Privacy Policy

Optional social publishing

When a brand administrator connects a social account, MESH receives account or Page identifiers, display names, granted publishing access and encrypted authorization tokens. Discovered accounts remain inactive until the administrator explicitly assigns them to that brand or a location. Connecting accounts is optional and does not authorize a post.

After approval and scheduling, MESH sends the selected caption, photo or video, image description, destination link and visibility or disclosure choices to the selected service: Facebook, Instagram, Threads, Pinterest, LinkedIn, YouTube, TikTok or X. Each service processes the content under its own terms and privacy policy. Public posts can be viewed, copied and retained outside MESH. MESH does not import followers, private messages, contacts or advertising audiences through these connections.

Connection metadata, drafts, approvals and delivery references follow the business’s owner-controlled retention and legal holds. Disconnecting disables local access and deletes MESH’s current token; revoke its grant in the service’s account settings as well. Trash, cancellation or deletion inside MESH does not remove content already sent to a service. Recovery excludes social credentials, disconnects accounts and cancels unsent schedules. Failed or uncertain deliveries retain evidence for review.

For account-data access or deletion requests, contact support@creativeexit.com and identify the brand and connected service; do not send passwords or tokens. We verify the request and authority before acting, and review legal holds and retained delivery evidence. For YouTube, the YouTube Terms of Service and Google Privacy Policy apply; revoke authorized access at Google account permissions.

Privacy-request records and AI limits

The master administrator can keep private request case metadata: the requested right, status, business or store scope, opaque case/verification/decision references, operator identity and timestamps. These records follow owner-controlled business-record retention and are included in encrypted recovery bundles. Correspondence and identity evidence belong in the separately protected case file.

After independent verification, the administrator can prepare a limited internal inventory using an exact email address or stable user ID. Those selectors are transient and are not saved in the case, activity notes or URL. The inventory includes archived exact matches and omits credentials, authorization capabilities and record content. Private downloads can contain a single page or a bounded, completed selection of one record kind, with its case scope and selectors; protect and dispose of them separately. Concurrent edits can affect the inventory, and it is not a point-in-time backup or a complete requester disclosure package. A read-only deletion preview checks explicit records, versions, scope, holds and saved references without erasing them. Free text, images, email and provider records require additional review; closing a case does not erase records, send a response or release a legal hold.

Optional platform and per-person AI limits aggregate the existing usage records across workspaces by stable user identity. They supplement each business's limits and remain off until explicitly configured. Daily and hourly windows use UTC; uncertain calls keep their reserved cost. These app controls do not replace provider billing controls.

Information we collect

• Account and access information: the account identifier, email address, and any available name supplied through ChatGPT sign-in, plus business membership and permissions. We do not receive your ChatGPT password. The master administrator may enter an invitee’s email, role and location scope. We store a hash of the invitation code, its expiry, acceptance or revocation, and the accepting account identifier. The master may set different role restrictions for individual stores, within a member’s brand role and assigned locations.
• Workspace information: business names, cities, addresses, phone numbers, location email addresses, websites, direct and third-party ordering links, directory and social profile links, regular and date-specific special hours, descriptions, location records, tasks, drafts, planned content dates, review decisions, uploaded media, media categories, captions, and usage-permission information you provide. Brand settings include shared profiles, business descriptions, taglines, writing notes, and choices about which locations use shared or location-specific values. Optional store details include categories, geographic coordinates, menu and booking links, services, amenities, parking and accessibility attributes, phone-availability declarations and pending opening details. Full-record confirmations retain the confirming member’s email, date and record version.
• Activity records: changes, approvals, actor identifiers, dates, previous and revised task notes, and related workflow details. Usage counters help enforce service limits. Activity entries are protected from ordinary update or deletion; historical entries are distinguished from newly recorded successful actions. This does not mean every rejected attempt is retained. AI accounting records include the member identifier, time, model, token counts, reserved and accounted cost, and completion status. General request protection stores one current minute-window counter per account identifier. Older counters are removed in bounded batches after a day during later activity, so inactive installations may retain them longer. These counters are excluded from recovery files and do not record raw IP addresses. A single aggregate minute counter also limits anonymous pages and rejected unauthenticated requests; it contains no visitor identifier.
• Support information: details you send when asking for help or making a privacy or accessibility request. The contact form asks for your name, reply email, topic and message. It does not subscribe you to marketing or accept attachments.
• Technical information: our hosting, authentication, and security providers may process IP addresses, browser information, request logs, cookies, and similar data needed to deliver and protect the service.

