Privacy policy
Under Regulation (EU) 2016/679 (GDPR) and French Act No. 78-17 of 6 January 1978 as amended. Last updated: 25 September 2026.
We process professional contact details in order to introduce our work to organisations it may concern, plus whatever you send us when you write to us. The public pages of this site set no cookies. If you received a message from us without having contacted us first, your details come from a public professional source, set out in the section Where your details come from. One reply saying "STOP" stops everything.
- Data controller
- Data processed, purposes, legal bases and retention
- Where your details come from, and Article 14 GDPR information
- Objecting and being left alone
- Recipients and processors
- Transfers outside the European Union
- Cookies and analytics
- Security
- Your rights and how to exercise them
- Lodging a complaint with the CNIL
- Changes to this policy
Data controller
The controller for the processing described below is Gilles Petit, an individual, publisher of the service presented under the trading name Mesh Universe, residing at 137 rue de Sèvres, 75006 Paris, France. Further identification details are in the legal notice.
Contact for any personal data matter: contact (at) meshuniverse.fr.
No data protection officer has been appointed. Requests are handled at contact (at) meshuniverse.fr.
Data processed, purposes, legal bases and retention
We process professional data only, tied to a role held within an organisation. We collect no special category data within the meaning of Article 9 of the GDPR, and we do not target personal addresses.
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Business outreach | First and last name, role, organisation, professional e-mail address, sector, source of the record, history of messages sent and replies received. | Introducing our work to organisations whose activity matches the subject of the message, and keeping track of the exchange. | Legitimate interest (Art. 6(1)(f)), namely developing a business-to-business activity, balanced against a message tied to the recipient's role, a limited sending volume, and objections handled immediately. | 3 years from your last contact with us, or from the last message left unanswered. |
| Reading measurement | Message opening (tracking image), view of the online brief, active reading time, scroll depth, button clicks, plus the IP address and mail client or browser identifier attached to the event. | Knowing whether a message interested its recipient, so we stop writing to those it does not, and improve our material. | Legitimate interest (Art. 6(1)(f)). Measurement only covers messages sent to someone who has not yet replied to us, and you can object at any time. | 13 months for reading events. 6 months for the IP address and client identifier. |
| Contact form | Professional e-mail address, role, sector, subject of the request, free-text message, originating page, language. | Answering your request and sending you the material you asked for. | Steps taken at your request prior to entering a contract (Art. 6(1)(b)), or legitimate interest in replying (Art. 6(1)(f)) where no contract is contemplated. | 3 years from the last exchange. |
| E-mail correspondence | Content of the messages exchanged and the associated technical headers. | Keeping the thread of the relationship and being able to retrieve the history of an exchange. | Legitimate interest (Art. 6(1)(f)) in keeping a record of one's professional correspondence. | 3 years from the last exchange, unless a legal retention obligation requires longer. |
| Suppression list | E-mail address and date of the request. | Making sure that a person who asked not to be contacted again is not contacted again, including in a later campaign. | Legal obligation to give effect to an objection (Art. 21 GDPR). | For as long as we carry out outreach, this retention serving the sole purpose of not contacting you. |
Measurement stops as soon as the exchange starts
It only covers messages sent to someone who has not yet replied to us. From your first reply, your address leaves the automated sending: the rest of the conversation is written and sent from an ordinary mailbox, with no tracking image and no measured link. The same applies as soon as an exchange starts through another channel.
Two further means are in your hands: blocking remote images in your mail client, which prevents open measurement, and objecting to this measurement as to the rest, at any time and without giving reasons.
Where your details come from, and Article 14 GDPR information
In business outreach, an address reaches us without the person having given it to us. Article 14 of the GDPR then requires us to state the source of that data.
Where your contact details come from
They come from publicly accessible professional sources:
- the "contact", "press" or "team" pages of websites run by companies, federations, consortia, clusters and public bodies;
- the "contact" and "newsroom" pages of media outlets, and the bylines of published articles, when we write to a journalist about a subject they cover;
- public professional directories, membership lists and organisation charts published by the organisations themselves;
- professional social networks, for the role and the organisation;
- where applicable, professional contact-search tools that aggregate those same public sources. We do not buy contact lists.
Where no address is published, we write to the organisation's generic address rather than to a personal one.
