GDPR and California Privacy Matrix

1. Processing activity matrix

Activity	Data	GDPR / UK basis	California category	Recipients	Default retention
Account registration and sign-in	Name, email, authentication and session identifiers, IP/security signals	Contract; legitimate interests in security; legal obligation where applicable	Identifiers; customer records; internet activity	Cloudflare, authentication and email subprocessors	Active account + 30 days; security evidence up to 90 days
Workspace administration	Membership, role, permissions, invitation, audit events	Contract; legitimate interests in access governance	Identifiers; professional information; internet activity	Authorized workspace admins; infrastructure subprocessors	Workspace life + contractual recovery period
Capture and authoring	Authorized URLs, screenshots, sanitized HTML, a11y trees, interactions, redactions, comments	Customer instructions/contract; legitimate interests for reliable delivery	Internet activity; audio/visual; possible customer-supplied identifiers	Infrastructure, storage, approved browser/AI providers	Workspace policy; raw artifacts subject to lifecycle deletion
Public viewer delivery	Anonymous session, device class, path state, proof and CTA events	Customer’s chosen basis; contract; legitimate interests for essential delivery	Identifiers; internet activity; approximate geolocation; inferences	Publisher, Cloudflare, configured integrations	Raw event detail up to 3 months; configured experiment metrics follow the workspace policy
Optional product analytics	Feature use, performance, errors, campaign/source parameters	Consent where required; otherwise legitimate interests after balancing	Internet activity; approximate geolocation; inferences	Analytics infrastructure; customer-authorized destinations	Raw analytics up to 3 months; de-identified aggregates may persist
Support and service communication	Contact details, request text, attachments, workspace reference	Contract; legitimate interests; legal obligation	Identifiers; customer records; professional information; communication contents	Sansa Group AB support operating as Sansa Vision; Cloudflare Email; advisers if necessary	Up to 24 months; longer for active disputes or legal duties
Billing and tax	Billing contact, plan, transaction, invoice, tax and usage metadata	Contract; legal obligation; legitimate interests in fraud prevention	Identifiers; commercial and financial information	Payment processor, tax/accounting providers, authorities	Statutory tax/accounting period, commonly 5–10 years
Security and abuse prevention	IP or rotating hash, user agent, access, audit, rate-limit, incident and diagnostic events	Legitimate interests; legal obligation; vital interests in rare cases	Identifiers; internet activity; approximate geolocation	Cloudflare security services; incident advisers; authorities where required	Generally up to 90 days; incident evidence as needed
AI-assisted creation and repair	Task inputs, sanitized captures or summaries, approved sources, model outputs, receipts	Contract/customer instructions; legitimate interests for quality and safety	Customer-supplied categories; inferences	Cloudflare AI Gateway; allowed model providers under policy	Receipts according to audit policy; large artifacts subject to R2 lifecycle
Product and transactional email	Email, workspace events, message delivery status	Contract; legitimate interests; consent for marketing where required	Identifiers; internet activity; professional information	Cloudflare Email and configured mail services	Delivery logs generally up to 90 days; account communication record as needed

2. Role allocation

Context	Customer	Sansa Group AB / Sansa Vision
Creator accounts, billing, security, direct support	Independent controller for its own employee administration	Sansa Group AB is controller / business
Customer content and configured viewer analytics	Controller / business	Sansa Group AB is processor / service provider / contractor
Security telemetry used to protect all tenants	Controller for its instructions and users	Sansa Group AB is controller for narrowly defined security purposes, or processor where contractually specified

3. California notice at collection

We collect the California categories listed in the matrix for service delivery, security, support, billing, legal compliance, and the configured business purposes of our customers. We retain each category according to the criteria in the matrix: account and contractual need, workspace retention settings, security and dispute requirements, legal obligations, and deletion/recovery windows.

We do not sell personal information for money, do not use viewer data for cross-context behavioral advertising, and do not knowingly sell or share personal information of people under 16. We honor Global Privacy Control where applicable. If our practices change, we will update this notice before beginning the new practice and provide the required right to opt out.

4. Rights and response path

EEA/UK: access, rectification, erasure, restriction, portability, objection, consent withdrawal, and complaint to a supervisory authority.
California: know/access, delete, correct, opt out of sale/sharing, limit qualifying sensitive-information use, non-discrimination, and use of an authorized agent.
Other US states: access, correction, deletion, portability, opt out of targeted advertising/sale/qualifying profiling, and appeal where applicable.

We target acknowledgement within 10 days and a substantive response within the legally required period. California requests are ordinarily completed within 45 days, subject to a permitted extension. GDPR requests are ordinarily completed within one month, subject to a permitted extension. We may verify the request and will explain denials and appeal routes.

5. Data protection impact triggers

A customer should assess a DPIA or similar review before enabling high-volume viewer identification, sensitive-data capture, systematic employee monitoring, new enrichment sources, automated decisions with significant effects, raw-capture submission to a third-party model, or deployment in a regulated environment. Showmesh exposes policy and audit controls but does not replace the customer’s legal assessment.

6. Data minimization defaults

Anonymous viewer sessions and no third-party cookies by default.
Progressive identification after proof rather than mandatory gating.
Rotating or truncated network identifiers where practical.
Redacted DOM/accessibility subsets and focused image crops for model work.
Cloudflare-hosted default models; third-party raw-data routing requires policy opt-in.
Purpose-scoped integration mappings and signed webhooks.
Content-addressed assets, tenant prefixes, lifecycle deletion, and short-lived signed access.

Legal entity and rights requests

Sansa Group AB, Sweden · Soldathemsgatan 20, 415 28 Göteborg, Sweden · Organisation no. 559111-9507 · VAT SE559111950701. Showmesh is operated under the Sansa Vision division.