Privacy Policy

• Account information: the email address and password you sign up with (the password is hashed, never stored in plain text), and the workspace name you choose.
• Connection credentials: OAuth tokens or API keys for systems you connect. These are encrypted before they’re stored and never shown back to anyone, including members of your workspace.
• Metadata from connected systems: object and field definitions, flow and workflow configuration, and similar structural metadata, never the business records (Contacts, Deals, Opportunities, and so on) those systems hold. One exception: we store n8n workflow definitions whole, so any sample data pinned inside a workflow is stored with it. Exactly what’s read per system is listed on the Security page.
• Names of your Salesforce admins: when a rescan can match a setup change to the person Salesforce’s Setup Audit Trail says made it, we store that person’s Salesforce user id and display name with the change, and show the name to members of your workspace. For these admins we don’t store an email address or username, and we don’t put their name in Slack or email notifications. They are deleted along with the scans they come from, when you disconnect Salesforce or delete the workspace.
• Salesforce usernames: the username of the Salesforce user who connected the org, kept with the connection until the workspace is deleted; and the usernames of active Salesforce users with an integration license, kept in the dependency map and deleted along with the scans they come from. Salesforce usernames are often email addresses.
• Questions you ask Meshie’s AI assistant, and the answers it gives. This history is private to you: other members of your workspace can’t see it.
• Billing information, for paid plans: handled directly by Stripe. We receive your subscription status, not your card number.
• Basic usage and log data: things like request timestamps and error logs, used for keeping the Service running and secure.
• Product analytics: which pages you open and actions you take in the app, along with your browser and device type and an approximate location derived from your IP address. Once you have an account these are linked to it, and your email address is recorded when the account is created. We do not record your screen: session replay is switched off.

To operate the Service: authenticate you, build your dependency map, answer your questions, process billing, and, once email delivery is switched on, send you account-related email (password resets, workspace invites). We don’t use your connected-system metadata or chat history for anything beyond your own workspace, and we don’t sell your data to anyone.

We share data with the third parties that make the Service work, and no one else:

• Anthropic, for the AI features. When you ask the AI assistant a question, the question and the dependency-map details needed to answer it (which can include Salesforce integration usernames) are sent to Anthropic. When you ask Meshie to propose a change, the text of your request is sent to Anthropic to classify and draft it. A workspace can use its own Anthropic API key instead of ours.
• Stripe, to process payment for paid plans.
• Resend, to deliver account-related email (password resets, workspace invites). Email delivery is not switched on yet: until it is, these emails are not sent and nothing is shared with Resend.
• PostHog, to measure how the Service is used (the product analytics described above).
• Fly.io, which hosts the Service and stores its database.
• Tigris, which stores database backups, kept for 30 days.
• The systems you connect (Salesforce, HubSpot, and others): we send API requests to them on your behalf, using the credentials you provided, only to read the metadata described on the Security page.
• AI apps you connect (such as Claude or ChatGPT): when you connect one to Meshie, it reads what you ask it to from your workspace, and that goes to the app’s vendor under your own account with them.

We don’t share your data with anyone else, and we don’t sell it. We may disclose it if legally required to (for example, in response to a valid subpoena).

We use a session cookie to keep you logged in, and a cookie set by our analytics provider to measure product usage. We don’t use advertising or cross-site tracking cookies.

We keep your data for as long as your workspace exists. Disconnecting a system deletes the data retrieved through that connection, and our stored credential for it, immediately. Deleting your entire workspace (available to owners, from the workspace’s Danger zone settings) permanently deletes everything associated with it: connections, retrieved metadata, and chat history. There’s no recovery period once that’s confirmed.

We keep database backups for disaster recovery, so deleted data can remain in a backup taken before it was deleted. Backups are kept for 30 days and then deleted automatically, so deleted data is gone from them within that window.

To access, correct, or delete your personal data, email support@meshie.ai and we’ll handle it. An owner can also delete a workspace and everything in it directly. If you’re in a jurisdiction that grants additional rights (for example, under GDPR or CCPA), contact us and we’ll honor them.

Meshie isn’t directed at, and we don’t knowingly collect data from, anyone under 16.

We may update this policy as the product changes. We’ll update the date at the top of this page when we do.

Questions about this policy, or a request regarding your data: support@meshie.ai.