We receive information from you, authorized workspace users, sign-in and service providers, and public business sources. The public preview uses bundled public-source examples; it does not expose your private workspace records.

How we use information

When an authorized approver chooses Google values as location defaults, MESH reads the matched profile and available attributes and action links. The selected values become retained business records, with before-and-after change history and an activity entry. Unselected preview values are not saved as a profile archive. Importing does not submit changes to Google or change another location. Imported records follow the workspace’s retention, legal-hold and backup rules.

We use information to authenticate users, manage permissions, operate location and listing workflows, store content, maintain change history, provide support, diagnose problems, prevent misuse, and meet applicable legal obligations. We do not use workspace content to run advertising campaigns for unrelated businesses.

Authorized business administrators can apply shared brand information to location records. We store the resulting values, local overrides, and change history. Brand reference content is available within its business workspace. Members assigned to specific locations can read shared brand profiles and reference content, and approved brand-wide logos and menu graphics. They cannot change shared content or access another location’s private records through this sharing. Saving brand information does not publish it to external platforms.

Who can receive information

Invitation codes are shown once to the administrator for private sharing; MESH does not email invitations. They expire after seven days and require sign-in with the invited email. Membership and invitation history remain after access is removed. Removing access does not erase earlier work or revoke permissions granted directly in Google or another service. Reports summarize the saved records available within the viewer’s access.

Workspace information is available to authorized members according to their permissions and to personnel and providers who need access to operate, protect, or support MESH. Avoid putting unrelated confidential or sensitive personal information into business records or uploads.

CREATIVE EXIT’s designated MESH master administrator can access all business workspaces to administer the service. Other members remain limited to their assigned businesses and locations, with the shared brand reference access described above. MESH’s Google connections remain separate for each business. Any direct Google agency access follows the permissions granted in Google.

• OpenAI Sites and ChatGPT: website hosting and the sign-in process.
• Cloudflare: hosting infrastructure, security, structured storage through D1, and private file storage through R2.
• Resend and our email providers: Resend transmits contact-form names, email addresses, topics and messages to our support inbox, or our accessibility inbox for accessibility requests. Our email providers store and process the resulting correspondence so we can respond. Resend also processes delivery metadata under its service practices.

We may disclose information when required by law, to protect legal rights or the security of the service, or as part of a business transaction subject to applicable safeguards. Third-party services have their own privacy practices. They may process information in countries other than yours.

Contact-form privacy

Form text stays in the current browser page until submitted or the page is closed; MESH does not save it in browser storage. MESH sends submitted messages through Resend without keeping a separate message inbox in its database or recovery bundles. Correspondence remains in our email systems as needed to handle the request and applicable recordkeeping obligations. You can contact us about access or deletion; provider-held copies follow their retention practices.

To limit abuse, MESH keeps aggregate sending counters and keyed hashes of sender addresses. The form does not store raw IP addresses in those counters. Counters older than two days are removed in bounded batches during later activity, so inactive installations may keep them longer. They are excluded from backups. Short-lived signed submission tokens help prevent accidental duplicate emails. No advertising tracker or marketing consent is added by using the form.

Connected accounts and AI features

AI requests are subject to brand spending and request limits and a per-person hourly limit. The master administrator can pause new requests. Accounting uses configured provider prices; uncertain requests retain their reserved cost. Operational AI request records older than seven days are removed in bounded batches during later requests, so inactive brands may retain them longer. These counters are excluded from recovery bundles; AI is paused after recovery.

Media originals remain private. MESH creates metadata-reduced display copies of images, checks supported file formats and limits image dimensions. JPEG and PNG images are decoded and re-saved; still WebP and MP4 receive container checks. This is not a malware-scanning or video-transcoding service. Unprocessed videos are downloaded as attachments.

OpenAI API drafting is available when configured by MESH’s master administrator. When an authorized editor requests a draft, MESH sends the entered topic and the selected approved location’s name, city, address, phone, website, hours, description and operating status to OpenAI. Do not enter unrelated sensitive information. Drafting is optional, uses no background generation, and requires human review; it does not publish content. Requests disable API response storage; OpenAI may still retain data under its applicable security and abuse monitoring practices. Google Business Profile connections are available with separate business consent.

Brand campaigns store post copy, selected locations, planning time zones, approvals and delivery results. Optional batch drafting sends the brief, brand writing notes and selected approved location facts to OpenAI. Design Studio stores editable layouts, private exported images and bounded revision history. Optional artwork generation sends the brief and saved brand/artwork notes; selected confirmed reference-image copies also go to OpenAI. Image requests use the provider’s image-endpoint retention practices. AI output never publishes itself.

