Privacy, explained as an operating system—not a footnote.

1. Who we are and when this notice applies

Showmesh is a product of Sansa Group AB, a Swedish company, operated under its Sansa Vision division (“Sansa Group AB,” “Showmesh,” “we,” “us,” or “our”). Sansa Vision is an operating brand and is not the contracting legal entity. This notice applies to our websites, creator application, public interactive-demo runtime, APIs, support services, and related communications that link to it.

For account, billing, security, support, and our own product-improvement data, Sansa Group AB generally acts as a controller or business. When a customer uses Showmesh to publish experiences and collect viewer data under that customer’s instructions, the customer is ordinarily the controller or business and Sansa Group AB acts as its processor or service provider. The customer’s own privacy notice also applies to those viewer interactions.

2. Personal data we collect

Account and workspace data

Name, business email, authentication identifiers, profile image, workspace membership, role, permissions, invitation status, and account preferences. Passwordless sign-in uses a one-time code or single-use magic-link token. Tokens and codes are stored only in protected form where supported by the authentication layer.

Customer content and capture data

Product URLs, approved pages, screenshots, sanitized HTML or replay representations, accessibility trees, interaction events, redaction maps, proof blocks, copy, comments, claims, sources, themes, and uploaded media. Captures may incidentally contain personal or confidential information chosen by the customer; customers must use authorized test data and configure masking or synthetic replacement.

Viewer and analytics data

Anonymous session identifiers, experience and release identifiers, steps viewed, actions, proof events, CTA interactions, errors, backtracks, questions, device class, language, source and campaign parameters, coarse location derived by our edge provider, and performance information. Direct identification is off by default and occurs only when the publisher enables a lawful progressive-identification flow.

Support, business, and billing data

Contact information, request contents, attachments, workspace references, subscription and invoice metadata, transaction identifiers, tax details supplied to our payment provider, and communications with us. We do not receive complete payment-card numbers from our payment processor.

Security and technical data

IP address or a truncated/rotating hash, browser and device attributes, timestamps, authentication and audit events, rate-limit events, network and console summaries from approved replay jobs, webhook delivery status, and suspected abuse indicators.

3. Sources of data

• Directly from account holders, viewers, support contacts, and customer administrators.
• Automatically from use of the service, cookies or similar local storage, Cloudflare edge services, and instrumented experiences.
• From integrations a customer authorizes, such as a CRM, marketing platform, identity provider, or webhook endpoint.
• From public product pages and customer-provided documentation that the customer explicitly authorizes Showmesh to process.
• From service providers that support payments, fraud prevention, email delivery, infrastructure, or enterprise procurement.

4. Why we use personal data

• Provide, authenticate, secure, maintain, and support Showmesh.
• Create, store, render, replay, publish, and measure interactive experiences.
• Process payments, administer subscriptions, enforce usage budgets, and prevent surprise overages.
• Detect abuse, isolate tenants, investigate incidents, maintain audit logs, and comply with law.
• Send transactional authentication, invitation, review, repair, usage, and support messages.
• Improve reliability, accessibility, usability, and performance using aggregated or privacy-reduced signals.
• Generate, retrieve, and validate AI-assisted work under workspace policies and documented provider controls.
• Communicate about product changes or, with required permission, send marketing communications.

5. Legal bases in the EEA, UK, and similar jurisdictions

Depending on the context, we rely on performance of a contract, legitimate interests, compliance with legal obligations, protection of vital interests in rare emergencies, and consent. Our legitimate interests include securing and improving the service, preventing fraud, providing business-to-business support, and understanding aggregate service performance. We balance those interests against the rights and expectations of affected people.

Optional analytics, functional, and marketing technologies are controlled through the consent interface where consent is required. Withdrawing consent does not affect processing that occurred lawfully before withdrawal. A detailed activity-by-activity mapping appears in the GDPR and California matrix.

