Privacy Policy
Mezaic is a product of Zyref, LLC (“Zyref”, “we”), which is the controller of the personal data described here. This policy explains what we collect, why, and the choices you have. It covers the platform (mezaic.co), the portal, websites published through the Service (“sites”), and Mezaic Persona embedded on approved external websites.
1. What we collect
Account data: your name, email address, hashed password (we never store the password itself), and the one-time codes used to confirm your email or reset your password.
Support requests: the contact form sends your name, email address, subject and message through our email provider to our support inbox so we can respond. It does not subscribe you to marketing emails.
Content: everything you add to your sites: profile, links, posts, updates, work history, images, custom scripts, domains, and the private notes you give Mezaic Persona. Published Content is public by design; do not put sensitive or private information in it (see the Terms of Service, section 3).
Persona chats: when a site owner switches on Mezaic Persona, we store each visitor chat (the messages, timestamps and a hashed network address used for rate limiting) for 90 days so the owner can review how it answered, plus monthly token counters. Visitors are not identified; no account is needed to chat.
Persona on external websites: owners may enable the same Persona on approved external domains. Those pages load a Mezaic script and chat frame, and the chat data and retention described above also apply there. The embedding domain is used to enforce the owner's approved-domain list. The external page's content is not automatically read or added to Persona's knowledge. The widget does not require third-party cookies or a visitor account. It may use browser storage to resume a conversation; where that storage is unavailable, it keeps conversation state in memory for the current page visit. Server-side transcripts are still subject to the 90-day retention period.
Generated files: CV PDFs rendered from a site’s published content, kept in a few recent versions on our media storage until replaced or the site is deleted.
Billing data: your plan, subscription status and Stripe customer reference. Card details are entered on Stripe’s pages and never reach our servers.
Bookings and Google Calendar: connecting Google is optional. When you connect, we access your Google account identifier and email address, calendar identifiers and details needed to list your calendars (such as names, time zones and access permissions), busy intervals on calendars you select, and details of meeting events created through Mezaic. We use Google’s free/busy service for conflict checks, which returns occupied times rather than the titles, descriptions or attendees of unrelated events. Google’s event permission allows access to events on calendars you own; Mezaic uses it to manage meetings booked through the Service.
We store your connected account identifier and email, encrypted OAuth access and refresh tokens, calendar selections, availability settings, and booking records. These records include the meeting title and description, guest name, verified email, optional note, host and guest time zones, meeting times, Google event identifier, meeting link and booking status. Booking verification requests also contain a hashed network identifier to limit abuse. Google credentials and private booking records are not published on your website.
Portal usage: server logs with IP address, browser, requested URL, status and timing, kept for up to 30 days for security and debugging.
Visitor analytics for sites: when someone views a site or opens a link we record the page, referrer, UTM parameters, country/region/city (derived from the IP address, which is then discarded), device type, browser, operating system and language, plus a visitor identifier derived from a daily-rotating salted hash of the IP and browser. We set no cookies on sites and do not store raw IP addresses. Raw events are kept for the period allowed by the site owner’s plan; aggregated daily statistics are kept longer.
2. Why we use it
To provide and secure the Service (accounts, publishing, custom domains, backups), to bill paid plans, to show site owners how their sites perform, to send transactional email (codes, receipts, payment problems, export notices), and to comply with legal obligations. We do not sell personal data and do not use it for advertising.
Google Calendar and meeting bookings
We use Calendar access to display available times, create meetings with guest invitations and an optional Google Meet link, process rescheduling and cancellation, and synchronize changes to those meetings from Google Calendar. Encrypted refresh tokens let us maintain this connection while you are signed out, including for calendar updates and reminders. One Google connection is shared across the websites owned by your Mezaic account.
Booking details are shared with the host and guest, Google Calendar and our transactional email provider as needed to deliver the meeting, invitations, confirmations, changes and reminders. A guest’s optional note is included in the calendar event and the host’s notification. Booking emails let the host and guest reply to each other, so their email addresses are shared. Google processes information it receives under its Privacy Policy. Meeting-management links allow access to the associated booking and should be kept private. Booking a meeting does not subscribe the guest to a newsletter.
Google Calendar data is not sold, used for advertising, sent to Mezaic Persona or used to train AI models. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
3. Processors we rely on
We share data only with providers that help run the Service, under contracts that limit their use of it: Stripe (payments, tax, receipts; Stripe may act as merchant of record), Cloudflare (DNS, TLS certificates, image and backup storage), Brevo (transactional email delivery), OpenAI (answers for Mezaic Persona: when a site owner enables it, the site’s published content, the owner’s Persona notes, the visitor’s messages in that chat and a hashed network identifier are sent to OpenAI’s API to generate each reply; under OpenAI’s API policies this data is not used to train its models and is retained for up to 30 days for abuse monitoring; see OpenAI’s privacy policy), and DB-IP (offline IP-to-location database; no data is sent to them). Our servers are operated by our hosting provider in the European Union.
4. Site owners and their visitors
Site owners may embed third-party scripts (for example Google Analytics) in their sites; those scripts are governed by the site owner’s and the third party’s privacy practices, not by this policy. If you are a visitor to a site published with Mezaic, contact the site owner for questions about their processing.
5. Retention
Account data is kept while your account exists and deleted within 30 days of account deletion, except billing records, which we keep as long as tax and accounting law requires. Content is deleted when you delete it, the site, or the account; backups and exports expire on the schedule shown in the portal. One-time codes are deleted after 24 hours. Persona chat transcripts are deleted after 90 days (owners can delete them sooner); Persona knowledge documents are rebuilt from current content and not kept separately.
Booking records remain until the associated website or account is deleted, or a deletion request is fulfilled. Expired booking verification requests are normally removed by background cleanup once they are more than 24 hours old. Website content exports do not include booking records or Google credentials; contact us or email support@mezaic.co for access to or deletion of booking data.
You can pause new bookings without cancelling existing meetings. Before disconnecting Google or deleting a website or account, complete or cancel active appointments and allow pending calendar updates to finish. Disconnecting clears the OAuth tokens from Mezaic’s active connection and disables new bookings across your websites; it does not delete the saved account identifier and email, availability settings or historical bookings. Account deletion removes the saved connection identity; deleting a website removes that website’s booking settings and history.
You can independently revoke Mezaic’s authorization at any time in your Google Account connections. Revoking access stops Mezaic from accessing Calendar once the authorization is invalid, but does not cancel meetings or delete booking records. Calendar events and emails already delivered remain with Google and their recipients under their respective retention settings. See the bookings guide for pausing, disconnecting and reconnecting.
6. Your rights
Depending on where you live you may have the right to access, correct, export, restrict or delete your personal data, to object to processing, and to complain to a supervisory authority. You can export your website content from the portal. Account deletion is also available there once active bookings and pending calendar changes have been resolved. For other requests, or if you cannot resolve a booking before deletion, email support@mezaic.co and we will respond within 30 days.
7. Security
All traffic is encrypted in transit (TLS), passwords are hashed with Argon2id, sessions are bound to secure, HttpOnly cookies, and access to production systems is restricted. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.
8. Cookies
The platform and portal use a single strictly necessary session cookie to keep you logged in. Published sites set no cookies of our own.
9. Changes and contact
We will post updates here and notify you of material changes by email or in the portal. Questions or requests about this policy or your data go to Zyref, LLC at support@mezaic.co or through our contact form.