When you approve and schedule a Google campaign, MESH sends the reviewed post, selected location identity, chosen button link and approved image to Google using that business’s authorization. Images are made fetchable through an unguessable delivery link for up to 24 hours; anyone holding that link can access the image during that period. Google may retain its own copy and display it publicly. Other media remain private. Campaigns, designs and delivery history follow workspace retention and recovery rules; recovery cancels unsent deliveries and requires fresh approval. No social-network connection, tracking cookie or background AI generation is introduced by these tools.

The master administrator may configure MESH’s platform API key. The setup screen reads only OPENAI_API_KEY from the selected local file; other file values are not uploaded. MESH validates the key with a small test request and stores it encrypted in private server storage. Keys are never returned through workspace screens, media downloads or recovery bundles. A replacement overwrites the prior stored key; revocation at the API provider remains a separate action.

MESH’s platform setup is managed by CREATIVE EXIT, LLC. An authorized workspace administrator chooses the business’s Google account and grants access separately. MESH sign-in and core workspace records do not require connecting a business’s Google account.

A business may separately authorize CREATIVE EXIT to manage selected Business Profiles through Google’s agency tools. Authorized agency personnel can view and manage those profiles within the role granted by the business. We use that access to carry out the business’s instructions and establish authorized service connections. This permission is controlled in Google, independently of MESH membership and any in-app Google connection. Ending MESH access or disconnecting an in-app connection does not remove the separate agency permission; a profile owner can remove that access in Google or contact us for help.

Supported browser assistants may access location details or create tasks only within an authorized workspace through MESH’s application tools. The public preview does not register those tools. Review requests from any browser assistant before authorizing it to act.

Cleared listing-change history remains in History Trash until restored or permanently deleted by the master administrator. A legal hold blocks permanent deletion. Deleting a history entry does not delete current business information or external listings. Separate security audit records remain, and existing backups expire under their retention schedule.

Artwork references and brand kits

Design Studio stores brand colors, a selected approved logo, a local font, owner-entered artwork facts and their review date. Editable layouts may include image references, positioning, alt text and up to 20 previous saved revisions. They remain subject to workspace permissions, owner-controlled retention, legal holds and existing backup expiry. Removing an original image can make an earlier layout’s preview unavailable.

When an authorized editor confirms AI generation, OpenAI receives the artwork brief, brand description, writing notes, tagline, artwork colors and approved facts. If the editor selects and confirms Media Library references, MESH sends up to three validated JPEG/PNG display copies to OpenAI’s image-editing endpoint. These copies are stripped of supported camera/location metadata during validation. MESH does not make the originals public or send other library items automatically. Do not select images of people or unrelated sensitive material unless you have an appropriate basis and rights to send them.

Image requests follow OpenAI’s applicable image-endpoint security and retention practices; the Responses API’s storage setting does not apply to them. Usage estimates reserve conservatively for image inputs and share the existing brand, person and platform limits. Uncertain provider failures retain a reservation. Reference identifiers, mode, format and requesting actor are recorded in the internal activity log; image bytes and API keys are not logged. AI edits may change product details and require human review. Local resizing, ZIP exports, crop guides and copy/color checks do not themselves call an AI provider. Attaching artwork to a draft calendar plan does not publish it.

Cookies, advertising, and browser signals

MESH has not added third-party analytics or advertising trackers. We do not sell personal information or share it for cross-context behavioral advertising. Optional layout storage is off by default and can be controlled in Cookie Settings. Sign-in and security providers may use necessary cookies.

MESH does not track your activity across unrelated websites for advertising. Do Not Track and Global Privacy Control signals do not activate any tracking in MESH; there is currently no sale or advertising-sharing activity to opt out of. Cookie settings can display a Global Privacy Control signal when your browser exposes it. If our practices change, we will update these disclosures and implement any required opt-out controls before that change.

Storage, security, and retention

We use HTTPS and server-side workspace permissions to protect access to information. Uploaded originals are stored separately from public website content. Security measures reduce risk but cannot guarantee absolute security.

Business-record retention is owner-controlled. Stored records, drafts, uploads, and activity history remain until explicitly removed through available controls or handled by an administrator, subject to operational and legal requirements. We assess retention and deletion requests based on the type of information, your authority, business needs, legal obligations, and technical limitations. Infrastructure copies and logs may follow provider retention practices. Account removal does not by itself erase business records, and self-service account deletion is not currently available.

The master administrator can apply a brand-wide legal hold that blocks permanent deletion of business records and original files. We record the hold time, administrator identifier, brief reason or case reference, and release history. A hold does not freeze edits or extend automatic backup retention; historical evidence must be preserved separately when necessary. Requests to delete personal information are reviewed separately from routine business-record retention and may require targeted administrative processing and provider coordination.

