Privacy Policy

• Name and email (optional): When you arrive via a QR campaign landing page (/welcome), a modal invites you to share your full name and email. Both fields are optional. If provided, we use them to follow up about our services.
• Voice messages: You may record a voice message through our in-browser voice widget. Your audio is transcribed on your device using an on-device speech recognition model (running via WebAssembly or WebGPU). The transcript is sent to us; the raw audio is sent to our object storage only if you are not located in a state with biometric voice statutes (currently Illinois, Texas, and Washington). See Section 4 for details.
• Email in voice messages: You may optionally provide an email address alongside a voice message so we can reply.
• Correspondence: When you contact us at welcome@mezmur.tech, we retain the content of your communications.
• Consulting engagement data: If you engage our consulting services, we may collect business information, workflow documentation, system access credentials, and project-related materials you share with us.

• Visit data: When you arrive via a QR campaign link (/go/{code}), we record a visit row containing a random token (stored in your browser's localStorage), the campaign code, a timestamp, and your user-agent string.
• IP address and coarse geolocation: We derive your IP address from HTTP headers. We also derive city-level geolocation (city, region, postal code, country) from edge network geo headers. This is approximate, carrier-grade location data, not GPS-precise.
• Dwell and engagement metrics: On our QR landing page, we track how long the page is visible (seconds_visible), how long you are actively interacting (active_seconds, capped at 30 minutes), and whether you launched the 3D viewer.
• First-party analytics: We use first-party web analytics for aggregate pageview counting.
• Third-party analytics and advertising data: We use Google Analytics, Microsoft Clarity, and the Meta Pixel on our public pages. These tools use cookies and similar technologies to collect device information (browser, operating system, screen size), usage information (pages viewed, clicks, scrolls, taps, mouse movement, time on page), approximate location, and the site events described in Section 10. Microsoft Clarity additionally records session replays (a reconstruction of how you interacted with a page) and generates heatmaps. Our internal operations portal is excluded from all third-party tracking. See Section 10 for details, cookie names, and opt-out options.
• Cookies and local storage: We use localStorage to store a random visit token (mz-visit) and a session flag (mz-welcome-seen). Cookies set by our third-party analytics and advertising partners are described in Section 10.

• Campaign partners: If you arrive via a referral or affiliate link, we may receive basic information from the referring partner.
• Authentication: Our internal operations portal uses a third-party authentication provider. This provider processes login credentials for authorized admin users only. No public visitor data is shared with the authentication provider.

We use on-device AI for voice transcription and may use AI-powered tools (including large language model providers) to assist in consulting engagements and content production. We do not use your personal information to train generalized, public AI models. Any AI subprocessors we engage are contractually limited to providing the specific service you are using, and your data is not used to improve their general models.

We require our service providers to protect your information consistent with this Privacy Policy and applicable law. We do not sell your personal information for money. However, some of the analytics and advertising tools above involve disclosures that qualify as "sharing" under certain U.S. state privacy laws — see Section 9.2 for details and your opt-out rights.

• Business transfers: In the event of a merger, acquisition, or asset sale, your information may be transferred as a business asset.
• Legal compliance: We may disclose your information to law enforcement or government authorities if required by law or if we believe disclosure is necessary to protect our rights, property, or safety.
• With your consent: We may share information with third parties when you direct us to do so.

You have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your personal information.
• Object to or restrict certain processing of your data.
• Withdraw consent for processing based on consent (without affecting prior processing).
• Receive a copy of your data in a portable format.

To exercise these rights, contact us at privacy@mezmur.tech. We may ask for information to verify your identity before fulfilling your request. We will respond within 45 days.

California residents have the right to:

• Know what personal information is collected, the sources, the business purpose, and the categories of third parties with whom it is shared.
• Request deletion of personal information.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information.

Sale and sharing: Mezmur does not sell your personal information for money. However, we use third-party analytics and advertising cookies (Google, Microsoft Clarity, and the Meta Pixel) that transmit identifiers and activity data to those providers, and some of these disclosures may constitute "sharing" for cross-context behavioral advertising under the CCPA/CPRA. The categories involved are: identifiers (cookie IDs, IP address) and internet or network activity (pages viewed, interactions with our site).

Right to opt out of sharing: You may opt out at any time by:

• Enabling the Global Privacy Control (GPC) signal in your browser or a browser extension — we honor GPC as a valid opt-out of sharing.
• Using the vendor and industry opt-out tools listed in Section 10.
• Emailing privacy@mezmur.tech with the subject "Opt Out of Sharing."

We do not use or disclose sensitive personal information for purposes beyond providing the services you request. We do not knowingly sell or share the personal information of consumers under 16 years of age.

To submit a verifiable consumer request, contact privacy@mezmur.tech. Authorized agents may submit requests on behalf of a California resident with written permission.

Residents of states with comprehensive privacy laws (including but not limited to Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) have rights substantially similar to those described above. We do not sell personal data for money, and we do not profile individuals through automated means for decisions with legal or similarly significant effects. Our use of third-party advertising cookies may constitute "targeted advertising" under some of these laws; you may opt out using any of the methods described in Sections 9.2 and 10, including the Global Privacy Control signal.

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR, UK GDPR, or Swiss nFADP:

• Access, rectification, erasure, restriction, objection, and data portability.
• Withdraw consent at any time (without affecting prior lawful processing).
• Lodge a complaint with your local data protection authority.

Our lawful bases for processing are:

• Contractual necessity: To provide services you have requested.
• Legitimate interests: To operate and improve our business, detect fraud, and secure our platform.
• Consent: For optional activities like marketing communications, voice message recording, and non-essential cookies.
• Legal obligation: To comply with applicable laws and regulations.

Where required by applicable law (including ePrivacy rules), we set non-essential cookies and similar tracking technologies only with your consent, and you may withdraw that consent at any time.

For international data transfers, we rely on Standard Contractual Clauses and applicable adequacy mechanisms.

As an Arizona-based business, we process personal information in accordance with Arizona state law. Arizona residents may contact the Arizona Attorney General's office for privacy-related complaints.

• localStorage: A random visit token (mz-visit) to link campaign visits to form submissions. A session flag (mz-welcome-seen) to avoid showing the welcome modal twice.
• First-party web analytics: Aggregate pageview tracking via first-party analytics. No cross-site identifiers.

You can clear localStorage by clearing your browser's site data for mezmur.tech.

We use the following third-party tools on our public pages. Our internal operations portal is excluded from all of them.

Events we send to these tools: page views, the campaign code from a QR scan, lead form submissions, the fact that a voice message was submitted (and its duration), and 3D viewer launches. We do not send them your name, your email address, or the contents or transcript of your voice message.

Session replay: Microsoft Clarity records how you interact with a page and reconstructs it as a session replay. Text you type into form fields is masked by default. Microsoft may also use data collected by Clarity for its own purposes, including advertising, as described in Microsoft's privacy statement. Similarly, Meta may use data collected by the Pixel for its own purposes, including improving its advertising products, as described in Meta's privacy policy.

• Global Privacy Control (GPC): We honor GPC browser signals as a valid opt-out of the "sharing" of personal information where required by law.
• Vendor opt-outs: Use the links in the table above, or the industry tools at aboutads.info/optout and optout.networkadvertising.org.
• Browser controls: You can block or delete cookies in your browser settings and clear site data for mezmur.tech at any time. Blocking these cookies does not affect your ability to use our website.
• Do Not Track: Legacy DNT signals never gained an industry-standard meaning, and we do not respond to them; we honor the Global Privacy Control signal instead.