Privacy Notice — WhoMesh

1. Controller and scope

OMNIVIA TECH, a French single-shareholder simplified joint-stock company (SASU), registered under 104 197 967 R.C.S. Paris, is the data controller responsible for the personal data described in this Privacy Notice.

Registered office: 58 rue de Monceau, 75008 Paris, France.

Correspondence: OMNIVIA TECH, 58 rue de Monceau, CS 48756, 75380 Paris Cedex 08, France.

Privacy and data-protection contact: support@whomesh.com

General support: support@whomesh.com

This Privacy Notice applies to whomesh.com, app.whomesh.com, admin.whomesh.com, WhoMesh referral links, request participation, introductions, messages, chats, rewards, payments and support interactions.

It applies to visitors and registered members, as well as to people who may be referred to or mentioned by another person even if they do not have a WhoMesh account.

Where third-party providers, including payment providers, process personal information for their own legal, regulatory, fraud-prevention or financial-services purposes, they may act as independent data controllers for that processing.

2. What information we handle and where it comes from

Information you provide

We may process information that you provide directly to WhoMesh, including account and contact information; authentication information; profile and professional information you choose to provide; profile tags and areas in which you indicate you may be able to help; request briefs; private messages; participation choices; introductions; chat content and attachments; complaints; support communications; reward claims; and information required in connection with payments or payouts.

The WhoMesh interface identifies information that is required and information that is optional.

If information necessary to provide a requested feature is not supplied, we may be unable to provide that account, introduction, communication or payment feature.

Optional information may be left blank.

Information provided by other people

Because WhoMesh is based on human introductions, another requester or intermediary may provide limited information about you.

This may include your name, professional role, an explanation of why you may be relevant to a request, or a contact detail where appropriate.

We may also receive messages, introductions, complaints or supporting evidence that refer to you.

Where required by applicable law, we provide information about the source or category of source and the purpose for which the information is being processed.

Being referred to WhoMesh by another person does not mean that you have consented to join WhoMesh, participate in a request, disclose your identity or communicate with the requester.

Service and referral records

We may record request identifiers; branch and referral identifiers; attribution events; timestamps; permissions; acceptance and refusal actions; delivery and workflow status; request status; reward status; and records reasonably necessary to operate, secure and troubleshoot WhoMesh.

A referral link may contain an identifier that associates a visit or later participation with a request or referral branch.

Merely opening a referral link does not, by itself, establish that an identified individual has joined or accepted participation in a WhoMesh chain.

Technical information

When you access WhoMesh, our systems and service providers may process technical information such as IP address, browser and device information, access times, security events, server logs, error records and similar technical information required for operation and security.

Cookies, local storage and similar technologies are described separately in the WhoMesh Cookie Policy.

Optional analytics or tracking technologies that require consent will be disclosed and controlled separately. The production check described in the Cookie Policy did not find analytics, advertising or profiling cookies in use.

Payments and rewards

When the WhoMesh reward feature is used, we may process the reward amount and currency; request and payment references; reward allocation; eligibility and payout status; transaction status; relevant invoice and tax information; and records required to administer or investigate a reward.

Stripe processes payments and recipient onboarding through its payment infrastructure. WhoMesh sends the payer to a Stripe-hosted checkout page. The payment, card and identity-verification information available to WhoMesh depends on that Stripe configuration. This notice does not claim that WhoMesh never receives card or identity data.

Sensitive information

WhoMesh should not be used to submit unnecessary sensitive personal information about another person.

Please do not include health information, political or religious beliefs, sexual-life information, biometric data, criminal-offence information or other similarly sensitive information in ordinary requests unless a specific WhoMesh feature expressly permits it and an appropriate lawful basis applies.

Do not submit unnecessary personal information about children.

If WhoMesh unexpectedly receives sensitive information, we may restrict, remove or otherwise handle it according to applicable law.

Accepting the Terms of Use does not constitute blanket consent to process sensitive personal information.

3. Why we process information and our legal bases

Providing your account and requested service

Where applicable, we process the information necessary to authenticate you, manage your account, create and manage requests, record your participation, deliver messages, facilitate introductions and provide support because it is necessary to perform the service you request or to take steps at your request before entering into a contract.

Being mentioned or referred by another person does not itself make you a party to a contract with WhoMesh.

Information about referred people who are not members

We may process limited relevant information concerning a non-member where necessary to facilitate a genuine introduction and where our legitimate interests, or those of the participants, provide an appropriate lawful basis.

We consider reasonable expectations, necessity, proportionality and the effect on the person concerned.

This does not authorise intrusive investigation, collection of unnecessary information or repeated unwanted contact.

Where consent or another legal basis is required, we must obtain it or refrain from the relevant processing.

Rewards and payments

Where a reward is used, we process participation, attribution, evidence, reward and payment records as necessary to administer the relevant reward arrangement.

Certain accounting, tax, regulatory, sanctions, fraud-prevention or reporting activities may also be required by law.

Stripe determines the appropriate legal basis for processing that it performs independently.

