Privacy Policy

1. Who is responsible for your data

Road Mesh (“Road Mesh,” “we,” “us,” or “our”), based in Iceland, is the controller of personal data used to operate the Road Mesh website, accounts, licensing, and services. You can contact us at support@roadmesh.app.

This policy covers the Road Mesh website, browser application, cloud projects, team workspaces, support, and licensing services (collectively, the “Service”). It does not govern third-party websites or services that publish their own privacy notices.

2. Customer Content and business customers

A business or organization may put personal data into a road model, imported file, project note, analysis, shared library, or other Customer Content. For that data, the business customer normally decides why and how it is processed and acts as controller; Road Mesh processes it to provide the Service on the customer’s behalf.

If your data was supplied to Road Mesh by your employer or another customer, direct your request to that organization first. We will assist it as required. Business customers that need data-processing terms can contact us at sales@roadmesh.app.

3. Personal data we process

Depending on the features you use, we process:

• Account and identity data: email address, display name, account identifier, authentication provider, account dates, session information, and your intended or current plan. Passwords and authentication credentials are handled by our authentication provider and are not visible to Road Mesh in plain text.
• Cloud project data: project names, road networks, imported source material, simulation settings and results, versions, thumbnails, file metadata, storage size, and other content you choose to upload or save. Imported content may contain personal data if you include it.
• Workspace and sharing data: organization names, membership, roles, invitations, share links, project permissions, and shared mapping presets or driver and vehicle profiles.
• License and billing data: selected plan, billing interval, subscription status and dates, licensed seat count, product and customer identifiers supplied by Polar, and the time and version of the Terms you accepted. Polar separately handles payment-card details, billing addresses, tax information, invoices, refunds, and payment disputes.
• Technical data: IP address, browser and device information, request timestamps, authentication events, and operational, error, and security logs that our hosting and service providers generate when you use the Service.
• Communications: your contact details and the content of sales, support, privacy, or other messages you send us.

Road Mesh is not designed to collect special-category or highly sensitive personal data. Do not place such data in Customer Content unless you have a lawful basis, suitable safeguards, and an agreement with us that supports that use.

4. Where the data comes from

We receive personal data:

• directly from you when you register, save content, purchase, or contact us;
• from your organization when it invites you, assigns a role, or manages a workspace;
• from Google if you choose Google sign-in;
• from Polar when you begin or manage a paid subscription; and
• automatically from your browser, device, and requests to the Service.

5. Why we process data and our legal bases

• To provide the Service and perform our contract: create and secure accounts, authenticate users, save and share cloud projects, operate workspaces, apply plan entitlements, process license purchases, and provide requested support.
• For our legitimate interests: protect the Service and users, prevent abuse and fraud, troubleshoot errors, maintain reliability, understand capacity needs, improve relevant features, enforce our Terms, and establish or defend legal claims. We balance these interests against your rights and expectations.
• To comply with legal obligations: respond to valid legal requests and meet applicable tax, accounting, consumer, security, and data-protection duties.
• With consent where required: for an optional use that the law requires us to base on consent. You may withdraw that consent at any time without affecting earlier lawful processing.

We do not use consent as the legal basis merely because you read this policy. The Privacy Policy is a notice, not a contract or a blanket consent form.

6. Local processing, browser storage, and cookies

You can create and edit local projects without an account. Local project content, saved simulation runs, preferences, mapping presets, profile libraries, and interface state may be stored in files you control or in your browser’s local storage, session storage, or IndexedDB. This information stays under your device and browser controls unless you choose a cloud, sharing, or external data feature.

Road Mesh does not currently set advertising cookies or use third-party behavioral advertising or marketing analytics on the Service. Necessary browser storage is used to keep you signed in and preserve settings. Google, Polar, and other websites you choose to visit may use cookies under their own notices. If we introduce non-essential cookies or similar tracking that requires consent, we will provide an appropriate choice before using it.

7. Maps, searches, and public data services

Road Mesh can request map tiles, satellite imagery, place searches, OpenStreetMap/Overpass road data, and public traffic-counter data. Depending on the feature and configuration, the request may be sent from your browser or through a Road Mesh proxy. A direct provider may receive your IP address, browser request data, and the map tile, search term, or geographic area requested.

