Privacy

Last updated: 2026-05-20

This is the privacy policy for Mesa. We are a small team building tooling for artisan food businesses, and we treat your data the way we'd want ours to be treated.

What we collect

Account data: email, business name, and a hashed password (we never store the plain password). If you sign in with Google, we also receive your name and Google's confirmation that your email is verified.
Operational data you enter: clients, products, suppliers, orders, invoices, purchases, cash-flow configuration, and any notes you add. This is your data — we hold it for you, we don't use it for anything else.
Logs: standard server logs (IP address, request path, timestamps). Used to debug and protect against abuse, retained 30 days.
Cookies: a single session cookie (HttpOnly, Secure, SameSite=Lax) and short-lived state cookies during sign-in. No tracking cookies, no third-party analytics that profile you.

How we use it

To run the service: render your dashboard, generate your invoices, compute your cash flow, send your transactional emails.
To keep your account secure: detect abuse, enforce rate limits, send you password-reset emails when you ask.
To improve the product: aggregated, non-identifying metrics (e.g., "X% of users sent an invoice in their first 24 hours").

We do not sell your data, ever. We do not share it with advertisers, data brokers, or marketing networks.

Who processes your data on our behalf

Supabase (PostgreSQL hosting) — stores your operational data, encrypted at rest. EU & US regions.
Render (application hosting) — runs the app servers.
Resend (transactional email) — sends verification and password-reset emails.
Stripe (payments) — handles your billing. We never see your full card number; Stripe is PCI-compliant.
Google — only if you choose "Sign in with Google".

Your rights

Export: at any time, from the dashboard, you can download every piece of your data as a single Excel file.
Delete: email us and we'll delete your account and all your data within 30 days. Backups expire within 90 days.
Access & correction: every field is editable from the dashboard. If something isn't, email us.
If you are in California (CCPA) or the EU (GDPR), the rights above apply to you fully.

Children

Mesa is a B2B operations tool for business owners. The service is not directed at children under 18.

Changes

If we change this policy in a meaningful way, we'll email account holders and update the "Last updated" date at the top.

Contact

Questions, concerns, or a deletion request: [email protected].