Privacy policy

1. Who is responsible

Trivomesh Limited, a private limited company registered in the United Kingdom and incorporated on 8 September 2026, company number 17446722, is the operator and data controller for Mesh & Moss. This policy describes the shop’s handling of personal data under applicable UK data protection law and, where applicable, the EU GDPR. It covers the website, checkout, customer library, and related communications of our direct digital shop. We sell downloadable files only, so checkout asks for your email address and your billing country, but not a street, postal, or delivery address.

Our registered office is 61 Bridge Street, Kington, England, HR5 3DJ. You can write to us at this address about your personal data and verify our company details on Companies House.

Data protection contact: for privacy enquiries, to exercise any of your rights, or about this policy, email [email protected] or write to us at our registered office. We act as controller under the UK GDPR and, where it applies, the EU GDPR.

2. Data we collect

• Purchase information: your email address, billing country, cart contents, purchased assets, prices, order references, and payment status.
• Account and access information: your customer identifier, email verification records, sign-in and session records, password hash if you choose password access, and library and download access records.
• Transaction evidence: the terms, license, and immediate-delivery request you accepted with an order, their versions and timestamps, and the billing country you declared. We do not check your billing country against your network location. Network and browser identifiers stored with this evidence are kept only as keyed one-way hashes.
• Technical information: IP address, browser and device information, request times, security events, and error information generated when our systems receive your requests.
• Withdrawal declarations: if you use the online withdrawal function, the name, contract or order description, and receipt email address you enter, the text of your declaration, the date and time you submitted it, its receipt reference, and whether our acknowledgement and internal notice were accepted for sending. The receipt email address is stored encrypted. To limit abuse, the function also keeps keyed one-way hashes of that email address and of your network address for 24 hours.
• Communications: information you send when asking for help, together with transactional email delivery information.

We receive data from you, from your interaction with the shop, and from payment and delivery providers involved in your order. Payment is completed on the payment provider’s own page; our shop does not ask you to send card details by email and does not receive or store full card numbers or card security codes.

3. Why we use it and our legal basis

We use personal data only for these purposes, each with its legal basis under Article 6(1) of the UK GDPR and, where it applies, the EU GDPR:

• Performance of a contract (Article 6(1)(b)): to manage your cart, process orders, deliver files and confirmations, provide account and library access, and respond to purchase-related support requests.
• Legal obligation (Article 6(1)(c)): to keep accounting records, receive and acknowledge withdrawal declarations, handle withdrawals, refunds, and statutory remedies, and respond to legally binding requests.
• Legitimate interests (Article 6(1)(f)): to protect the shop and our customers against fraud and misuse, limit abuse of forms, diagnose failures, maintain reliable service, and establish or defend legal claims. We balance these interests against your rights and expectations, and you may object as section 7 explains.
• Consent (Article 6(1)(a)), where required: any optional marketing or non-essential tracking introduced in the future would require its own information and, where applicable, a separate choice. Buying an asset is not consent to receive marketing.

The emails we send are order confirmations, library access, sign-in messages, and acknowledgements of withdrawal declarations needed for your purchase and your rights. The shop does not currently send marketing email. Without the information needed to process payment, meet our legal obligations, or verify access, we may be unable to complete a purchase or provide your library. Setting a password is optional; email sign-in remains available.

4. Cookies and fonts

The storefront uses only cookies that are strictly necessary for the shop to work: cart continuity, sign-in, checkout and form security, payment status, and access to a recent order. It does not use advertising, analytics, or social media cookies. Our cookie policy lists each cookie, its purpose, and how long it lasts.

The fonts used by the storefront are served from our own website. Your browser does not contact a third-party font service when you visit the shop.

5. Who receives data

Access is limited to people and service providers who need the information for their role. We do not sell personal data. Our service providers are:

• Cloudflare: network security, DNS, content delivery, and storage of product files and encrypted backups in storage located in the European Union.
• HOSTKEY: hosting of the server that runs the shop, in the Netherlands.
• Mailgun (EU region): sending order, library, sign-in, and withdrawal acknowledgement emails.
• Our payment provider: processing your payment on its own page, fraud prevention, and its own legal duties.

We may also share data with professional advisers and with authorities where disclosure is legally required. Payment providers may act as independent controllers for payment processing, fraud prevention, and their own legal duties; their notices apply to those activities. Our processors must handle data under our instructions and appropriate contractual protections.

Some providers may process data outside the UK or the European Economic Area. Where this is a restricted transfer, an applicable adequacy decision or other lawful safeguard is required, such as EU standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, and additional measures where necessary. You may request information about the applicable safeguards and a copy of them.

6. Retention periods

We keep personal data only as long as its purpose requires, and for any longer retention period the law sets. Order, license, and library records are needed to administer your purchase and continued access for as long as the purchase remains active. Accounting records, including the checkout evidence above, are kept for the relevant statutory period.

• Sign-in links are deleted by an automatic hourly job once 24 hours have passed since they expired, were used, or were replaced. Sign-in rate-limit records are deleted the same way 24 hours after they are created.
• Rate-limit records from the withdrawal function are deleted by an automatic job 24 hours after they are created. The withdrawal declaration itself is kept with the related order and accounting records as evidence of when you withdrew and how we handled it.
• Encrypted database backups are deleted automatically 7 days after they are created.
• Checkout records that did not become an order, download history, and support correspondence are reviewed periodically and deleted when no longer needed for security, dispute, or legal purposes. This review is currently carried out manually rather than by an automatic schedule.

Data subject to a specific dispute or legal retention requirement may need to be kept longer, with access limited to that purpose. Deleting an account does not necessarily erase records we are legally required to keep.

7. Your rights

Under the UK GDPR and, where it applies, the EU GDPR, and subject to the conditions they set, you have these rights:

• Right of access: to confirm whether we process your personal data and to receive a copy of it.
• Right to rectification: to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure: to have personal data deleted where there is no longer a lawful reason to keep it. Records we must keep by law, such as accounting records, are kept for their retention period.
• Right to restriction of processing: to have the use of your data limited, for example while its accuracy is checked.
• Right to data portability: to receive data you provided to us, where we process it by automated means under contract or consent, in a structured, commonly used, machine-readable format, or to have it sent to another controller where technically feasible.
• Right to object: to object at any time to processing based on our legitimate interests, on grounds relating to your situation, and always to direct marketing.
• Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

To exercise a right, contact [email protected]. We may need proportionate evidence to verify your identity before disclosing or changing account information. We respond without undue delay and within one month; if a lawful extension is necessary, we will explain why within that first month. Exercising your rights is free unless a request is manifestly unfounded or excessive.

You can complain to the UK Information Commissioner’s Office or, where EU data protection law applies, your local EU supervisory authority. You do not have to contact us before doing so.

8. Automated checks and security

Our systems check payment status and access permissions. A failed check may prevent payment or delay download access. If you believe a check is wrong, contact support to request a human review. Payment providers may perform their own checks under their own privacy notices.

We use access controls, protected sign-in and download links, and other technical and organisational measures appropriate to the data. No system can promise absolute security. Please keep access links private and tell us if you suspect unauthorised use of your account.

9. Changes to this policy

We may update this notice when the shop, its providers, or legal requirements change. The version identifier and date identify the latest revision. We will provide additional notice of material changes where required and obtain fresh consent if a new use of data requires it.