Archiving a draft keeps its content available for restoration; it does not delete it. Authorized business administrators can download workspace records and media details. Original media files are downloaded separately, and credentials are excluded from these exports.

Media, editable designs, campaigns, individual drafts and action items can be moved to Trash and restored by authorized editors within their assigned scope. Trashing a campaign cancels unsent posts; restoring it requires a new review and schedule. Restored media requires approval again. Only the master administrator can permanently delete these trashed items, after confirmation. Media deletion removes its private original and preview; deletion cannot finish while saved work or protected delivery records still reference the image. Incomplete file deletions remain locked in Trash for retry. Activity and publication history, earlier backups and external published copies remain under their existing retention rules. There is no automatic permanent purge. Exported images and editable layouts are separate records.

Deleting a brand or location moves it to recoverable Deleted items; it does not permanently erase its records, original files, or history. Deleted brands and their locations are hidden from normal workspaces. A brand deletion pauses publishing and removes its stored MESH Google credentials; permissions granted directly in Google remain separate. There is no automatic permanent purge. Contact support for an erasure request. Authorized administrators can restore eligible records.

Listing imports process the file you select to preview new records and duplicates. Import previews are stored for up to ten minutes of use; applied preview contents are cleared, while unused expired previews are removed on a later import or brand deletion. Imported locations remain unconfirmed. Listing exports include saved business details; workspace record exports also include recoverable deleted records. Exports exclude credentials and original media files. Separate daily recovery backups are available after platform storage activation and configuration; the master administrator can see their actual status in Settings.

The master administrator can download a manual recovery bundle across all brands, including recoverable deleted data, memberships, audit history and verified original files. It excludes platform API keys, Google tokens and transient authorization/import/submission state. Recovery pauses publishing, revokes pending invitations and requires reconnection and a review of membership changes. Downloads contain private information and must be stored securely by the operator. Manual bundles do not establish a proven production recovery service. An isolated local restoration can check file integrity and data relationships without replacing live records.

When enabled, daily backups copy these records and original files to a separate private Cloudflare R2 bucket controlled by CREATIVE EXIT. The backup service uses a dedicated credential, encrypted in private storage and excluded from exports. It records run times, completion or failure, file counts and integrity checksums. Access to settings and recovery downloads is restricted to the MESH master administrator. New recovery files use authenticated encryption with an operator-held private recovery key required for restoration. Earlier recovery files may use the previous unencrypted bundle format within private storage. The private recovery key is not included in backups; loss of it prevents recovery of encrypted copies. Display copies can be regenerated from originals.

Backup retention defaults to 30 days and can be set to 14 or 90 days. Expired copies and run history are removed by scheduled maintenance; the newest successful copy is retained until a replacement succeeds. Deletion of a live record does not immediately erase earlier backup copies. Failed maintenance can delay removal. Contact support about erasure requests. Downloaded copies remain under the operator’s control. Backup status is shown in Settings; this feature does not send automatic emails or add visitor tracking.

Your choices and privacy requests

Contact support@creativeexit.com to request access to, correction of, export of, or deletion of your information, or to ask about privacy practices. We may need to verify your identity, business authority, and the scope of the request. Please do not send passwords or identity documents in your first message.

Depending on applicable law and our role in handling your information, you may have additional rights, including information about collection and disclosure, limiting or objecting to certain processing, and making requests through an authorized agent. Legal exceptions may apply. We will not unlawfully discriminate against you for exercising privacy rights. If another business controls the workspace information you are asking about, we may direct or coordinate your request with that business.

Children

MESH is intended for business use and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact support if you believe a child has provided information so we can review and address it.

Changes to this policy

We review these disclosures as features and data practices change. Updated text and the effective date will appear here. We will display a notice in MESH for material changes and provide additional notice or obtain consent where required. The review date does not represent an independent legal or security certification.

Optional artwork prompt drafting sends your written idea, brand writing notes and artwork facts, chosen format/edit mode, whether references will be used, and the selected location’s name and city to OpenAI’s text model. It does not send reference-image bytes or private media filenames. The returned prompt is editable in the current page and is not saved as prompt history in MESH. We request that this text response not be stored as a retrievable OpenAI response; the provider’s separate security/retention terms still apply. Usage counters and an activity entry record the action without prompt contents. Creating an image requires a separate action and uses the prompt you choose, with reference-image confirmation when applicable.

Contact us

MESH by CREATIVE EXIT, LLC
support@creativeexit.com