Mesh Beta Privacy Notice

Version 0.3, revision 5 of 7 November 2026 (0.3-r5).

This notice exists in French, English and Polish. You receive it in the language you chose when you signed up. All three versions have the same value. If they differ, the version most favourable to you applies.

1. Who is responsible

Rome Studio OÜ, a private limited company incorporated under Estonian law (osaühing), is the controller of the data processed by Mesh.

• Registry code: 17249502 (Estonian Commercial Register); VAT EE102864940
• Address: Tartu mnt 67/1-13b, 10115 Tallinn, Estonia
• Contact for your data: [email protected]. You can write to us in French, English, Estonian or Polish. A reply in Estonian or Polish may be machine-translated.

Rome Studio OÜ has not appointed a data protection officer: the law does not require one for Mesh. For any question about your data, write to [email protected].

2. What we collect, why, and for how long

The legal basis "contract" means that the data is necessary to provide Mesh to you under the terms of use. "Legitimate interest" means that we need it to run the site securely, without this weighing on your rights.

Your email address, your name and your password are required to create an account. Your contact details are required to sell or buy. Everything else is optional.

Mesh takes no automated decision that produces legal effects concerning you or similarly significantly affects you. Recognising a card from a photo concerns only the card.

Your account

• Email address, name, password, language. To create your account, log you in and write to you. The password is stored as a hash, never in plain text. Basis: contract. Retention: as long as your account exists.
• Who invited you. For invitation-only access and to measure what each ambassador brings in. This link is not shown to any member. Basis: legitimate interest. Retention: as long as your account exists, then 3 years after its deletion (see section 4).
• The invitations you create. Their status and the member who used one. The code itself is stored only as a hash. Basis: contract. Retention: a link is valid for 14 days; the record is erased 12 months after the link is used or expires.
• Ambassador status. If the Mesh team gives it to you, you can create more invitations per day, from your first day. It is not shown to any member. Basis: contract. Retention: until the team removes it, or you delete your account.
• Login sessions, with your IP address and browser type. To keep you logged in and detect abnormal access. Basis: legitimate interest. Retention: erased 7 days after your last visit.
• IP address for rate limiting. To block attacks on login and sign-up. Kept in memory only, never written to disk. It is used only for the duration of the rate-limiting window (one hour at most) and is erased when the site restarts. Basis: legitimate interest.
• Sign-up slot. When you sign up, your email address is noted for a short moment, so that the site does not send more emails per day than planned. It is erased as soon as the verification email is ready to go. If sign-up is interrupted, it stops counting after 5 minutes and is erased at the next sign-up on the site. Basis: legitimate interest.
• Links sent by email. Verification link (2 hours), password reset link (1 hour), pending sign-up cookie (24 hours). Basis: contract.

Your profile

• Member type (professional or private individual), country, city, hand-over method, contact details. So that other members know who is selling, where, and how to reach you. Your member type, city and country are visible to all members on your listings. Your contact details are visible only to the other member of an accepted request, who keeps them afterwards. Your name and member type are visible to the seller as soon as you say "I want it". Basis: contract. Retention: as long as your account exists.
• Settings (showcase on or off, price display, theme). Basis: contract. Retention: as long as your account exists.

Your binder and your listings

• Copies in your binder. The card, its condition and its position. Private, unless you turn on your showcase, which shows no prices. Basis: contract. Retention: as long as your account exists.
• Listings. Card, condition, price, quantity, country, city, hand-over method. Visible to all members while they are online. Basis: contract, then legitimate interest once the listing has ended (keeping a record of the exchange for the other member). Retention: 3 years after the listing ends (withdrawn, sold or out of stock), then erased.
• Listing photos. One or two photos per listing. The site removes all metadata from the photo, including GPS location, before storing it. Basis: contract. Retention: erased 90 days after the listing ends, or immediately if you delete your account.
• Requests ("I want it"). The listing, the buyer, the quantity, the status of the request. Basis: contract, then legitimate interest once the request has ended. Retention: 3 years after the listing ends, then erased. If your account is deleted earlier, "Former member" is displayed.
• Wanted cards ("Je cherche", I'm looking for). The card you want and your criteria (minimum condition, maximum price, country). Basis: contract. Retention: until you delete it, or delete your account.
• Card missing from the catalogue. If your search does not find a card and you report it, Mesh keeps what you typed, the site language, the page you reported it from, the catalogue version, the status of the request and its date, in order to add the card to the catalogue and let you know when it is there. No other member sees these requests. They are in the "Download my data" file. Basis: contract. Retention: as long as your account exists.
• File import. The file is neither kept nor sent anywhere else. Mesh keeps only the column names and values you confirmed, in order to recognise the same format next time (50 at most). Basis: contract. Retention: as long as your account exists.
• Photo used to recognise a card. The photo is read in memory, stripped of its metadata, sent to our recognition service on the same server, then discarded. It is never written to disk or to a log. Nothing that identifies you accompanies it.
• Photo of several cards, read by an AI. When reading several cards is turned on and you use it, even for a single card, a copy of the photo and a crop of each card read are sent to Anthropic, which runs the Claude AI, to read the cards. Nothing that identifies you goes with them: not your name, not your account, not the photo's metadata. Anthropic is not allowed to train its models on these images. It erases them within 30 days, unless its automated safety system flags them, in which case it may keep them for up to 2 years. Mesh does not keep the photo. Only photograph your cards. Basis: contract.
• Series-addition token. A hash that prevents the same series from being added twice. Retention: 24 hours.

