Meshy

GDPR overview

GDPR handling is documented rather than merely claimed. The privacy policy names Meshy as data controller, cites Article 6(1)(b) as the legal basis for European users, and designates an Article 27 representative: Instant EU GDPR Representative Ltd. in Lucan, Ireland, with a separate UK representative in Brighton. Access, rectification, erasure, objection and the right to complain to a supervisory authority are all set out, with a stated response window of up to thirty days. Transfers outside Europe rely on standard contractual clauses or binding corporate rules where no adequacy decision applies. The API page advertises ISO/IEC 27001 and SOC 2 Type II certification alongside a public Drata trust centre. Note that its wording, GDPR certified, is marketing shorthand: GDPR is a regulation, not a certification scheme.

Who owns the data?

Meshy's Terms of Use assign ownership of generated assets to the user, but the licence depends on the plan. Paid subscribers own every model they create and hold full commercial rights, including distribution and resale. Free-plan outputs are instead granted under a CC BY 4.0 licence: they may still be sold, but Meshy asks for attribution on the commercial listing. Ownership is conditional in both cases, since the Terms require that the materials used during generation do not infringe anyone else's copyright. Separately, Aggregated Statistics — anonymised, aggregated usage data — and the intellectual property rights attached to them remain the exclusive property of Meshy LLC, which may publish them.

Reuse rights

On a paid plan the answer is straightforward: the models are yours, you need no further permission, and you may use them in commercial games, products, films, 3D prints and client work, or sell them on third-party marketplaces. On the free plan reuse is still permitted, including resale, but the CC BY 4.0 licence means Meshy must be credited. One restriction cuts the other way: the Terms forbid using generated assets to train, develop or improve AI models that compete with Meshy. In the opposite direction, Meshy reserves the right to use inputs and outputs from non-Enterprise customers to train, validate, test or improve its own services, unless a signed Order says otherwise.

Data retention & training

Hosting summary

Meshy states that web app data is stored with Amazon Web Services in the United States. That claim is consistent with the technical evidence: the domain resolves to 44.250.101.71, an address operated by Amazon (AS16509) and geolocated in Boardman, Oregon. Users in mainland China are told explicitly that their information is stored overseas in the US, with Meshy LLC named as recipient and support@meshy.ai as the contact point. No European or Asian hosting region is offered as an alternative. For European users, transfers outside the EEA are covered by appropriate safeguards where no adequacy decision applies — the privacy policy names EU standard contractual clauses and third-party binding corporate rules. The company holds ISO/IEC 27001 and SOC 2 Type II certification and publishes a trust centre hosted on Drata. No list of named subprocessors is published, only broad categories of service providers, so anyone needing a full data map will have to request one.