Polityka prywatności

Ostatnia aktualizacja: 3 czerwca 2026

MEZnet operates meznet.com and all its products (MEZ Laser, MEZ Cutter and future services). This Privacy Policy describes how we collect, use, store and protect your personal data when you use our services.

We comply with applicable data protection laws in the major global jurisdictions: the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazil's Lei Geral de Proteção de Dados (LGPD), and Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

1. Data Controller

Administratorem Twoich danych jest MEZnet, prowadzony przez Luisa Gerardo Garcię Gutierreza, osobę fizyczną prowadzącą działalność gospodarczą z siedzibą w Juárez, Chihuahua, Meksyk. W sprawach prywatności i ochrony danych skontaktuj się z nami pod adresem:

2. Data We Collect

We only collect the data necessary to provide the service:

Kategoria	Szczegółowe dane	Usługa
Identity	Email address; optional username.	Laser Manager
Authentication	Password stored as a bcrypt hash — never in plain text.	Laser
Service usage	Images you upload (not retained after processing), usage history (counters), credit balance.	Laser
Financial	Billing email, transaction ID. Card data is processed by Polar.sh — MEZnet never sees it.	Laser Manager
Technical	IP address, browser type, country, city, pages visited, timestamps.	Desktop MEZLink
Dane warsztatu	Nazwa warsztatu, telefon, WhatsApp, skonfigurowane instrukcje płatności	Manager
Klienci warsztatu	Imię, telefon i email klientów zarejestrowanych przez warsztat w MEZ Manager	Manager
Zamówienia i wyceny	Tytuł, cena, ilość, status zamówienia i obrazy projektu przesłane przez warsztat	Manager
Anonymous fingerprint	Hash of IP + browser features for free-tier limits. Cannot identify you individually.	Laser Manager

3. Legal Basis and Purposes

We process your data under the following legal bases (GDPR Art. 6):

• Contract performance — to create your account, manage credits and subscriptions, and process images.
• Legitimate interest — to prevent fraud, detect abuse and generate anonymous statistics.
• Consent — for optional marketing communications. You may withdraw consent at any time.
• Legal obligation — to maintain accounting records as required by law.
• Obsługiwanie MEZ Manager: zarządzanie zamówieniami, wycenami, komunikacją warsztat–klient i portalem śledzenia.
• Bezpieczne i tymczasowe przesyłanie obrazów między urządzeniami przez MEZLink.

We do NOT use your data for:

• Third-party advertising.
• Training AI/ML models.
• Sale or transfer to third parties for commercial purposes.

4. Data Sharing

We share data only with necessary service providers, under Data Processing Agreements (DPAs):

Dostawca	Rola	Udostępniane dane	Lokalizacja	Zabezpieczenie
Supabase	Database	Email, hashed password, credits, history	US / Ireland	Standard Contractual Clauses (SCCs)
Polar.sh	Payment processor	Billing email, transaction data	US	SCCs
Render	Hosting	IP, access logs	US	SCCs
Render (Render Services, Inc.)	Hosting aplikacji i obrazy projektu (MEZ Manager)	Pliki projektu przesłane przez warsztat	USA	Standardowe DPA
Polar.sh	Procesor płatności (MEZ Laser + MEZ Manager)	Email i dane rozliczeniowe kupującego	USA	DPA + SCC (Standardowe Klauzule Umowne UE)

These providers cannot use your data for their own purposes and are contractually required to protect it.

5. International Transfers

Your data may be processed outside your country of residence. For transfers outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring a level of protection equivalent to GDPR requirements.

6. Data Retention

• Active accounts — while your account remains active.
• Processed images — not retained; deleted immediately after processing.
• Payment records — 7 years (legal/tax requirement).
• Access logs — 90 days.
• Deleted accounts — data erased within 30 days, except where legally required to retain.

7. Your Rights

EU/EEA users (GDPR)

• Access (Art. 15) — obtain a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure / 'right to be forgotten' (Art. 17) — request deletion of your data.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent at any time (Art. 7.3), without affecting the lawfulness of prior processing.
• Lodge a complaint with the supervisory authority in your country of residence.

California residents (CCPA)

• Right to know what personal information is collected and how it is used.
• Right to delete personal information (with legal exceptions).
• Right to non-discrimination for exercising privacy rights.

We do not sell, rent or trade personal information.

Brazilian users (LGPD)

You have rights of access, correction, deletion, portability, information on sharing and withdrawal of consent under the Lei Geral de Proteção de Dados (LGPD). To exercise them, contact us at the email below.

Mexican users (LFPDPPP — ARCO Rights)

• Access — know what personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Cancellation — request deletion of your data from our systems.
• Opposition — object to processing of your data for specific purposes.

8. Cookies and Tracking

We use only strictly necessary cookies. We do not use advertising, behavioural tracking or third-party analytics cookies. See our Cookie Policy for full details. Polityka cookies.

9. Security

We implement the following technical and organisational measures:

• HTTPS encryption for all communications.
• Passwords stored as bcrypt hashes (irreversible process).
• Signed webhooks via Standard Webhooks to verify authenticity.
• Rate limiting and abuse detection to prevent unauthorised access.
• Restricted database access — authorised personnel only.

10. Minors

Our services are not directed at children under 13. Users between 13 and 16 in the EU require verifiable parental consent. If we discover that a minor's data has been collected without adequate consent, we will delete it immediately. If you are a parent or guardian and believe your child has provided personal data, please contact us.

11. Automated Decisions

We do not make decisions that produce legal or significant effects on individuals based solely on automated processing (GDPR Art. 22). The usage-limit system is based on anonymous counters, not individual profiles.

12. Changes to this Policy

We will notify you of material changes by email (registered users) or by a prominent notice on the website at least 30 days before they take effect. Continued use of the service after notification constitutes acceptance.

Kontakt