Privacybeleid

Laatst bijgewerkt: 3 juni 2026

MEZnet operates meznet.com and all its products (MEZ Laser, MEZ Cutter and future services). This Privacy Policy describes how we collect, use, store and protect your personal data when you use our services.

We comply with applicable data protection laws in the major global jurisdictions: the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazil's Lei Geral de Proteção de Dados (LGPD), and Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

1. Data Controller

De verwerkingsverantwoordelijke is MEZnet, geëxploiteerd door Luis Gerardo Garcia Gutierrez, eenmanszaak gevestigd in Juárez, Chihuahua, Mexico. Voor vragen over privacy of gegevensbescherming kun je contact met ons opnemen via:

2. Data We Collect

We only collect the data necessary to provide the service:

Categorie	Specifieke gegevens	Dienst
Identity	Email address; optional username.	Laser Manager
Authentication	Password stored as a bcrypt hash — never in plain text.	Laser
Service usage	Images you upload (not retained after processing), usage history (counters), credit balance.	Laser
Financial	Billing email, transaction ID. Card data is processed by Polar.sh — MEZnet never sees it.	Laser Manager
Technical	IP address, browser type, country, city, pages visited, timestamps.	Desktop MEZLink
Werkplaatsgegevens	Naam werkplaats, telefoon, WhatsApp, geconfigureerde betalingsinstructies	Manager
Klanten van de werkplaats	Naam, telefoon en e-mail van klanten geregistreerd door de werkplaats in MEZ Manager	Manager
Bestellingen en offertes	Titel, prijs, hoeveelheid, bestelstatus en ontwerpsafbeeldingen geüpload door de werkplaats	Manager
Anonymous fingerprint	Hash of IP + browser features for free-tier limits. Cannot identify you individually.	Laser Manager

3. Legal Basis and Purposes

We process your data under the following legal bases (GDPR Art. 6):

• Contract performance — to create your account, manage credits and subscriptions, and process images.
• Legitimate interest — to prevent fraud, detect abuse and generate anonymous statistics.
• Consent — for optional marketing communications. You may withdraw consent at any time.
• Legal obligation — to maintain accounting records as required by law.
• MEZ Manager exploiteren: bestellingen, offertes, communicatie werkplaats–klant en trackingportaal beheren.
• Afbeeldingen veilig en tijdelijk overdragen tussen apparaten via MEZLink.

We do NOT use your data for:

• Third-party advertising.
• Training AI/ML models.
• Sale or transfer to third parties for commercial purposes.

4. Data Sharing

We share data only with necessary service providers, under Data Processing Agreements (DPAs):

Aanbieder	Rol	Gedeelde gegevens	Locatie	Beveiliging
Supabase	Database	Email, hashed password, credits, history	US / Ireland	Standard Contractual Clauses (SCCs)
Polar.sh	Payment processor	Billing email, transaction data	US	SCCs
Render	Hosting	IP, access logs	US	SCCs
Render (Render Services, Inc.)	Applicatiehosting en ontwerpsafbeeldingen (MEZ Manager)	Ontwerpsbestanden geüpload door de werkplaats	VS	Standaard DPA
Polar.sh	Betalingsverwerker (MEZ Laser + MEZ Manager)	E-mail en factureringsgegevens van de koper	VS	DPA + SCK's (EU-standaardcontractbepalingen)

These providers cannot use your data for their own purposes and are contractually required to protect it.

5. International Transfers

Your data may be processed outside your country of residence. For transfers outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring a level of protection equivalent to GDPR requirements.

6. Data Retention

• Active accounts — while your account remains active.
• Processed images — not retained; deleted immediately after processing.
• Payment records — 7 years (legal/tax requirement).
• Access logs — 90 days.
• Deleted accounts — data erased within 30 days, except where legally required to retain.

7. Your Rights

EU/EEA users (GDPR)

• Access (Art. 15) — obtain a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure / 'right to be forgotten' (Art. 17) — request deletion of your data.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent at any time (Art. 7.3), without affecting the lawfulness of prior processing.
• Lodge a complaint with the supervisory authority in your country of residence.

California residents (CCPA)

• Right to know what personal information is collected and how it is used.
• Right to delete personal information (with legal exceptions).
• Right to non-discrimination for exercising privacy rights.

We do not sell, rent or trade personal information.

Brazilian users (LGPD)

You have rights of access, correction, deletion, portability, information on sharing and withdrawal of consent under the Lei Geral de Proteção de Dados (LGPD). To exercise them, contact us at the email below.

Mexican users (LFPDPPP — ARCO Rights)

• Access — know what personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Cancellation — request deletion of your data from our systems.
• Opposition — object to processing of your data for specific purposes.

8. Cookies and Tracking

We use only strictly necessary cookies. We do not use advertising, behavioural tracking or third-party analytics cookies. See our Cookie Policy for full details. Cookiebeleid.

9. Security

We implement the following technical and organisational measures:

• HTTPS encryption for all communications.
• Passwords stored as bcrypt hashes (irreversible process).
• Signed webhooks via Standard Webhooks to verify authenticity.
• Rate limiting and abuse detection to prevent unauthorised access.
• Restricted database access — authorised personnel only.

10. Minors

Our services are not directed at children under 13. Users between 13 and 16 in the EU require verifiable parental consent. If we discover that a minor's data has been collected without adequate consent, we will delete it immediately. If you are a parent or guardian and believe your child has provided personal data, please contact us.

11. Automated Decisions

We do not make decisions that produce legal or significant effects on individuals based solely on automated processing (GDPR Art. 22). The usage-limit system is based on anonymous counters, not individual profiles.

12. Changes to this Policy

We will notify you of material changes by email (registered users) or by a prominent notice on the website at least 30 days before they take effect. Continued use of the service after notification constitutes acceptance.

Contact