Security, disputes and service reliability

We may use proportionate account, technical and activity records to prevent and investigate abuse; protect users and the service; diagnose technical problems; secure accounts; investigate complaints and reward disputes; prevent fraud; and establish, exercise or defend legal claims.

Where the processing is not required by law or contract, it may be based on our legitimate interests, subject to applicable safeguards and your rights.

Optional marketing and tracking

Marketing communications and optional tracking that legally require consent are subject to a separate choice.

Declining optional marketing or tracking does not prevent you from using the basic WhoMesh introduction service.

You can withdraw consent where applicable without affecting processing that was lawful before withdrawal.

Accepting this Privacy Notice or the WhoMesh Terms of Use does not constitute consent to unrelated marketing or tracking.

4. Who can see a request and your information

Shareable request brief

People who receive a shareable request link may see the information that the requester intentionally placed in the shareable part of the request.

A recipient may forward that information to another person, including outside WhoMesh.

For this reason, confidential or highly personal information should not be included in the shareable brief.

Intermediaries

An intermediary sees only the information reasonably necessary to understand and participate in the relevant request and their authorised branch.

WhoMesh does not provide intermediaries with unrestricted access to the complete acquaintance graph, other branches, private candidate responses or private chats.

Candidates and requesters

A possible candidate may choose whether to view a private message, respond or proceed with an introduction.

WhoMesh does not reveal a candidate's identity to the requester merely because the candidate opened a referral link, privately identified themselves to WhoMesh, read a message, or declined the request.

Before an action reveals identity or opens direct communication, WhoMesh will explain what information will be shared and obtain the required choice.

Chat content is accessible to the participants authorised to use that chat and may also be accessed in a restricted manner by authorised personnel or service providers where necessary for support, security, dispute resolution or legal obligations.

Progress and reward information

Participants may receive limited information about the progress of a request or reward.

A notification that someone's contribution resulted in a connection does not automatically disclose private messages, undisclosed identities or contact details belonging to other participants.

Reward recipients may see information about their own allocation and payment status, but do not receive unrestricted access to other participants' identity documents, payment information or reward allocations.

5. Service providers and other recipients

WhoMesh uses third-party providers to operate certain parts of the service. This section names providers that the service actually uses. It does not list every cookie a provider's documentation mentions.

Caasify

Caasify provides hosting and database infrastructure and may process application data, backups and operational logs according to the WhoMesh configuration. Use of Caasify on the server does not, by itself, place a cookie in your browser. The Cookie Policy records what was actually observed in the browser.

Brevo

WhoMesh sends transactional email and SMS through Brevo from WhoMesh servers. Depending on the message, Brevo may process email addresses or phone numbers, message content, and delivery records.

The application request that sends an email does not insert an open-tracking pixel. No Brevo script or cookie was loaded on the WhoMesh websites checked for the Cookie Policy. WhoMesh does not treat the use of an email provider as proof that email open-tracking or click-tracking is enabled.

Stripe

Stripe is used for payment processing and recipient onboarding when monetary rewards are enabled.

Depending on the Stripe service and activity, Stripe may act as a service provider to WhoMesh or as an independent controller for its own regulatory, financial-services, identity-verification or fraud-prevention activities.

WhoMesh uses Stripe Checkout by redirecting the payer to a page hosted by Stripe. Stripe may also be used for recipient account onboarding. Technologies on Stripe's own pages are described in the Cookie Policy to the extent they were observed. A Stripe-hosted page that was not opened during that check is not listed as if it had been.

Google

On app.whomesh.com, WhoMesh loads Google Fonts stylesheets and, on the sign-in page, Google Identity Services so that the “Continue with Google” button can be shown. Google may receive technical information such as IP address as part of those requests. The cookie Google’s sign-in script stored is described in the Cookie Policy.

Apple

If you choose “Continue with Apple”, WhoMesh loads Apple’s sign-in script from Apple. That script is not loaded merely by opening the sign-in page.

Other providers

WhoMesh does not currently run a separate analytics, advertising or crash-reporting script on the public site or the customer app. If one is added, this notice and the Cookie Policy will be updated before it is activated where consent is required.

Push notifications, where enabled by a signed-in user, can use Firebase Cloud Messaging. That path is not started by visiting the public site or the sign-in page.

WhoMesh does not provide prospective commercial partners with general access to private requests, private messages or the referral graph.

We may disclose proportionate information to professional advisers, insurers, courts, regulators or other competent authorities where required by law or reasonably necessary for a legitimate legal claim.

6. International transfers

OMNIVIA TECH is established in France. Not every WhoMesh service provider is necessarily located in the European Economic Area.

If personal information is transferred outside the EEA in circumstances where GDPR transfer rules apply, we use an appropriate lawful transfer mechanism where required.

Depending on the recipient and destination, this may include an adequacy decision, approved Standard Contractual Clauses or another legally recognised safeguard.

Where necessary, supplementary technical or organisational safeguards may also be used.

You may contact support@whomesh.com to request information about applicable transfer safeguards, subject to appropriate confidentiality and security limitations.

Acceptance of the WhoMesh Terms of Use is not treated as blanket consent to international data transfers.