Your basket, orders, payment and shipments

• Basket. The cards you add with "Add to basket", with their quantity. Only you see it. Basis: contract. Retention: until you remove the card, place the order or delete your account. If the listing ends first, the card stays in your basket but can no longer be ordered, until you remove it or the listing is erased (3 years after it ends).
• Orders. The buyer, the seller, the cards and their quantity, the hand-over method chosen (shipping or hand delivery), the shipping fee, the total, the status of the order and its dates. Payment is made between the buyer and the seller, outside Mesh. Only the buyer and the seller of the order see it. The other member sees your name and, once the order is accepted, your contact details. Basis: contract, then legitimate interest once the order has ended. Retention: 3 years after the listing ends, like requests; an order for several cards is erased as soon as one of its listings ended 3 years ago.
• Payment. Mesh collects nothing and receives no payment data: payment is made between members, outside Mesh.
• Shipments. For an order handed over by shipping: the carrier and the tracking number, if given, and the dates on which the seller marked the shipment as sent, the buyer marked it as received or not received, and the reminder went out. Mesh keeps no postal address. Only the buyer and the seller of the order see them; Mesh's administration panel does not show them, and the server administrator, who has access to the whole database (section 3), can read them. Notifications and emails about an order never contain the tracking number. The tracking link opens the carrier's page directly in your browser: Mesh calls no carrier service, and the carrier then sees your IP address and the number. If the shipment is not marked as received, one reminder goes to the buyer, 7 days after dispatch within the same country, 14 days otherwise. Basis: contract, then legitimate interest once the shipment has ended. Retention: that of its order.
• Shipments and expected parcels. If you track in Mesh a parcel bought elsewhere (Cardmarket, eBay or another site), Mesh keeps the site, the carrier, the tracking number, your note if you write one, the date you added it and the date you marked it as received. Only you see these parcels. Mesh keeps no postal address and sends no email about them. The tracking link opens the carrier's page directly in your browser: Mesh calls no carrier service, and the carrier then sees your IP address and the number. Basis: contract. Retention: a received parcel is erased 6 months after you received it; a parcel not received stays until you delete it; all are erased if you delete your account.
• Your export. The "Download my data" file now contains your orders (lines, total, payment status, amount refunded), your shipments (carrier, number, link, dates) and your expected parcels (site, carrier, number, note, dates).

Your messages

• Messages. Each order has a message thread between the buyer and the seller, opened as soon as the order is placed. A message has a text of 2,000 characters at most and one photo at most. Mesh keeps the text, the photo, the author, the date and the message's number in the thread. Only the buyer and the seller of the order read the thread. Basis: contract, then legitimate interest once the order has ended. Retention: that of the order. The thread, its messages and their photos are erased with it, 3 years after the listing ends.
• Message photos. The site reduces the photo to 1,600 px and removes all its metadata, location included, before keeping it.
• Reading a reported thread. The Mesh team reads a thread only if one of its messages is reported. An administrator then reads the whole thread, to understand the message in its context, from a panel protected by two-factor authentication. Each reading is written to a log in which the site allows no line to be changed or erased. Basis: legitimate interest (handling reports and protecting members).
• No end-to-end encryption. Messages are not end-to-end encrypted: that would make it impossible to read a reported thread. The server administrator, who has access to the whole database (section 3), can therefore technically read them.
• Removed message. If the Mesh team removes a reported message, its author receives an email explaining why, and the other member reads "Message removed by the Mesh team". The text and the photo stay on our servers, without being shown, for as long as the order exists, so that the message can be restored after a challenge.
• "Seen" and unread messages. For each thread, Mesh keeps the number of the last message you read. Mesh uses it to count your unread messages, and the other member sees the last of their messages that you read ("Seen"). You cannot hide it in this version. Basis: contract. Retention: that of the thread.
• Message notices. A new message alerts you by a notification, or by an email if the notification fails. The notice gives the author's name and a link, never the text of the message. Several messages in a row make only one notice, until you read the thread again. Basis: contract. Retention: erased with its thread.
• Your export. The "Download my data" file contains your threads: for each message, yours as well as the other member's, its number in the thread, whether it comes from you or from the other member, its text, its date, and whether it had a photo. The photo itself is not in the file. A removed message appears without its text. The other member's name is not included.

