Privacy Policy

1. Scope

This policy applies to plotmesh.xyz, the Plotmesh studio, customer support, and related account, generation, storage, and billing services. It does not govern third-party sites you choose to visit.

2. Data we process

• Account data: email address, user and workspace identifiers, authentication events, sessions, roles, and preferences.
• Creative content: prompts, briefs, uploaded media, persona and series settings, selected models, generated outputs, approvals, and publishing instructions.
• Usage and billing: credit events, plan, purchases, cost records, Stripe customer and transaction identifiers. Stripe processes full payment-card details; Plotmesh does not store them.
• Technical and security: IP address, device and browser information, request logs, error records, rate-limit events, and Turnstile security signals.
• Communications: support messages, feedback, and records needed to resolve a request.
• Voice data (operational draft, pending qualified counsel review): audio recordings you submit for transcription, the transcripts produced from them, and text you submit for free-tier narration. Recordings are sent to Deepgram's speech-to-text service for the sole purpose of producing a transcript; narration text is sent to Fish Audio's s2.1-pro-free text-to-speech service. Transcripts and narrated audio are stored as sources in your workspace and kept under the same retention as other workspace content.
• BYOK key references (operational draft, pending qualified counsel review): provider class, label, budget settings, status, and an opaque vault reference for keys you register. Raw provider keys are never stored; client surfaces show redacted key metadata only.

3. Why we use data

We process data to provide and secure the service, create and store requested content, manage credits and billing, support users, prevent abuse, improve reliability, meet legal obligations, and establish or defend legal claims. Our legal bases under the GDPR are performance of a contract, legitimate interests in operating and protecting Plotmesh, compliance with law, and consent where required for optional cookies or similar technologies.

4. AI processing

Your prompts, source material, configuration, and relevant context may be sent through Plotmesh's creative routing infrastructure. Lite routes are the default. Pro routes require an explicit selection. Plotmesh does not use customer content to train Plotmesh models. External AI subprocessors may process request data under their own enterprise terms and retention controls, which can vary by route; the studio shows the selected quality tier and credit estimate before generation.

Generated content can be inaccurate, incomplete, or similar to material generated for others. Review outputs before relying on or publishing them, especially where people, rights, health, law, finance, or factual claims are involved.

5. Service providers and disclosure

We disclose data only as needed to operate Plotmesh, complete your instructions, comply with law, or protect rights and safety. Providers include Cloudflare for Workers, D1, R2, AI Gateway, email delivery, and Turnstile; the AI model provider selected for a generation; Deepgram for requested speech-to-text; Fish Audio for free-tier narration; and Stripe and Link for merchant-of-record checkout, billing, indirect-tax compliance in supported jurisdictions, fraud controls, receipts, disputes, and transaction support. If you enable signal alert webhooks, alert titles, bodies, and evidence links are also sent to the webhook endpoint you configure. Professional advisers and authorities may receive information where legally necessary. We do not sell personal information or share it for cross-context behavioural advertising.

6. International transfers

Providers may process data outside your country. Where the GDPR or UK GDPR applies, we use appropriate safeguards such as adequacy decisions, standard contractual clauses, and supplementary technical or organisational measures, as applicable.

7. Retention

• Email sign-in credentials expire after five minutes; verification values are stored hashed.
• Sessions can remain valid for up to 30 days, subject to earlier sign-out, revocation, or security action.
• Workspace content and generated media remain until deleted, the account closes, or retention is no longer needed for the service or a dispute.
• Deleting a workspace from Studio → Data & privacy freezes it immediately, waits 72 hours so you can cancel, then removes its records and stored files and gives you a receipt of what was removed and what is retained.
• A workspace export archive stays downloadable for seven days and is then deleted; each download link is signed and valid for five minutes.
• Billing and transaction records are retained for applicable accounting, tax, fraud-prevention, and legal periods.
• Security, support, and operational records are retained only as long as reasonably needed for their purpose.

8. YouTube API Services

When you connect a YouTube destination, Plotmesh uses YouTube API Services and Google OAuth only to upload a finished video after you approve the exact master, choose the destination, set its audience and visibility, and click upload. Plotmesh requests the youtube.upload scope. It does not read, list, analyze, edit, or delete your existing YouTube videos, and it does not use YouTube data for advertising or AI-model training.

Plotmesh stores an encrypted access token, refresh token, granted scope, connection time, and the limited upload and processing identifiers needed to complete and reconcile your request. This data is shared with Google only to perform the upload you requested and is handled subject to the Google Privacy Policy and the YouTube API Services Terms of Service.

You can disconnect YouTube from Studio → Integrations at any time. Plotmesh then requests token revocation and deletes the stored connection tokens, account reference, upload session, and YouTube identifiers associated with that connection. You can also revoke Plotmesh through your Google Account connections. To request deletion of other stored account data, email support@plotmesh.xyz; verified requests are completed as soon as possible and within seven calendar days. Deleting Plotmesh data does not delete videos or other data stored by YouTube; use YouTube to delete content held by YouTube.

9. Your rights

Depending on where you live, you may request access, correction, deletion, portability, or restriction; object to certain processing; withdraw consent prospectively; or appeal a decision. You can exercise access and portability yourself in Studio → Data & privacy, which prepares a JSON archive of the records your workspace owns and a list of your stored media files, and which can delete the workspace. Credentials, token references and signing secrets are excluded from the archive and listed as excluded; billing and tax records, immutable production spend audits and prior deletion receipts are retained and named in the deletion receipt. You may also complain to your local supervisory authority. In Sweden, the lead authority is Integritetsskyddsmyndigheten. California residents have the additional rights described in our California privacy disclosure.

10. Security

We use access controls, encrypted transport, secure Cloudflare infrastructure, hashed authentication values, rate limits, Turnstile, workspace authorization checks, and restricted secrets. No system is perfectly secure, so report suspected issues promptly.

11. Children

Plotmesh is intended for users aged 18 or older and is not directed to children. Contact us if you believe a child provided personal data.

12. Changes and contact

We may update this policy as Plotmesh changes. Material changes will be communicated through the service or by email where appropriate. Contact Sansa Group AB at Soldathemsgatan 20, 415 28 Göteborg, Sweden, or support@plotmesh.xyz.