Politique de confidentialité

Dernière mise à jour : 3 juin 2026

MEZnet operates meznet.com and all its products (MEZ Laser, MEZ Cutter and future services). This Privacy Policy describes how we collect, use, store and protect your personal data when you use our services.

We comply with applicable data protection laws in the major global jurisdictions: the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazil's Lei Geral de Proteção de Dados (LGPD), and Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

1. Data Controller

Le responsable du traitement de vos données est MEZnet, exploité par Luis Gerardo Garcia Gutierrez, entrepreneur individuel établi à Juárez, Chihuahua, Mexique. Pour toute question relative à la confidentialité ou à la protection des données, contactez-nous à :

2. Data We Collect

We only collect the data necessary to provide the service:

Catégorie	Données spécifiques	Service
Identity	Email address; optional username.	Laser Manager
Authentication	Password stored as a bcrypt hash — never in plain text.	Laser
Service usage	Images you upload (not retained after processing), usage history (counters), credit balance.	Laser
Financial	Billing email, transaction ID. Card data is processed by Polar.sh — MEZnet never sees it.	Laser Manager
Technical	IP address, browser type, country, city, pages visited, timestamps.	Desktop MEZLink
Données de l'atelier	Nom de l'atelier, téléphone, WhatsApp, instructions de paiement configurées	Manager
Clients de l'atelier	Nom, téléphone et e-mail des clients enregistrés par l'atelier dans MEZ Manager	Manager
Commandes et devis	Titre, prix, quantité, statut de commande et images de design téléchargées par l'atelier	Manager
Anonymous fingerprint	Hash of IP + browser features for free-tier limits. Cannot identify you individually.	Laser Manager

3. Legal Basis and Purposes

We process your data under the following legal bases (GDPR Art. 6):

• Contract performance — to create your account, manage credits and subscriptions, and process images.
• Legitimate interest — to prevent fraud, detect abuse and generate anonymous statistics.
• Consent — for optional marketing communications. You may withdraw consent at any time.
• Legal obligation — to maintain accounting records as required by law.
• Exploiter MEZ Manager : gérer les commandes, devis, communication atelier–client et portail de suivi.
• Transmettre des images entre appareils de manière sécurisée et temporaire via MEZLink.

We do NOT use your data for:

• Third-party advertising.
• Training AI/ML models.
• Sale or transfer to third parties for commercial purposes.

4. Data Sharing

We share data only with necessary service providers, under Data Processing Agreements (DPAs):

Fournisseur	Rôle	Données partagées	Localisation	Garantie
Supabase	Database	Email, hashed password, credits, history	US / Ireland	Standard Contractual Clauses (SCCs)
Polar.sh	Payment processor	Billing email, transaction data	US	SCCs
Render	Hosting	IP, access logs	US	SCCs
Render (Render Services, Inc.)	Hébergement de l'application et images de design (MEZ Manager)	Fichiers de design téléchargés par l'atelier	États-Unis	DPA standard
Polar.sh	Processeur de paiement (MEZ Laser + MEZ Manager)	E-mail et données de facturation de l'acheteur	États-Unis	DPA + CCT (Clauses Contractuelles Types UE)

These providers cannot use your data for their own purposes and are contractually required to protect it.

5. International Transfers

Your data may be processed outside your country of residence. For transfers outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring a level of protection equivalent to GDPR requirements.

6. Data Retention

• Active accounts — while your account remains active.
• Processed images — not retained; deleted immediately after processing.
• Payment records — 7 years (legal/tax requirement).
• Access logs — 90 days.
• Deleted accounts — data erased within 30 days, except where legally required to retain.

7. Your Rights

EU/EEA users (GDPR)

• Access (Art. 15) — obtain a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure / 'right to be forgotten' (Art. 17) — request deletion of your data.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent at any time (Art. 7.3), without affecting the lawfulness of prior processing.
• Lodge a complaint with the supervisory authority in your country of residence.

California residents (CCPA)

• Right to know what personal information is collected and how it is used.
• Right to delete personal information (with legal exceptions).
• Right to non-discrimination for exercising privacy rights.

We do not sell, rent or trade personal information.

Brazilian users (LGPD)

You have rights of access, correction, deletion, portability, information on sharing and withdrawal of consent under the Lei Geral de Proteção de Dados (LGPD). To exercise them, contact us at the email below.

Mexican users (LFPDPPP — ARCO Rights)

• Access — know what personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Cancellation — request deletion of your data from our systems.
• Opposition — object to processing of your data for specific purposes.

8. Cookies and Tracking

We use only strictly necessary cookies. We do not use advertising, behavioural tracking or third-party analytics cookies. See our Cookie Policy for full details. Politique de cookies.

9. Security

We implement the following technical and organisational measures:

• HTTPS encryption for all communications.
• Passwords stored as bcrypt hashes (irreversible process).
• Signed webhooks via Standard Webhooks to verify authenticity.
• Rate limiting and abuse detection to prevent unauthorised access.
• Restricted database access — authorised personnel only.

10. Minors

Our services are not directed at children under 13. Users between 13 and 16 in the EU require verifiable parental consent. If we discover that a minor's data has been collected without adequate consent, we will delete it immediately. If you are a parent or guardian and believe your child has provided personal data, please contact us.

11. Automated Decisions

We do not make decisions that produce legal or significant effects on individuals based solely on automated processing (GDPR Art. 22). The usage-limit system is based on anonymous counters, not individual profiles.

12. Changes to this Policy

We will notify you of material changes by email (registered users) or by a prominent notice on the website at least 30 days before they take effect. Continued use of the service after notification constitutes acceptance.

Contact