Your help requests

• Help requests. If you write to the Mesh team from the help page, Mesh keeps your messages, our replies, their dates and their number in the thread. Only you and the Mesh team read this thread. An administrator reads it from the panel protected by two-factor authentication, and each reading is recorded in the log. The thread is not end-to-end encrypted: the server administrator, who has access to the whole database (section 3), can technically read it. When the team replies, an email lets you know, without the text of the reply or of your request. Basis: contract. Retention: 12 months after the last message in the thread; everything is erased if you delete your account.

Notifications and emails

• Notification subscription. If you turn notifications on, your browser gives us a delivery address and two keys. Basis: your consent, which you give by accepting your browser's prompt. Retention: until your browser's push service rejects it, or you delete your account.
• Alerts and request notices. The fact that an alert was sent, and when. Basis: contract. Retention: an alert is erased together with its wanted card or its listing; a request notice, together with its request.
• Email queue. The address and content of each email are encrypted in the database, then erased as soon as the email has been sent or has failed. A record remains for 30 days after sending, with your identifier, the type of email and the dates, then it is erased. Basis: contract.

Consign

Consign is a live-sales app, separate from Mesh, where cards kept in a vault (Collector Crypt or PSA) are sold as NFTs on the Solana blockchain. Consign is not open to all members. What follows applies only if Consign is open to you: otherwise, Mesh shows you nothing from Consign and creates no more Consign alerts for you. Consign alerts already created stay in your account, and in your "Download my data" file, until you delete their wanted card or your account; if Consign stays open to other members but no longer to you, they are erased within seconds.

• Consign offers. On a card's page, in search and in the Consign tab, Mesh shows the cards offered in Consign and their starting price. These offers come from public data on the Solana blockchain and contain no member data.
• The Consign tab. It opens the Consign app in a frame, served by our server at an address other than Mesh's. Mesh passes it only your theme and your language: not your name, not your email address, not your account. The purchase takes place in Consign, with your own wallet, outside Mesh: Mesh holds no key, signs nothing and keeps nothing about your purchase or your wallet.
• Consign alerts. If a card from one of your wanted cards appears in Consign, Mesh may let you know, as it does for a listing. For each alert, Mesh keeps the card, the offer (the NFT's public address), the starting price, the delivery status and its dates. The notice contains only the card's name, the starting price and "Availability to be confirmed live". The alerts are in the "Download my data" file, under each wanted card. Basis: contract. Retention: erased together with their wanted card or your account.

In your browser

• Cookies. A session cookie to keep you logged in, a pending sign-up cookie (24 hours), a language cookie and a theme cookie (1 year). All are necessary for the site. Mesh uses no audience measurement or advertising cookies, so it does not ask for your consent.
• Local storage. The series of cards being added and your last addition choice stay in your browser, not on our servers, until the addition is completed or you log out.

Mesh has no audience measurement or advertising tools.

3. Who receives your data

We do not sell any data. The following service providers process data on our behalf, under contract:

• Hetzner Online GmbH hosts the server, in the European Union (Nuremberg data centre, Germany, checked on 8 November 2026). It holds the database, the photos and the backups.
• Cloudflare, Inc. routes all of the site's traffic through its network. It sees your IP address, the pages requested and what they contain, messages included. As a US company, the transfer outside the EU relies on its certification under the EU–US Data Privacy Framework and, failing that, on the European Commission's standard contractual clauses (checked on 29 October 2026 in Cloudflare's privacy policy).
• Resend sends our emails. It receives your email address and the text of the email (link, alert, request, message or help notice). A message or help notice never contains the text of the message. As a US company, the transfer relies on the standard contractual clauses in its data processing agreement, which applies to every account, and on its Data Privacy Framework certification (checked on 29 October 2026 on Resend's GDPR page; to be checked again on dataprivacyframework.gov before going live).
• Anthropic, PBC reads photos of several cards with its Claude AI, when this reading is turned on (see section 2). US company: the images are stored in the United States and may be processed outside the European Union; the transfer relies on the European Commission's standard contractual clauses (module 2) in its data processing addendum.
• Consign, if Consign is open to you: its frame receives from Mesh only your theme and your language, and what you do in Consign (wallet, purchase) takes place outside Mesh (see section 2).
• Cloudflare R2 keeps a copy of our nightly backups, off the server, in the European Union, so that everything can be restored if the server is lost. Each copy is erased after 60 days. Same transfer basis as Cloudflare above.
• Your browser's push notification service, if you turn notifications on: Apple, Google, Mozilla or Microsoft, depending on your device. It receives an encrypted message that it cannot read, and the time of sending. Your browser chooses this service.
• TCGdex, which serves the card images. Your browser loads them directly from TCGdex, so TCGdex sees your IP address. Its servers are hosted by OVH, in France (checked on 29 October 2026).

