Meshnect Privacy Policy
Effective date: 19 October 2026
1. Who is responsible
Upsquare Technosys Pvt. Ltd. operates Meshnect, a platform for separate professional networks. We are the data fiduciary for your Meshnect account, shared profile, and single sign-on (SSO). One Meshnect account lets you access networks you are authorized to join. vCarrd is not a sign-up path.
Each network operator decides who belongs to its network, which member records it imports, and how it uses those records. The operator is responsible for those decisions and its own privacy notice. We process network data on its instructions where we act as its service provider, and remain responsible for our own platform purposes. These roles depend on the actual processing, not just these labels.
Networks normally use an address such as <slug>.meshnect.com; some may use a custom domain. House of Starts (HoSt) operates at host.meshnect.com. Its additional notice is in the HoSt Network Addendum.
2. Data we collect
| Category | Information and source | Purpose |
|---|---|---|
| Account and sign-in | Registration details, contact email, authentication records, and sign-in identifiers supplied by you or an enabled identity provider | Create and secure your account; authenticate you across authorized networks |
| Profile | Name and professional information you provide, and profile fields imported by an operator as described below | Maintain your profile and show the information you choose to share |
| Network membership | Network affiliation, membership status, invitations, and claim status from you and the operator | Manage admission, access, and member records |
| Posts and messages | Content, attachments, recipients, and related timestamps you submit | Deliver content to its intended audience, handle reports, and operate the network |
| Device and logs | IP address, browser/device information, session and access logs, and error/security records generated when you use Meshnect | Maintain sessions, troubleshoot, prevent abuse, and secure the service |
| Requests and correspondence | Support messages, rights requests, and information reasonably needed to verify the requester | Provide support, resolve grievances, and document responses |
Required account information is needed to provide account access. Optional profile information is your choice. Do not upload sensitive information about yourself or others unless necessary and lawfully authorized. The final field inventory and any cookies, analytics, or additional collection must be disclosed before use.
3. Purposes and legal grounds
For processing governed by India's Digital Personal Data Protection Act, 2023 (DPDP Act), we seek consent for the specified purposes where required. Consent must be informed, specific, and given through a clear affirmative action. This policy and acceptance of the Terms do not, by themselves, supply consent for every use.
We rely on a legitimate use only where a specific provision of the DPDP Act permits it and its conditions are met. We do not treat a general business interest or an old membership record as automatic permission. An operator must establish a lawful basis before importing or continuing to hold member data.
You may withdraw consent through the contact below as easily as giving it. Withdrawal does not invalidate earlier lawful processing. We stop the affected processing, and instruct relevant processors to stop, unless continued processing is required or permitted by applicable law. Features that need that data may no longer work; we explain that consequence without conditioning unrelated features on unnecessary consent.
4. Imported and unclaimed profiles
HoSt has imported EventPass member records to prepare its member network and let eligible people claim their own profiles. The fields imported are name, email, phone, and company where available, exactly as entered. Their source is HoSt's EventPass membership records. Importing a record does not mean the person has joined Meshnect, accepted the Terms, or consented to publication.
Unclaimed profiles remain hidden from the public and other members. Authorized HoSt administrators and Meshnect personnel may access them only as needed to administer, support, or secure the import. They are not shared with other networks.
HoSt public sign-up is closed. Claims are invite-only, using one individual link per person. If you receive an authorized invitation, follow that link, verify that the record is yours, create or sign in to your Meshnect account, and review the information and sharing choices before completing the claim. Claiming must not automatically make every field public. Ask HoSt at hello@houseofstarts.com if you need help or a replacement invitation. Do not forward your claim link.
You can request correction or removal at that address or through Meshnect's contact below without creating an account or claiming the profile. We use proportionate identity checks. Unclaimed records are removed after 90 days from the date we send the claim notice unless a documented legal requirement requires limited retention. Removal requests are handled sooner under the rights process below.
5. Visibility and sharing
A network sees only its own members and information people share there. Membership or activity in one network is not automatically disclosed to another. Using SSO does not enroll you in every network. Shared account information is used to authenticate you; network access and content visibility remain separate.
Posts and messages are visible to their intended recipients or selected audience. Public sharing, if offered, requires a clear audience choice. Recipients can copy material they receive. Authorized staff may access relevant data for support, security, lawful requests, and moderation under controlled permissions. We do not promise that private messages are end-to-end encrypted.
We share data with contracted service providers only as needed for their work, with authorities where law requires it, and with professional advisers where necessary and lawfully permitted. We do not sell personal data or use imported records for bulk broadcasts. Platform email is transactional, such as account, invitation, security, and service messages.