6. AI processing

Showmesh routes model tasks through Cloudflare AI Gateway and follows workspace sensitivity, provider, cost, and raw-data policies. Cloudflare-hosted models are the default for routine tasks. Third-party models receive sanitized structural summaries by default and may receive raw customer captures only when a workspace explicitly permits that data class and the applicable provider terms have been reviewed.

AI output is validated against structured schemas and approved sources where relevant. Model prose does not determine whether a replay passed, whether a person has access, or whether a claim may be published. Customer content is not used to train a shared model unless the customer gives a separate, explicit opt-in and the governing agreement permits it.

7. How we disclose data

• Service providers and subprocessors: infrastructure, database, storage, email, authentication, payment, monitoring, customer-support, and approved AI providers operating under contractual restrictions.
• Customer-authorized integrations: data is sent when an administrator connects and configures an integration.
• Workspace participants: content and activity are visible according to roles, project scope, and sharing settings.
• Public or invited viewers: published content is available according to link, password, expiry, domain, email, or token controls selected by the customer.
• Legal and safety recipients: regulators, courts, law enforcement, professional advisers, or affected parties where required or reasonably necessary to protect rights and safety.
• Corporate transactions: a buyer, investor, or successor subject to appropriate confidentiality and legal requirements.

We do not sell personal information for money. We do not use viewer data for cross-context behavioral advertising. If a future practice constitutes “sharing,” targeted advertising, or sale under an applicable state law, we will update this notice and provide the legally required opt-out before enabling it.

8. International transfers

Our providers and customers may operate globally. Where personal data is transferred from the EEA, UK, or Switzerland to a country not recognized as adequate, we use an appropriate transfer mechanism such as the European Commission Standard Contractual Clauses, the UK Addendum, or another lawful mechanism, together with supplementary safeguards where appropriate.

9. Retention

We keep personal data only for the period reasonably needed for the purpose collected, contractual commitments, dispute resolution, security, and legal requirements. Default targets are: account data for the active account plus 30 days; customer content according to the workspace retention policy plus a short recovery window; raw security logs up to 90 days unless an incident requires longer; support records up to 24 months; billing and tax records for the legally required period; consent records for the consent period plus evidence needed to demonstrate compliance; and aggregated metrics that no longer identify a person for longer-term trend analysis.

Immutable published releases and backups may persist for a limited rolling recovery period after deletion. Deletion workflows propagate through active systems and scheduled backup expiry. Enterprise contractual retention settings may shorten or extend specific periods.

10. Security

We use tenant-scoped authorization, least-privilege Cloudflare bindings, encrypted transport, protected secrets, signed asset access, immutable releases, audit logging, content sanitization, origin controls, rate limiting, redaction, and deterministic replay. No service can guarantee absolute security. Report suspected vulnerabilities to security@sansavision.com. We do not claim a certification until it has been independently completed.

11. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object, port, or obtain a copy of personal data; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; limit use of sensitive personal information; and appeal a denied request. You may also complain to a supervisory authority.

Send a request to privacy@sansavision.com. We may verify identity and authority in a proportionate way. Authorized agents must provide evidence of authority. We will not discriminate against a person for exercising privacy rights. If Showmesh processes viewer data solely for a customer, we may direct the request to that customer and assist it as required.

12. California disclosures

During the preceding 12 months, we may have collected identifiers, customer records, commercial information, internet or electronic activity, approximate geolocation, professional information, audio/visual content supplied for demos, and inferences about product intent. We use and disclose these categories for the business purposes described above. We do not knowingly sell or share personal information of consumers under 16. We honor Global Privacy Control as an opt-out signal for browser-based sale, sharing, and targeted advertising where legally applicable.

Showmesh does not use or disclose sensitive personal information to infer characteristics about consumers. Credentials and contents of communications are used only to provide, secure, and support the service or as otherwise permitted by law.

13. Children

Showmesh is a business service and is not directed to children under 16. We do not knowingly collect personal data from children. Contact us if you believe a child provided data so we can investigate and delete it as appropriate.

14. Changes to this notice

We may update this notice to reflect product, legal, or operational changes. We will publish the new effective date and provide additional notice for material changes when required. Archived versions will be available on request.