• The carrier whose tracking link you open: your browser goes straight to it, without passing through Mesh.

You can obtain a copy of the safeguards governing transfers outside the EU by writing to us.

Other members see what section 2 describes as visible. The server administrator (Rome Studio OÜ) has access to the whole database.

4. When you delete your account

From your profile, using your password.

Erased immediately: your name, email address, password, sessions, profile and contact details, binder, wanted cards, notification subscriptions, listing photos, import memory, your invitations that are still open, your basket, your expected parcels, your help requests, your missing-card requests and your Consign alerts. Your online listings are withdrawn, your open requests cancelled and your open orders closed.

What remains, without your name or email address (except the last point):

• an empty account record, with your sign-up date, your language and who invited you, so that the people you invited keep their "invited by". It is erased 3 years after your account is deleted; the people you invited then keep only "invited by a former member";
• proof that you accepted the terms (the version, the language and the date of your acceptance), kept in that same empty account record for the same 3 years, so that we can answer a dispute about those terms;
• your past listings (card, price, country, without your city) and your past requests, so that the other member keeps a record of your exchange, for 3 years after the listing ends; they are then erased;
• your past orders and their shipments (cards, total, payment status, carrier and tracking number), so that the other member keeps a record of your exchange. The other member sees them signed "Former member". They are erased 3 years after the listing ends;
• your messages and their photos, so that the other member keeps a record of your exchange. They can still read them, signed "Former member". The thread is then closed to writing. They are erased with the order, 3 years after the listing ends;
• the email queue records, without address or content, for 30 days at most after sending.
• if the Mesh moderation team deletes your account: your email address and the text of the email that explains the measure and your options to contest it, kept apart for the time needed to deliver it to you, and erased as soon as it is delivered or after 30 days at most.

Contact details you gave to a member after an accepted request remain with that member, outside Mesh.

The server backups keep a copy of your data for 7 days at most, after which they are overwritten. Their off-server copy, at Cloudflare R2, is erased after 60 days.

An account with no login for 24 months is deleted. We notify you by email 30 days beforehand; simply logging in keeps it.

5. Your rights

At any time, you can:

• view and correct your profile, contact details and binder on the site. To change your name or email address, write to us;
• erase your account from your profile;
• receive a copy of your data (access), and receive it in a reusable format, such as a JSON file (portability): write to us;
• request restriction of processing;
• withdraw your consent to notifications, in your browser settings. This does not affect notifications already sent.

You can also object at any time to processing based on our legitimate interest (who invited you, sessions, IP address, past listings and requests, messages of an ended order, reading of a reported thread), on grounds relating to your particular situation. Write to us: we will stop, unless there are compelling grounds, which we will explain to you.

Write to [email protected]. We reply within one month. If your request is complex, this period may be extended by two months; we will tell you if so. We may ask you to prove that the account is yours.

If you are not satisfied with our reply, you can lodge a complaint with the data protection authority of the country where you live or work. The lead authority for Mesh is the Estonian one, because Rome Studio OÜ is established in Estonia.

• In Estonia: Andmekaitse Inspektsioon (Data Protection Inspectorate), Tatari 39, 10134 Tallinn, www.aki.ee.
• In France: the CNIL, www.cnil.fr.
• In Finland: Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman), www.tietosuoja.fi.
• In Poland: Urząd Ochrony Danych Osobowych (UODO, Personal Data Protection Office), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, www.uodo.gov.pl.

6. Security

Apart from login, sign-up, these texts and the Estonian summary, the site can only be opened with an account. Passwords are stored as hashes. Server secrets are kept outside the code. The content of queued emails is encrypted. No account data is sent to the recognition service.

In the event of a personal data breach that poses a risk to you, we will notify you.

7. Changes

We will notify you by email at least 15 days before a significant change to this notice, unless the law requires us to act faster or we need to counter fraud or a security vulnerability.