Informativa sulla privacy

Ultimo aggiornamento: 3 giugno 2026

MEZnet operates meznet.com and all its products (MEZ Laser, MEZ Cutter and future services). This Privacy Policy describes how we collect, use, store and protect your personal data when you use our services.

We comply with applicable data protection laws in the major global jurisdictions: the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazil's Lei Geral de Proteção de Dados (LGPD), and Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

1. Data Controller

Il titolare del trattamento dei tuoi dati è MEZnet, gestito da Luis Gerardo Garcia Gutierrez, imprenditore individuale con sede a Juárez, Chihuahua, Messico. Per qualsiasi domanda su privacy o protezione dei dati puoi contattarci a:

2. Data We Collect

We only collect the data necessary to provide the service:

Categoria	Dati specifici	Servizio
Identity	Email address; optional username.	Laser Manager
Authentication	Password stored as a bcrypt hash — never in plain text.	Laser
Service usage	Images you upload (not retained after processing), usage history (counters), credit balance.	Laser
Financial	Billing email, transaction ID. Card data is processed by Polar.sh — MEZnet never sees it.	Laser Manager
Technical	IP address, browser type, country, city, pages visited, timestamps.	Desktop MEZLink
Dati dell'officina	Nome officina, telefono, WhatsApp, istruzioni di pagamento configurate	Manager
Clienti dell'officina	Nome, telefono ed email dei clienti registrati dall'officina in MEZ Manager	Manager
Ordini e preventivi	Titolo, prezzo, quantità, stato ordine e immagini di design caricate dall'officina	Manager
Anonymous fingerprint	Hash of IP + browser features for free-tier limits. Cannot identify you individually.	Laser Manager

3. Legal Basis and Purposes

We process your data under the following legal bases (GDPR Art. 6):

• Contract performance — to create your account, manage credits and subscriptions, and process images.
• Legitimate interest — to prevent fraud, detect abuse and generate anonymous statistics.
• Consent — for optional marketing communications. You may withdraw consent at any time.
• Legal obligation — to maintain accounting records as required by law.
• Gestire MEZ Manager: gestire ordini, preventivi, comunicazione officina–cliente e portale di tracciamento.
• Trasmettere immagini tra dispositivi in modo sicuro e temporaneo tramite MEZLink.

We do NOT use your data for:

• Third-party advertising.
• Training AI/ML models.
• Sale or transfer to third parties for commercial purposes.

4. Data Sharing

We share data only with necessary service providers, under Data Processing Agreements (DPAs):

Fornitore	Ruolo	Dati condivisi	Posizione	Garanzia
Supabase	Database	Email, hashed password, credits, history	US / Ireland	Standard Contractual Clauses (SCCs)
Polar.sh	Payment processor	Billing email, transaction data	US	SCCs
Render	Hosting	IP, access logs	US	SCCs
Render (Render Services, Inc.)	Hosting dell'applicazione e immagini di design (MEZ Manager)	File di design caricati dall'officina	USA	DPA standard
Polar.sh	Elaboratore di pagamenti (MEZ Laser + MEZ Manager)	Email e dati di fatturazione dell'acquirente	USA	DPA + CCS (Clausole Contrattuali Standard UE)

These providers cannot use your data for their own purposes and are contractually required to protect it.

5. International Transfers

Your data may be processed outside your country of residence. For transfers outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring a level of protection equivalent to GDPR requirements.

6. Data Retention

• Active accounts — while your account remains active.
• Processed images — not retained; deleted immediately after processing.
• Payment records — 7 years (legal/tax requirement).
• Access logs — 90 days.
• Deleted accounts — data erased within 30 days, except where legally required to retain.

7. Your Rights

EU/EEA users (GDPR)

• Access (Art. 15) — obtain a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure / 'right to be forgotten' (Art. 17) — request deletion of your data.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent at any time (Art. 7.3), without affecting the lawfulness of prior processing.
• Lodge a complaint with the supervisory authority in your country of residence.

California residents (CCPA)

• Right to know what personal information is collected and how it is used.
• Right to delete personal information (with legal exceptions).
• Right to non-discrimination for exercising privacy rights.

We do not sell, rent or trade personal information.

Brazilian users (LGPD)

You have rights of access, correction, deletion, portability, information on sharing and withdrawal of consent under the Lei Geral de Proteção de Dados (LGPD). To exercise them, contact us at the email below.

Mexican users (LFPDPPP — ARCO Rights)

• Access — know what personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Cancellation — request deletion of your data from our systems.
• Opposition — object to processing of your data for specific purposes.

8. Cookies and Tracking

We use only strictly necessary cookies. We do not use advertising, behavioural tracking or third-party analytics cookies. See our Cookie Policy for full details. Informativa sui cookie.

9. Security

We implement the following technical and organisational measures:

• HTTPS encryption for all communications.
• Passwords stored as bcrypt hashes (irreversible process).
• Signed webhooks via Standard Webhooks to verify authenticity.
• Rate limiting and abuse detection to prevent unauthorised access.
• Restricted database access — authorised personnel only.

10. Minors

Our services are not directed at children under 13. Users between 13 and 16 in the EU require verifiable parental consent. If we discover that a minor's data has been collected without adequate consent, we will delete it immediately. If you are a parent or guardian and believe your child has provided personal data, please contact us.

11. Automated Decisions

We do not make decisions that produce legal or significant effects on individuals based solely on automated processing (GDPR Art. 22). The usage-limit system is based on anonymous counters, not individual profiles.

12. Changes to this Policy

We will notify you of material changes by email (registered users) or by a prominent notice on the website at least 30 days before they take effect. Continued use of the service after notification constitutes acceptance.

Contatto