7. Retention and deletion

WhoMesh retains personal information only for as long as reasonably necessary for the purpose for which it was collected, after which it is deleted, anonymised or retained only in a restricted archive where a legal or legitimate need remains.

WhoMesh does not retain every chat or the complete referral graph indefinitely merely because a request existed or a payment occurred.

Account and profile information

Account and ordinary profile information remain available while an account is active.

After an account is closed, ordinary account and profile information will normally be removed from active systems within 30 days, except where specific records must be retained for outstanding rewards, payments, security investigations, disputes or legal obligations.

Inactive accounts

If an account has had no meaningful activity for 24 months, WhoMesh may treat it as dormant.

Where appropriate, we will provide at least 30 days' notice before closing a dormant account and allow the user to keep it active.

Requests, referral branches and private messages

Requests, branch-attribution information, participation choices and private messages are retained while the relevant request or conversation is active.

After a request or conversation is closed, ordinary request and message data will normally be deleted or anonymised from active systems within 180 days.

Information that is genuinely required for a pending reward, dispute, fraud investigation or legal claim may be retained separately for the period necessary to resolve that issue.

Unaccepted invitations and non-member information

Information associated with an invitation that is not accepted will normally be removed within 30 days after the related request closes or expires, unless a limited record is necessary to address an abuse report, dispute or legal obligation.

A minimal suppression record may be retained where reasonably necessary to ensure that a person who has refused further invitations is not repeatedly contacted.

Support correspondence

Ordinary support and complaint correspondence will normally be retained for 24 months after the matter is closed.

Information needed for an ongoing legal dispute or regulatory matter may be retained longer where necessary.

Security and access logs

Routine security, access and technical logs will normally be retained for up to 12 months.

A restricted incident record may be kept longer where necessary to investigate or document a significant security incident.

Backups

Deleted data should disappear from routine backup rotation within 30 days.

Backups are not intended to be used to restore deleted personal information into normal active use.

Financial and legal records

Accounting records and supporting documents that OMNIVIA TECH is legally required to retain in France may be retained for 10 years from the end of the relevant financial year.

Records genuinely necessary to establish, exercise or defend a legal claim may be retained for the applicable limitation period or for the duration of the proceeding.

This does not justify indefinite retention of unrelated requests, messages or profiles.

8. Security and important decisions

WhoMesh applies technical and organisational measures intended to protect personal information proportionately to the nature of the information and the risks involved.

These measures may include access controls, authentication, restricted administrative access, logging, provider oversight, backup controls and incident-response procedures.

We do not describe WhoMesh as end-to-end encrypted, and we do not state that authorised operators can never access messages.

Where a personal-data breach triggers notification duties under applicable law, WhoMesh will notify the relevant authority and affected individuals as required.

Users should protect their login credentials and avoid putting confidential information into the shareable part of a request.

Reward attribution and disputed reward-payment decisions include access to human review.

9. Your choices and privacy rights

Depending on your location, the processing involved and applicable law, you may have rights concerning your personal information.

These may include rights to access personal information; correct inaccurate information; request deletion; restrict certain processing; receive certain information in a portable format; obtain information about recipients; object to processing based on legitimate interests; object to direct marketing; and withdraw consent where processing is based on consent.

Where applicable, rights concerning solely automated decisions are also preserved.

You can exercise applicable privacy rights through the Support section of WhoMesh or by contacting support@whomesh.com.

You do not need to maintain a WhoMesh account solely to exercise a privacy right.

We may request additional information only where reasonably necessary to verify identity or understand the request.

Where GDPR applies, we normally respond within one month. Where legally permitted because of complexity or the number of requests, this may be extended by up to two additional months, in which case we will explain the extension within the initial period.

Requests are generally free, subject to exceptions permitted by applicable law.

If we reject or limit a request, we will explain the decision and any applicable complaint rights.

Because OMNIVIA TECH is established in France, where GDPR applies you may complain to the Commission nationale de l'informatique et des libertés (CNIL) or, where applicable, another competent EEA supervisory authority.

Users in other jurisdictions may also have rights to complain to the privacy or data-protection authority that is competent under their local law.

10. People referred by someone else and updates

WhoMesh may sometimes receive limited information about a person from another requester or intermediary.

Where applicable data-protection law requires us to provide privacy information to someone whose information we received indirectly, we will provide that information within the applicable legal period.

Where GDPR applies, this will generally be no later than one month after receiving the information and may be earlier when we first communicate with the person or disclose the information.

An exception will only be used where applicable law actually permits it.

We do not assume that a person has consented to WhoMesh merely because another person supplied their name or suggested them for a request.

A referred person may decline an introduction, ask what source or category of source provided their information where applicable, object to further contact and exercise applicable privacy rights without creating a WhoMesh account.

Declining an introduction is not publicly displayed as an indication that the person is unwilling to help.

We may update this Privacy Notice as WhoMesh, its providers or applicable legal requirements change.

The current version and effective date will be displayed with the Notice.

Where a material change requires additional notice or a new consent, we will provide that notice or request before the new processing begins.

Questions about this Privacy Notice can be submitted through the WhoMesh Support section or sent to support@whomesh.com.