Privacy Policy

Who we are

This Privacy Policy explains how PnL Mesh ("we", "us") processes personal data when you use PnL Mesh. PnL Mesh is the controller of this data. Send all privacy requests and questions to support@pnlmesh.com.

Where the GDPR applies, this policy also provides the information it requires. PnL Mesh has not appointed an EU representative or data protection officer unless required by applicable law.

What stays on your device

The desktop application does not send telemetry, crash reports, usage analytics, trading data, or exchange API keys to PnL Mesh. API keys and trading settings stay on your computer, and the application connects to exchanges directly.

To update automatically, the application contacts our update server, which receives technical data such as your IP address and application version.

Data we process

We process only the data needed to run accounts, cloud servers, payments, and support.

Account data: email address, password hash, role, status, referral code and relationship, and timestamps.
Google sign-in data: if you sign in with Google, your Google account identifier and email address.
Cloud server data: server region, status, and rental period and, when you run a bot in the cloud, the exchange API keys and bot settings stored on the server allocated to your account.
Payment data: transaction ids, amounts, provider names, invoice URLs, and sanitized provider callback metadata. Trybit does not perform identity verification (KYC) on PnL Mesh users.
Exchange partner data: rebate or commission reports that partner exchanges may share about trading activity attributed to PnL Mesh.
Website usage data: pages viewed, clicks and interactions on the website, referrer and campaign (UTM) parameters, approximate location derived from the IP address, and device and browser type. It is collected without cookies or browser storage.
Technical data: cookies, language and theme preferences, request metadata, device and browser data, and security events.

How we use data

We use data to authenticate you, protect accounts, provide the application, run and update cloud servers, process payments, account for exchange rebates, send notifications, provide support, prevent abuse, and meet legal obligations.

We never need withdrawal-enabled exchange keys. Keys stored on a cloud server are used only to run your bot.

We use website usage data in aggregate to understand how visitors find and use the website and to improve it.

Lawful bases

Where the GDPR applies, we rely on the following lawful bases:

Contract: accounts, sign-in, cloud server rental, payments, support, and service delivery.
Legal obligation: accounting, fraud prevention, and responses to lawful requests.
Legitimate interests: security, abuse prevention, debugging, website analytics, and rebate accounting with partner exchanges, balanced against your rights.
Consent: any optional processing, such as marketing or non-essential cookies, if introduced later.

Service providers and international transfers

PnL Mesh runs on Amazon Web Services (AWS). Cloud bot servers run in the region you choose from Frankfurt (eu-central-1), London (eu-west-2), Tokyo (ap-northeast-1), and Singapore (ap-southeast-1), and parts of our infrastructure run in US East (N. Virginia, us-east-1). We also use Google for sign-in, Trybit for payments, Cal.com for call booking, and PostHog (EU Cloud) for website analytics. We do not use a third-party email provider.

Because of this infrastructure, personal data may be processed outside your country and outside the EEA. Where GDPR transfer rules apply, we rely on the safeguards offered by our providers, such as standard contractual clauses.

Each provider processes data under its own terms and privacy policy. We do not control exchange, wallet, blockchain, Telegram, Google, Cal.com, YouTube, or payment provider systems.

Retention schedule

We keep data only while it is needed for the purposes above or while an account, transaction, dispute, or legal obligation remains active.

Account and sign-in data: while the account is active, then for a limited period for security and audit.
Cloud server data: API keys and bot settings are deleted together with the server when the rental ends or on request.
Payment and rebate data: as long as needed for accounting, chargeback, and fraud prevention.
Technical and security data: for short operational periods, unless needed to investigate an incident.

Security

We use technical and organizational measures to protect data, but no online service, cloud server, or integration can be fully secure.

You are responsible for the security of your own computer, including the API keys used by the desktop application.

Data subject rights

Where the GDPR applies, you may have the right to access, correct, delete, restrict, or port your data, to object to processing, to withdraw consent, and to complain to your local data protection authority.

To delete your account and its data, email us from your account email. Some data may be kept where needed for accounting, security, fraud prevention, or legal claims.

Request handling

Send requests to support@pnlmesh.com from your account email and describe what you need. Requests sent through Telegram are not processed as privacy requests.

We may ask for more information to confirm account ownership. Never send passports, private keys, seed phrases, or exchange API keys.

We aim to respond within 1 month. Complex requests may take up to 2 more months where the law allows, and we will let you know within the first month.