provider; redacted metadata to authorised staff only. | Until revoked or the account closes, plus statutory records. |
Your rights
You may have the right to access, correct, erase, restrict, or receive your personal data; object to legitimate-interest processing; withdraw consent; and complain to a supervisory authority. Where processing is automated and based on contract or consent, portability may apply. Where applicable, you may also request human review of a decision producing legal or similarly significant effects. Plotmesh does not currently use solely automated decisions of that kind.
Send a request to support@plotmesh.xyz. We may verify identity and clarify scope. We normally respond within one month, subject to lawful extensions.
International transfers
Cloudflare, Stripe, Deepgram, Fish Audio, and selected AI providers can process data internationally. We rely on adequacy decisions or appropriate safeguards such as the European Commission’s standard contractual clauses, together with supplementary measures where required.
Controller and processor roles
For individual accounts, Sansa Group AB generally acts as controller. For customer-supplied personal data processed solely to provide workspace and generation functions for a business customer, Sansa Group AB may act as processor under the customer’s instructions. Business customers needing a data processing agreement can contact support.