Privacy Policy

Mepage is the data controller of your personal data within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR) and a "business" under the California Consumer Privacy Act (CCPA).

To exercise any of the rights described below, or to ask questions about your data, contact us at privacy@mepage.cc. We respond to verified requests within 30 days (GDPR) / 45 days (CCPA).

We process personal data only on the following legal bases:

• Performance of a contract — providing your account, hosting your card, and processing bookings you send or receive.
• Consent — loading non-essential analytics identifiers in your browser. You can withdraw consent at any time by clearing site data.
• Legitimate interests — automated content moderation, rate limiting, and security logging to protect the Service and other users.
• Legal obligation — retaining specific records where required by applicable law.

The information we collect is used to: provide and maintain the Service, deliver booking and notification emails, generate aggregated analytics for card owners, prevent abuse and fraud, and respond to your support requests. We never sell your personal information to third parties.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not profile you for marketing purposes.

We share limited personal data with the following subprocessors, each bound by written data processing agreements:

• Neon — hosted PostgreSQL database storing account, profile, and booking records.
• Cloudflare R2 — object storage for user-uploaded images (avatars, covers).
• Resend — transactional email delivery for magic links, booking confirmations, and notifications.
• Sentry — error and performance monitoring. Sentry receives sanitized error metadata only, never full user content.
• Upstash — serverless Redis used for rate limiting and short-lived caches.

We do not transfer personal data to any third party for advertising or cross-site tracking.

To maintain platform safety, Mepage performs automated moderation on user-published text. The moderation runs server-side without human review of complete user content.

• Content scanning: detects sensitive keywords in submitted text.
• Moderation logs: record the moderation result (risk level, matched category) without storing complete content.
• IP logging: moderation logs record the submitter's IP address at the time of submission, used only for security tracing.

Moderation logs are retained for 90 days and then automatically deleted.

Subject to the conditions of the GDPR, you have the following rights:

• Access — receive a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Restriction of processing — ask us to limit how we use your data.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdrawal of consent — withdraw consent at any time without affecting prior lawful processing.
• Right to lodge a complaint — with your local supervisory authority (e.g., EDPB members) before contacting us or after.

To exercise any of these rights, email privacy@mepage.cc with the request and we will verify your identity before responding.

If you are a California resident, you have the following rights under the CCPA as amended by the CPRA:

• Know — request the categories and specific pieces of personal information we have collected about you in the preceding 24 months, the categories of sources, the business or commercial purpose for collecting, and the categories of third parties to whom we disclose.
• Delete — request deletion of personal information we collected from you, subject to exceptions under Cal. Civ. Code § 1798.105.
• Correct — request correction of inaccurate personal information.
• Opt-out of sale or share — Mepage does not sell personal information and does not share it for cross-context behavioral advertising, so no opt-out is necessary.
• Limit use of sensitive personal information — we do not process sensitive personal information as defined by CPRA beyond what is necessary to perform the Service.
• Non-discrimination — we will not discriminate against you for exercising any CCPA right.
• Authorized agent — you may submit a request through an authorized agent with written permission.

Submit CCPA requests to privacy@mepage.cc. We will verify your identity before fulfilling the request.

Your data is stored on our subprocessor infrastructure and protected by industry-standard security measures including TLS in transit, encrypted credentials, scoped access tokens, and least-privilege database roles.

Despite these measures, no system can be guaranteed 100% secure. In the event of a personal data breach affecting your rights, we will notify you and the relevant supervisory authority without undue delay, in accordance with GDPR Art. 33–34.

As a neutral technology service provider, Mepage only provides tools for creating and displaying personal pages and is not responsible for content published by users through this platform.

Users bear full legal responsibility for all content they publish, including but not limited to:

• Truthfulness and legality of content
• Any harm caused to third parties by the content
• Any legal disputes arising from the content

Mepage reserves the right to remove or block violating content, and to restrict or terminate service access for violating users, in accordance with legal requirements or our Terms of Service.