KardMesh LogoKardMesh
PricingBack to studio

Privacy Policy

How we collect, use, and protect your personal data in compliance with the GDPR (EU Regulation 2016/679).

Last updated November 11, 2026

At a glance

We only collect the minimum data required to operate KardMesh. We never use your uploaded images to train AI models, we never store your payment card numbers, and we do not use third-party advertising or tracking cookies.

1. Data Controller & Contact

This Privacy Policy explains how personal data is collected and processed when you use kardmesh.com, our API (api.kardmesh.com), and official KardMesh addons. For any privacy inquiries or GDPR data subject requests, contact us at: support@kardmesh.com.

2. Data We Collect and Purpose of Processing

  • Account & Authentication Data: When you sign in via Magic Link, we store your email address, account ID, session records, and credit ledger in Cloudflare D1. Magic link tokens and addon API keys are stored strictly as SHA-256 cryptographic hashes. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
  • Uploaded Images & Generated 3D Files: 2D character images and generated 3D ZIP archives (.OBJ, .GLB, .VRM) are processed ephemerally in isolated temporary directories on our GPU workers solely to complete your generation job. They are not permanently stored and are never used to train AI models. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
  • Guest Trial & Anti-Abuse Data: To prevent automated abuse of the unregistered free trial, we use Cloudflare Turnstile, a local guest token (kardmesh-guest-token), and a salted SHA-256 hash of the IP address (raw IP addresses are not stored in guest trial records). Legal basis: legitimate interest in security and fraud prevention (GDPR Art. 6(1)(f)).
  • Payment & Billing Data (Paddle.com): All orders and payments are processed by Paddle.com as our Merchant of Record. KardMesh never receives or stores your credit card or bank details; we only receive webhook identifiers (customer_id, subscription_id, transaction_id), plan status, and email to provision your credits. Legal basis: performance of a contract and legal/tax compliance (GDPR Art. 6(1)(b) and 6(1)(c)).

3. Cookies & Local Storage

KardMesh uses only strictly necessary technical cookies and browser storage:

  • Authentication Session Cookies: To keep you signed in securely.
  • Browser Storage (localStorage / sessionStorage): To store your guest trial token and recover active generation jobs if you refresh the page.
  • Security & Checkout (Turnstile & Paddle): Essential cookies required for bot verification and Paddle checkout.

4. Sub-Processors

  • Cloudflare, Inc. — Web/API Worker hosting, D1 database, and Turnstile bot protection.
  • Modal Labs, Inc. — Serverless GPU workers for ephemeral 3D inference.
  • Paddle.com Market Limited — Merchant of Record, billing, subscriptions, and tax compliance.
  • Resend, Inc. — Transactional email delivery for login magic links.

5. Your GDPR Rights

Under the GDPR, you have the right to access, rectify, erase (delete your account), restrict, or export your personal data at any time. To exercise these rights, email us at support@kardmesh.com.