Privacy Policy
What personal data Glxymesh collects, why, who it is shared with, where it is stored, how long it is kept, and how to exercise your rights under India's DPDP Act.
This policy explains how Abhishek Mourya, trading as Glxymesh (“we”), handles personal data
when you use glxymesh.com, its subdomains, the gxmesh CLI and our MCP endpoints. For the purposes
of India’s Digital Personal Data Protection Act, 2023, we are the data fiduciary for the data
described here.
What we collect
Section titled “What we collect”| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, name, password hash, passkeys, two-factor settings | You, when you sign up |
| Google sign-in | Email address, name and profile picture from your Google account | Google, if you choose to sign in with Google |
| Organization | Organization and project names, members, invitations, roles | You and your organization’s owner |
| Billing | Billing name, address, GSTIN, invoices, payment status | You and Razorpay |
| Tools | Source code, manifests, project descriptions, build output, generated docs | You, when you push a tool |
| Secrets | Values you store for your tools, such as API keys | You |
| Usage | Calls to your tools: time, tool, caller, duration, size, result status | Our gateway and runtime |
| Logs | Messages your tools write, and our service logs | Your tools and our services |
| Technical | IP address, browser and device type, pages visited | Your browser, and Google Analytics |
We do not collect card numbers. Card, UPI and netbanking details are entered with Razorpay.
How we use it
Section titled “How we use it”- To create and secure your account and sign you in.
- To build, run and serve your tools, and to show you their usage and logs.
- To bill organizations, issue GST invoices and keep tax records.
- To send service emails: sign-in and verification codes, invitations, invoices and important changes.
- To generate the MCP documentation your endpoint serves, from your tool’s source, manifest and project description.
- To keep the platform safe: detect abuse, enforce limits, and investigate incidents.
- To understand how our websites are used.
We rely on your consent, given when you create an account, and on legitimate uses permitted by the DPDP Act, such as meeting legal obligations. We do not sell personal data, and we do not use your tools’ code or data to train AI models.
Who we share it with
Section titled “Who we share it with”We share data only with the service providers we use to run Glxymesh, and only what each one needs.
| Provider | Purpose | Data |
|---|---|---|
| Amazon Web Services | Hosting, storage and databases, in the Mumbai (ap-south-1) region | All data above |
| Cloudflare | Delivery and protection for the console and websites | Technical data |
| Razorpay | Payment processing | Billing details, payment information |
| Sign-in with Google, and Google Analytics | Sign-in data, technical data | |
| Anthropic | Generating your project’s MCP documentation | Tool source, manifests, project descriptions |
| Our email provider | Delivering service emails | Email address, message content |
We may also disclose data when the law requires it, or to protect the rights and safety of our users and the platform.
Where it is stored
Section titled “Where it is stored”Glxymesh runs in AWS’s Mumbai region, so your data is stored in India. Some providers above, such as Anthropic, Google and Cloudflare, may process data outside India, as the DPDP Act permits.
How long we keep it
Section titled “How long we keep it”| Data | Kept for |
|---|---|
| Account and organization | Until you delete the account or organization |
| Tools, secrets and generated docs | Until you delete the tool, project or organization |
| Per-call usage events | 90 days; monthly totals are kept for billing |
| Invoices and billing records | As long as Indian tax law requires |
| Logs | As long as needed to operate the platform and investigate problems |
Security
Section titled “Security”Connections use TLS. Secrets are encrypted at rest. Each tool call runs in its own WebAssembly sandbox with no filesystem and only the network access its manifest declares. You can protect your account with passkeys and two-factor authentication.
Your rights
Section titled “Your rights”Under the DPDP Act you can:
- ask what personal data we hold about you and how we use it;
- ask us to correct, complete or update it;
- ask us to erase it, subject to what the law requires us to keep;
- withdraw consent, which may mean closing your account;
- nominate someone to exercise these rights if you die or become unable to;
- raise a grievance with us, and then with the Data Protection Board of India.
Email hello@glxymesh.com from your account’s address. You can also delete your account from accounts.glxymesh.com.
Cookies
Section titled “Cookies”We use cookies to keep you signed in and to protect sign-in forms. Google Analytics measures visits to www.glxymesh.com, and to the console and accounts site when it is enabled there; it sets its own cookies. Analytics never runs on payment screens.
Children
Section titled “Children”Glxymesh is not for anyone under 18, and we do not knowingly collect their data.
Changes
Section titled “Changes”We will update the date at the top of this page when this policy changes, and email account holders about material changes.
Grievance officer
Section titled “Grievance officer”Indorama Square Pithampur Sector-03