Privacy Policy

1. In short

• Your photos are used only to create your mosaic and print your order. Nothing else.
• They are stored in the EU (Microsoft Azure, Sweden) and deleted when your order is paid, when you press Start over, or after 24 hours without activity.
• No face recognition, no biometric processing, no AI training, no selling of data.
• Analytics only run if you allow them.

2. Data controller

The controller for personal data processed through mezeik.com is Keenear Holding AB (org. no. 556902-0026), Västra Hamngatan 11, 411 19 Göteborg, Sweden, phone +46 73 403 82 76. For any privacy question or to exercise your rights, email legal@mezeik.com or use our contact form.

3. What we collect and why

Photos you upload

Your browser reduces each photo to a small version (and the target image to a larger one) before upload, and removes location and other metadata (EXIF/GPS) in the process. We store these versions, small thumbnails, colour data computed from them, and the generated previews. Purpose: to create your mosaic, preview and print. Legal basis: performance of a contract and steps at your request before a contract (GDPR Art. 6(1)(b)).

Photos you pick from Google Photos

If you choose Google Photos, you sign in with Google and pick photos in Google’s own picker. We request only the scope photospicker.mediaitems.readonly, which gives access to the items you pick and nothing else in your library. We download resized copies of the selected items and treat them exactly like uploaded photos. The access token is kept encrypted only for your session. Legal basis: Art. 6(1)(b).

Orders

Name, email, delivery and billing address, phone number if you give it, company name and VAT or tax ID if you give them, the products, amounts, payment status and invoices. Card details are handled by Stripe and never reach us. Purposes: to deliver the order, invoice it, handle complaints and keep accounts. Legal bases: Art. 6(1)(b), and legal obligation under the Swedish Bookkeeping Act (Art. 6(1)(c)).

Contact form

Name, email, subject and message. Purpose: to answer you and handle notices about content. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f)), or Art. 6(1)(b) if it concerns an order.

Technical data

IP address, browser type, request logs and the country derived from your IP address (used only to suggest a delivery country and currency). Purposes: security, fraud and abuse prevention, rate limiting of the contact form, and fault finding. Legal basis: legitimate interest (Art. 6(1)(f)).

Analytics

Only if you accept analytics cookies: Google Analytics 4 via Google Tag Manager measures page views and use of the site. Before you choose, Google Consent Mode is set to “denied” and no analytics tags are loaded. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time.

4. No profiling, face recognition or AI

The mosaic is created by deterministic colour matching: the same photos always give the same result. We do not use face recognition, biometric identification, profiling or automated decision-making with legal effects, and your photos are never used to train any model. The mosaic software is not an AI system under the EU AI Act; if that ever changes we will assess it and update this policy first.

5. Who we share data with

We use the following processors and partners, all bound by data processing agreements. We never sell personal data.

Photos are uploaded directly from your browser to our storage in Sweden and never pass through Vercel. When data is transferred outside the EU/EEA, it is protected by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. We may also disclose data to authorities when required by law, for example when reporting illegal content.

6. How long we keep data

7. Google user data

Mezeik’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Photos you pick are used only to create and print your mosaic, are not transferred to others except as needed to provide this service (our storage and print partner, as described above), are not used for advertising, and are not read by humans unless you ask us to, it is needed for security, or the law requires it. You can revoke Mezeik’s access at any time in your Google Account settings.

8. Your rights

• Access — get a copy of the personal data we hold about you (Art. 15).
• Rectification — have inaccurate data corrected (Art. 16).
• Erasure — have data deleted when it is no longer needed or processed unlawfully (Art. 17). Photos can be deleted at any time with Start over in the editor.
• Restriction — have processing limited while a dispute is resolved (Art. 18).
• Data portability — receive data you gave us in a machine-readable format (Art. 20).
• Objection — object to processing based on our legitimate interests (Art. 21).
• Withdraw consent — at any time, for example in the cookie settings, without affecting earlier processing (Art. 7(3)).
• Complain — to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or the supervisory authority where you live.

Email legal@mezeik.com or use the contact form. We answer within one month. We may need to verify your identity, for example with your order number.

9. Security

All traffic is encrypted (TLS). Storage and databases are encrypted at rest and located in Sweden. Upload links are short-lived and limited to your session, previews are watermarked, and full-resolution files are never sent to the browser. Access is limited to what each system needs.

10. Cookies

We use necessary cookies to run the site. They do not require consent. Analytics cookies are only set if you accept them. Your choice is stored for 12 months and you can change it at any time.

Cookie settings

11. Changes

We will update this policy when our processing changes and show the date of the latest version at the top of this page.