Privacy Policy

This Privacy Policy describes how Fiesta Labs Inc. collects, uses, and protects the personal information of users of Mesh API.

By using Mesh API and its features, you agree to the collection and use of your data as outlined in this policy. We rely on different legal bases depending on the type of processing. See Section 5 for details.

Zero Data Retention (ZDR) is enabled by default on every Mesh API account.

• Your content is not stored. With ZDR on, prompt and completion content passes through the gateway in memory and is never written to our logs or databases.
• We never train on your data. We do not use your prompts, completions, files, or embeddings to train, fine-tune, or evaluate any model, ours or anyone else's.
• We never sell or share it. Your content is not sold, rented, or shared for advertising or marketing, or for any purpose other than fulfilling your request.
• Only billing metadata is kept. Model name, token counts, latency, cost, and a request ID are recorded so you can audit usage and we can invoice accurately. This metadata contains no prompt or completion text.
• If you turn ZDR off. Some teams disable ZDR to get request-level debugging and context. In that case prompt and completion content and related context may be retained for up to 90 days, and longer only where law or a signed contract requires it. The no-training and no-selling commitments still apply.
• Third-party providers. To answer a request we must transmit it to the model provider you selected. That provider's own terms and retention practices apply to the content it receives.

Zero Data Retention is the default, but certain Mesh API features cannot work without keeping some of your content or context for the lifetime of the feature. Examples include:

• RAG and knowledge bases. If you upload documents or enable retrieval-augmented generation, we must store those documents or their embeddings so the model can retrieve from them on later requests.
• Memory and conversation context. If you use a memory or persistent-context feature, we keep the relevant conversation history or context so the assistant can maintain continuity across turns.
• File and embedding storage. Files, vectors, or indexes you explicitly ask us to host are stored only as long as the feature is active.

Storage for these features is operational, not for training or marketing. We do not use content stored for RAG, memory, or file hosting to train, fine-tune, or evaluate any model, and we do not sell or share it for advertising. The exact features that require storage may change as the product evolves; the dashboard or API will flag them when they are enabled.

If you want complete privacy and do not want any content retained beyond the immediate request, do not use these features, or contact us at [email protected] to discuss an enterprise arrangement tailored to your retention needs.

Account and platform data

• Account information: Name, email, organization, billing information.
• Payment details: Processed securely through TagMango Inc (outside India) or TagMango Pvt Ltd (India).
• Usage metadata: Model used, token counts, latency, cost, request IDs, and error codes.
• Technical data: IP address, browser type, device information.

Request content

Prompts, completions, files, and embeddings you send through the gateway are treated as your content, not ours. With Zero Data Retention on by default, this content is processed in memory to fulfil your request and is not retained. It is only retained if you explicitly disable ZDR for your account, or if you use a feature described in section 3 that inherently requires storage, as described in section 8.

Source of data. Most of the information above is collected directly from you, when you create an account, use the API, or interact with our website. Where you visit our website, our analytics or marketing vendors (see Section 9a) may associate that activity with other personal information they independently hold about you, such as by matching your email address.

We use account, billing, and usage metadata to:

• Provide, route, and maintain the gateway service.
• Meter usage, process payments, and issue invoices.
• Detect abuse, enforce rate limits, and keep the platform secure.
• Communicate important service updates (and offers, where permitted).
• Improve reliability and performance using aggregate metadata only.

We do not use your prompts, completions, files, or embeddings to train, fine-tune, or evaluate any model, and we do not use them to build products or profiles.

Lawful basis for processing. We process your data on the following legal bases: performance of our contract with you (service delivery, billing, invoicing); our legitimate interests (fraud prevention, rate limiting, platform security, service reliability); legal obligation (tax and financial record-keeping); and your consent (marketing communications and non-essential cookies, see Section 9a).

Automated decision-making. We do not use your personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

We may share limited data with:

• Payment processors (TagMango Inc / TagMango Pvt Ltd) for transaction fulfillment.
• The third-party AI provider you selected, solely to generate a response to that request. That provider's own terms and retention practices then apply to the content it receives.
• Service providers helping us operate the platform, under confidentiality obligations and on a least-privilege basis.

We do not sell your personal data, and we do not sell, rent, or share your request content for advertising or marketing.

We implement encryption in transit and at rest, least-privilege access controls with multi-factor authentication, and audit logging. However, no system is 100% secure.

• Request content, ZDR on (default): not retained. It exists only in memory for the lifetime of the request.
• Request content, ZDR disabled by you: prompt and completion content and related context may be retained for up to 90 days, and longer only where law or a signed contract requires it. The no-training and no-selling commitments still apply.
• Feature-required storage: if you use features described in section 3 (such as RAG or memory), the content or context needed for those features is retained only as long as the feature is active, and only for operational purposes.
• Usage metadata: retained as long as needed for billing, dispute resolution, and legal or tax obligations.
• Account data: retained while your account is active, then deleted or anonymized unless we are legally required to keep it.

Wherever you are located, you can exercise the following rights over the personal data we hold about you:

• Access. Obtain a copy of the personal data we hold about you and information about how it is processed.
• Rectification. Have inaccurate or incomplete data corrected.
• Erasure. Request deletion of your personal data, subject to legal, tax, and contractual retention obligations.
• Restriction. Ask us to limit processing while a request or objection is being resolved.
• Portability. Receive your data in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible.
• Objection. Object to processing based on our legitimate interests, including direct marketing. If you object to direct marketing, we stop.
• Withdraw consent. Where processing is based on consent, you may withdraw that consent at any time, and it must be as easy to withdraw as it was to give. Withdrawal does not affect the lawfulness of processing carried out before you withdrew. You can withdraw marketing consent by using the unsubscribe link in any email or by emailing us, and cookie consent through the Cookies Policy page or the "Cookie preferences" link in the site footer.
• Automated decisions. Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.
• Complain. Lodge a complaint with your local supervisory or data protection authority.

To exercise any of these rights, email [email protected] with the subject line "Privacy Request." We may need to verify your identity before responding.

Response timelines. Under the GDPR, we respond within one month of receiving your request; this may be extended by a further two months where necessary, taking into account the complexity and number of requests. If an extension is needed, we will notify you within the first month and explain why. Under the CCPA, we respond within 45 days; this may be extended by a further 45 days (90 days total) where reasonably necessary, with notice and the reason provided within the initial 45-day period.

Exercising these rights is free of charge and we will not discriminate against you for doing so.

Optional analytics and marketing cookies on our website are set only after you consent, and you can change or withdraw that choice at any time. See our Cookies Policy for the full list and controls.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

Bot protection. We use Cloudflare Turnstile to protect sign-in, checkout and our docs assistant from automated abuse. Turnstile checks information about your browser and device to tell people from bots, sometimes without showing you anything. Cloudflare's handling of that information is described in the Cloudflare Turnstile Privacy Addendum.

Mesh API is not directed towards children under the minimum digital consent age in their country (13 in the US; 16 in the EU unless lowered by law).

By using this platform, you confirm that you meet the legal minimum age in your jurisdiction or have obtained verifiable parental consent.

We do not knowingly collect personal data from children under these ages without consent. If we discover that such data has been provided, we will delete it promptly.

AI responses may contain third-party information. We are not responsible for the accuracy or legality of third-party outputs.

We may update this policy from time to time. Continued use of Mesh API after updates means you accept the revised policy.