Providers may include the OpenStreetMap Foundation and Overpass operators, Esri and its imagery partners, and national or local transport-data publishers. Their own terms and privacy notices apply to direct requests. See the OpenStreetMap Foundation privacy policy.

8. Who receives personal data

We disclose data only as needed for the purposes described above:

• Supabase: authentication, database, private cloud storage, and server functions. See the Supabase privacy policy.
• Vercel: website and API hosting, delivery, and operational logs. See the Vercel privacy notice.
• Polar Software, Inc.: merchant of record for paid purchases, subscriptions, invoices, tax, refunds, and payment disputes. Polar acts under its own responsibilities for checkout data. See the Polar privacy policy.
• Google: only when you choose Google sign-in. See the Google privacy policy.
• Other users: project owners, workspace owners and administrators, members, and people you authorize through sharing features can see the account, role, and project information needed for that collaboration.
• Professional advisers and authorities: where reasonably necessary for legal advice, audits, security, compliance, or a valid legal requirement.
• A successor: if Road Mesh is involved in a genuine merger, financing, reorganization, or sale, subject to appropriate confidentiality and notice where required.

Service providers may use approved subprocessors to deliver their services. We do not authorize processors to use Road Mesh customer data for their own advertising.

9. International data transfers

Road Mesh is based in Iceland, within the European Economic Area (EEA). Some providers or their subprocessors operate in countries outside Iceland or the EEA, including the United States. Where a transfer requires a safeguard, we rely on an applicable adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary measures where appropriate.

You may contact us for more information about safeguards relevant to your data.

10. How long we keep data

Retention depends on why the information is held:

• Local browser data remains until you remove it, clear the relevant browser storage, or remove that browser profile.
• Account, profile, membership, and cloud project data is generally kept while your account or workspace is active, until you delete the data, or until the Service no longer needs it for the purpose for which it was collected.
• Deleted data may remain temporarily in restricted backups or provider recovery systems until their normal backup cycle expires.
• Terms-acceptance evidence, subscription records, communications, and dispute records are kept for the period reasonably necessary to administer the contract and meet applicable audit, accounting, tax, and legal-claims requirements.
• Technical and security logs are kept for the operational period needed to secure, investigate, and maintain the Service, subject to provider settings and any required legal hold.

We use these purpose, legal-duty, security, and limitation-period criteria to set or review retention. When personal data is no longer needed, we delete it or anonymize it.

11. Security

We use technical and organizational measures designed to protect personal data, including encrypted transport, authenticated access, private cloud storage, role-based permissions, database row-level access controls, restricted administrative access, and service credential management. No internet service is completely secure, so we cannot guarantee absolute security.

Protect your sign-in credentials, use appropriate sharing settings, and notify us promptly if you suspect unauthorized access.

12. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• receive information about how your personal data is used;
• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• request deletion of your personal data;
• restrict certain processing;
• receive data you provided in a portable, machine-readable format;
• object to processing based on legitimate interests or direct marketing;
• withdraw consent where processing relies on consent; and
• complain to a supervisory authority.

You can update basic account information and request account deletion through available account controls. For other requests, email support@roadmesh.app. We may need to verify your identity and clarify the scope of your request. If Road Mesh holds data only for a business customer, we may refer the request to that customer.

You may lodge a complaint with Iceland’s supervisory authority, Persónuvernd, or with the competent authority where you live or work in the EEA.

13. Automated decisions

Road Mesh does not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects. Automatic entitlement and quota checks apply the plan, workspace role, and subscription status associated with your account; contact us if you believe one was applied incorrectly.

14. Children

Road Mesh is intended for professionals and organizations and is not directed to children. We do not knowingly collect personal data from a child who cannot lawfully provide it. Contact us if you believe a child has provided personal data without appropriate authorization.

15. Changes to this policy

We may update this policy when the Service, our providers, or legal requirements change. We will publish the current version and date on this page and provide additional notice of a material change where required. An update does not reduce rights that applicable law gives you.