Version 1.0 · effective 23 October 2026

Privacy Policy

This Policy explains what data the Mesh-Sync service ("Mesh-Sync", "the Service", "we") processes when you use mesh-sync.ru, the workspace console, the msync agent and the API at api.mesh-sync.ru, why we process it and how it is protected. It is prepared in accordance with Russian Federal Law No. 152-FZ "On Personal Data". If the Russian version differs from this translation, the Russian version prevails.

01Controller and contacts

The Service acts as the personal data operator. The operator's full legal details are stated in the agreement with your organisation. For privacy questions, write to privacy@mesh-sync.ru.

02We cannot access the contents of your caches

Geometry, meshes, point clouds, textures and other files you transfer through the Service ("Customer Content") are encrypted with AES-256-GCM on your machines before they are sent. Project keys are created and stored inside your perimeter (or in your HSM on the Enterprise plan). Edge nodes and control servers store and move ciphertext only and cannot decrypt, view, index or analyse it.

03Data we process

• Account data: name, work email, role and workspace membership of users invited by the customer's administrator.
• Technical metadata: agent IDs and IP addresses, software versions, file paths and sizes, chunk hashes, transfer times, routes and statuses.
• Authentication data: password hashes (Argon2id), token IDs and scopes, agent certificate fingerprints. Plain-text passwords and tokens are never stored.
• Website requests: name, studio, email, phone and comment you enter in the access request form.
• Web server logs: IP address, user agent, requested URL and time. The website uses no advertising or third-party analytics cookies.

04Purposes

• concluding and performing the agreement with your organisation and providing the Service;
• routing, integrity checks and resumption of transfers, keeping the audit log;
• security, preventing unauthorised access and investigating incidents;
• responding to requests and sending service notices;
• complying with the laws of the Russian Federation.

We do not sell personal data or use it for advertising.

05Legal grounds

We process data to conclude and perform an agreement to which your organisation is a party, on the basis of the data subject's consent (for example, when you submit a request on the website), and to meet obligations imposed on the operator by law.

06Localisation and retention

Personal data of Russian citizens is recorded, organised, accumulated, stored, updated and retrieved using databases located in the Russian Federation. Retention periods:

• transfer metadata — 13 months unless the agreement states otherwise;
• audit log — for the term of the agreement and 3 years after;
• accounts — until the workspace is closed, then deleted within 30 days;
• website requests — 12 months if no agreement was signed;
• web server logs — 30 days.

07Sharing

We only use infrastructure providers (data centres, network operators) bound by confidentiality obligations and share the minimum data they need. Information may also be disclosed upon a lawful request from authorised bodies. No cross-border transfer of personal data takes place unless agreed with the customer in the contract.

08Security

End-to-end content encryption, TLS 1.3 and mTLS for agents, least-privilege staff access, a signed append-only audit log, encrypted metadata backups and regular external penetration testing. Report vulnerabilities to security@mesh-sync.ru.

09Your rights

You may request information about the processing of your data, ask for it to be corrected, blocked or deleted, and withdraw consent. Where we process data on behalf of your organisation, we forward the request to its administrator and help them respond. We reply within 10 business days. You may also contact Roskomnadzor.

10Changes

New versions are published on this page with an effective date. We notify workspace administrators of material changes at least 14 days in advance.