Why we write to you, and on what basis
The message concerns a subject tied to the role you hold, and is addressed to your organisation in a strictly professional setting. The legal basis is the legitimate interest in Article 6(1)(f) of the GDPR: making a business activity known among professionals. The balancing rests on the following elements: the message relates to your work, it contains no special category data, follow-ups are capped at two, reading measurement stops at your first reply, and any objection stops everything.
When you are informed
You are informed no later than the first message we send you, in accordance with Article 14(3)(b) of the GDPR. That message states why you are receiving it, how to object, and links to this page.
Categories of data concerned
First and last name, role, organisation, professional e-mail address, sector, and the source the address came from. Nothing else is collected at that stage.
Objecting and being left alone
You may object at any time and without giving reasons to receiving our messages, under Article 21(2) of the GDPR.
- Reply "STOP" to the message you received. A sentence works just as well, the wording does not matter.
- Or write to contact (at) meshuniverse.fr.
The request is handled immediately. Your address is added to a suppression list so that no later campaign reaches you, and no follow-up is sent after an objection. Every first message we send carries that opt-out wording.
Independently of any objection on your part, we send at most two follow-ups when there is no reply, after which we stop writing.
Recipients and processors
Data is accessible to the publisher and, where applicable, to the people assisting him with the business relationship. It is disclosed to no third party for commercial purposes. The following providers act as processors, on our behalf and on our instructions:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Business e-mail for the meshuniverse.fr domain (sending, receiving, message storage) | France |
| Netlify, Inc. | Hosting of the public pages of the website | United States |
| Vercel, Inc. | Hosting of the go.meshuniverse.fr service, which serves the briefs sent by e-mail and receives the contact form | United States |
| Upstash, Inc. | Database of outbound messages, reading events and contact requests | United States |
Data may also be disclosed at the request of a competent administrative or judicial authority.
Transfers outside the European Union
Three of our providers are established in the United States: Netlify, Vercel and Upstash. The data entrusted to them, namely reading events and requests sent through the contact form, is therefore transferred outside the European Union.
Those transfers rely on these providers' participation in the EU-U.S. Data Privacy Framework, found adequate by the European Commission's implementing decision of 10 July 2023, and on the standard contractual clauses in our data processing agreements with them. Business e-mail, for its part, is hosted in France.
Cookies and analytics
The public pages of meshuniverse.fr set no cookies and embed no third-party analytics. That is why you are shown no consent banner.
One single item is stored by your browser, in its local storage: the fact that you dismissed the banner offering the English version of the site. It stays on your device, is never transmitted to us, and identifies no one. Clearing the site's data removes it.
The briefs we send by e-mail are served from go.meshuniverse.fr. That page measures reading time and scroll depth. It sets no cookies either, and does nothing more than remember, in your browser's local storage, the display language you chose.
Security
Exchanges with the website and with our services are encrypted in transit (HTTPS, TLS). Access to tracking data is restricted to authorised people and protected by an access key. The providers listed above operate under their own contractual security commitments.
No arrangement removes risk entirely. We therefore keep collection to what is necessary, and purge measurement data according to the retention periods stated above.
Your rights and how to exercise them
Under the conditions set by the GDPR, you have the following rights:
- Access (Art. 15): obtain confirmation that data about you is processed, and receive a copy of it.
- Rectification (Art. 16): have inaccurate or incomplete data corrected, for instance a role that is no longer yours.
- Erasure (Art. 17): ask for your data to be deleted.
- Objection (Art. 21): object to the processing, in particular to outreach, where the right is absolute.
- Restriction (Art. 18): ask for the processing to be frozen, for instance while a contested point is verified.
- Portability (Art. 20): receive the data you provided in a machine-readable format, for processing based on consent or on a contract.
- Post-mortem directives (Art. 85 of the French Act of 6 January 1978): set out what happens to your data after your death.
To exercise these rights, write to contact (at) meshuniverse.fr, or by post to the address in the legal notice. We answer within one month of receiving the request, a period that may be extended by two months for a complex request, in which case you are told.
Where serious doubt exists about your identity, we may ask for an element allowing us to verify it. A request sent from the e-mail address concerned is enough in the vast majority of cases.
Lodging a complaint with the CNIL
If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the French data protection authority:
CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. Online form: www.cnil.fr/en/plaintes.
Changes to this policy
This policy may be updated to reflect a change in our processing, our providers or the applicable rules. The date of the last update appears at the top of the page. Where a change is substantial, the people concerned are told in the next message.