Privacy Policy

Last updated: June 3, 2026

MEZnet operates meznet.com and all its products (MEZ Laser, MEZ Cutter and future services). This Privacy Policy describes how we collect, use, store and protect your personal data when you use our services.

We comply with applicable data protection laws in the major global jurisdictions: the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazil's Lei Geral de Proteção de Dados (LGPD), and Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

1. Data Controller

The data controller is MEZnet, operated by Luis Gerardo Garcia Gutierrez, a sole proprietor (persona física con actividad empresarial) established in Juárez, Chihuahua, Mexico. For any privacy or data protection enquiry, you can contact us at:

2. Data We Collect

We only collect the data necessary to provide the service:

Category	Specific data	Service
Identity	Email address; optional username.	Laser Manager
Authentication	Password stored as a bcrypt hash — never in plain text.	Laser
Service usage	Images you upload (not retained after processing), usage history (counters), credit balance.	Laser
Financial	Billing email, transaction ID. Card data is processed by Polar.sh — MEZnet never sees it.	Laser Manager
Technical	IP address, browser type, country, city, pages visited, timestamps.	Desktop MEZLink
Workshop data	Workshop name, phone, WhatsApp, configured payment instructions	Manager
Workshop customers	Name, phone and email of customers registered by the workshop in MEZ Manager	Manager
Orders and quotes	Title, price, quantity, order status and design images uploaded by the workshop	Manager
Anonymous fingerprint	Hash of IP + browser features for free-tier limits. Cannot identify you individually.	Laser Manager

3. Legal Basis and Purposes

We process your data under the following legal bases (GDPR Art. 6):

• Contract performance — to create your account, manage credits and subscriptions, and process images.
• Legitimate interest — to prevent fraud, detect abuse and generate anonymous statistics.
• Consent — for optional marketing communications. You may withdraw consent at any time.
• Legal obligation — to maintain accounting records as required by law.
• Operating MEZ Manager: managing orders, quotes, workshop–customer communication and tracking portal.
• Transmitting images between devices securely and temporarily via MEZLink.

We do NOT use your data for:

• Third-party advertising.
• Training AI/ML models.
• Sale or transfer to third parties for commercial purposes.

4. Data Sharing

We share data only with necessary service providers, under Data Processing Agreements (DPAs):

Provider	Role	Data shared	Location	Safeguard
Supabase	Database	Email, hashed password, credits, history	US / Ireland	Standard Contractual Clauses (SCCs)
Polar.sh	Payment processor	Billing email, transaction data	US	SCCs
Render	Hosting	IP, access logs	US	SCCs
Render (Render Services, Inc.)	Application hosting and design images (MEZ Manager)	Design files uploaded by the workshop	USA	Standard DPA
Polar.sh	Payment processor (MEZ Laser + MEZ Manager)	Buyer's email and billing data	USA	DPA + SCCs (EU Standard Contractual Clauses)

These providers cannot use your data for their own purposes and are contractually required to protect it.

5. International Transfers

Your data may be processed outside your country of residence. For transfers outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring a level of protection equivalent to GDPR requirements.

6. Data Retention

• Active accounts — while your account remains active.
• Processed images — not retained; deleted immediately after processing.
• Payment records — 7 years (legal/tax requirement).
• Access logs — 90 days.
• Deleted accounts — data erased within 30 days, except where legally required to retain.

7. Your Rights

EU/EEA users (GDPR)

• Access (Art. 15) — obtain a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure / 'right to be forgotten' (Art. 17) — request deletion of your data.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent at any time (Art. 7.3), without affecting the lawfulness of prior processing.
• Lodge a complaint with the supervisory authority in your country of residence.

California residents (CCPA)

• Right to know what personal information is collected and how it is used.
• Right to delete personal information (with legal exceptions).
• Right to non-discrimination for exercising privacy rights.

We do not sell, rent or trade personal information.

Brazilian users (LGPD)

You have rights of access, correction, deletion, portability, information on sharing and withdrawal of consent under the Lei Geral de Proteção de Dados (LGPD). To exercise them, contact us at the email below.

Mexican users (LFPDPPP — ARCO Rights)

• Access — know what personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Cancellation — request deletion of your data from our systems.
• Opposition — object to processing of your data for specific purposes.

8. Cookies and Tracking

We use only strictly necessary cookies. We do not use advertising, behavioural tracking or third-party analytics cookies. See our Cookie Policy for full details. Cookie Policy.

9. Security

We implement the following technical and organisational measures:

• HTTPS encryption for all communications.
• Passwords stored as bcrypt hashes (irreversible process).
• Signed webhooks via Standard Webhooks to verify authenticity.
• Rate limiting and abuse detection to prevent unauthorised access.
• Restricted database access — authorised personnel only.

10. Minors

Our services are not directed at children under 13. Users between 13 and 16 in the EU require verifiable parental consent. If we discover that a minor's data has been collected without adequate consent, we will delete it immediately. If you are a parent or guardian and believe your child has provided personal data, please contact us.

11. Automated Decisions

We do not make decisions that produce legal or significant effects on individuals based solely on automated processing (GDPR Art. 22). The usage-limit system is based on anonymous counters, not individual profiles.

12. Changes to this Policy

We will notify you of material changes by email (registered users) or by a prominent notice on the website at least 30 days before they take effect. Continued use of the service after notification constitutes acceptance.

Contact