Skip to content

Privacy and your data

What Mezaic stores about you and your visitors, where it lives, and how to take it with you.

Mezaic is a product of Zyref, LLC, which is responsible for the data described here. The full privacy policy and terms of service are the legal reference; this page is the plain-language version of what matters in practice.

Your data

  • Your website content (profile, links, posts and subscribers) belongs to you and can be exported at any time as a portable archive. Booking records and Google credentials are not included in website exports.
  • Deleting a website or your account removes it, including images, backups and exports. See Delete a website or account.
  • Payment details are held by Stripe; Mezaic stores only a customer reference and subscription status.
  • Everything you publish is public. It can be read by anyone, indexed by search engines and copied. Do not put sensitive or private information (identifiers, financial or health details, home address, private numbers, credentials, other people’s personal data) on your site or in your Persona notes.

Your visitors

  • Mezaic sets no cookies on your public site. Analytics is measured on the server from the request itself; IP addresses are used to derive a country and a daily-rotating anonymous hash and are never stored. See Analytics.
  • Embedded media (YouTube, Spotify, …) loads only when a visitor clicks play, so no third party is contacted just by opening a page.
  • Fonts are served by Mezaic, not by a font provider.
  • If you add third-party scripts under Custom code, their privacy behaviour is yours to disclose.
  • If you switch on Mezaic Persona, each visitor question is answered by OpenAI’s API. Your published content, your Persona notes, the visitor’s messages in that chat and a hashed network address are sent to OpenAI to generate the reply; under OpenAI’s API policies this data is not used to train its models. Chats are anonymous and kept for 90 days for your review, and the widget tells visitors it is an AI.

Persona on external websites

If you enable Persona embedding, an approved external website loads a Mezaic script and chat frame. The same AI processing and 90-day transcript retention apply, and chats appear in the Mezaic website owner’s Recent chats. The approved host domain is used to check whether the widget may run. The external website’s page content is not automatically read or added to Persona’s knowledge.

The widget does not require third-party cookies or a visitor account. It may use browser storage to resume a conversation; if that storage is blocked, it keeps the conversation state in memory for the current page visit instead. This does not change server-side transcript retention. Owners should disclose the AI chat and link to the privacy policy on the websites where they install it.

Your subscribers and contacts

  • Subscribers confirm by email (double opt-in) and every email has an unsubscribe and preferences link. Their addresses are used only to send what they subscribed to and are included in your export so you can move them.
  • Messages from the contact form and testimonial submissions are visible only to you. Testimonial authors’ emails are never published.

Bookings and Google Calendar

Calendar access is optional. If you connect Google, Mezaic uses your Google account identity and calendar list to show the connected account and let you choose calendars. It checks busy times and manages meetings booked through Mezaic on the calendar you select. Visitors see available slots, not details of your other events.

Mezaic stores encrypted Google credentials, availability settings and booking records, including the guest’s name, verified email, optional note, time zone, meeting time, link and status. Booking details go to the host, guest, Google Calendar and the email provider for invitations, confirmations, changes and reminders. Booking does not subscribe the guest to a newsletter. Google Calendar data is not sent to Persona or used to train AI models.

Pausing bookings stops new appointments without cancelling existing ones. Disconnecting Google removes the stored access credentials and switches off bookings across your websites, while keeping the Google account identity, availability settings and booking history. It does not revoke Google’s permission grant; you can do that separately in Google Account connections. Complete or cancel active appointments and let pending calendar updates finish before disconnecting.

Booking history is removed when its website or account is deleted. Deleting one website leaves the shared Google connection available to your other websites; deleting your account removes the connection too. Already-delivered calendar events and emails remain with Google and the recipients. Website exports exclude bookings, Google credentials and private booking management tokens. For booking-data access or deletion requests, contact support. See Meeting bookings and the full privacy policy.

Where data is stored

Mezaic runs on infrastructure in the EU; images, exports and backups are stored in object storage in a private bucket, with public images served through a CDN.