6. Providers and international processing
DigitalOcean provides hosting in India. Postmark delivers transactional email and processes recipient details, email content, and delivery records. India hosting does not mean every provider, backup, or support operation stays in India.
If enabled, Google or LinkedIn sign-in exchanges the identity details and permissions shown in the sign-in flow. Those providers also process information under their own notices; they are not automatically Meshnect processors for all their activities. Choosing a provider does not authorize access to your contacts or publication to that provider.
The confirmed countries and safeguards for processing outside India are the United States, for transactional email sent through Postmark (ActiveCampaign, LLC). Our servers and database are hosted in India (DigitalOcean, Bangalore). We comply with applicable Indian transfer restrictions. Where EU or UK transfer rules apply, we use a valid transfer mechanism and any required additional safeguards. Contact us for details and copies of applicable safeguards, subject to lawful redactions.
7. Retention
We keep data only for its stated purpose and applicable legal requirements. Closing an account, leaving a network, and deleting particular content are separate actions. Leaving one network does not close your account or memberships elsewhere.
| Record | Retention limit or deletion trigger |
|---|---|
| Account and shared profile | While needed for your account; delete within 30 days of your request after closure or a valid erasure request, subject to lawful exceptions |
| Network membership, posts, and messages | Kept until you delete it, leave the network, or the network closes, then deleted within 30 days. Copies already received by others in conversations, and records an operator must keep by law, may remain |
| Unclaimed imports | 90 days from the date we send the claim notice |
| Device, access, security, and email delivery logs | 180 days, as required by Indian CERT-In directions |
| Support and rights-request records | 3 years |
| Backup copies | Expire within 30 days; deleted records must not return to active use after restoration |
Where a legal obligation or dispute requires retention, we limit the data, access, purpose, and duration, and explain the exception where legally permitted. We also instruct relevant processors to delete data when required. Records independently retained by an operator remain subject to its own lawful duties and notice.
8. Security
We use reasonable technical and organizational safeguards appropriate to the data and risks, including restricted administrative access and controls intended to separate networks. No service can guarantee absolute security. Report suspected unauthorized access to the contact below. We assess incidents and notify affected people and authorities as required by applicable law. Specific controls and incident procedures must be validated before this draft is published.
9. Your choices, rights, and grievances
Contact us to request information about processing and sharing of your data, access where applicable, correction, completion or updating, erasure, consent withdrawal, or grievance resolution. You may nominate another person to exercise applicable DPDP rights in the event of your death or incapacity; contact us for the nomination and verification process. Legal rights apply subject to their statutory conditions and commencement. We also offer the request process described here as a service commitment.
Include enough information to locate your record and the relevant network. Do not send passwords, sign-in codes, or unnecessary identity documents. We may ask for proportionate verification, including authority to act for someone else. We route network-specific requests to the responsible operator with only necessary information and tell you who is handling them.
We respond to requests and grievances within 30 days or any shorter applicable legal deadline. If a request cannot lawfully be granted, we explain why and available escalation routes. Where the DPDP complaint mechanism is applicable and available, you may approach the Data Protection Board of India after using the required internal grievance process. Other applicable complaint rights remain available.
10. EU and UK members
Where EU GDPR or UK GDPR applies, Meshnect acts as controller for its platform purposes and the operator for its own membership purposes. Relevant grounds may include contract necessity for requested account services, consent for optional uses, legal obligations, and documented legitimate interests in proportionate security and abuse prevention, subject to your rights. The import needs its own assessed basis. You may have rights of access, correction, erasure, restriction, portability, objection, and consent withdrawal, and may complain to your competent supervisory authority, including the UK ICO. We normally respond within one calendar month, or sooner under our 30-day commitment; any lawful extension requires timely explanation. Contact us for the applicable transfer safeguards and any required EU/UK representative details.
11. Children
Meshnect is for people age 18 and older. People under 18 may not create accounts, claim profiles, or use networks. Operators must not import their records. If we learn that a record concerns someone under 18, we restrict access and remove the data unless limited retention is legally required. Contact us to report such a record.
12. Changes and contact
We update the effective date when this policy changes and provide appropriate notice of material changes. We obtain new consent where required before a new use. A policy update does not retroactively authorize an import or expand consent.
Grievance Officer
Privacy and grievance contact:
- Legal entity: Upsquare Technosys Pvt. Ltd.
- Name: Hardip Kalola
- Email: grievance@meshnect.com
- Postal address: Block-D, 3rd Floor, Satyam Corporate Square, Behind Rajpath Club, Ahmedabad, Gujarat 380054, India
- Response time: within 30 days, or a shorter period required by applicable law.