EZCNC Privacy Policy

# EZCNC Privacy Policy This Privacy Policy explains how 1255410 B.C. LTD., doing business as EZCNC (“EZCNC,” “we,” “us” or “our”), collects, uses, discloses and protects personal information through EZCNC.ca, customer accounts, quoting, ordering, support and related services. ## 1. Accountability and contact EZCNC is responsible for personal information under its control. The designated Privacy Officer may be contacted at: - Email: support@ezcnc.ca, subject line “Privacy Request” You may ask questions, request access or correction, withdraw a consent where applicable, or make a privacy complaint using this contact. ## 2. Information we collect Depending on how you use the Services, we may collect: - account and identity information, such as name, email, telephone number, organization and login records; - quote and order information, including dimensions, units, materials, quantities, machining choices, notes and quote history; - uploaded design files and derived technical information, including previews, dimensions, geometry analysis and file-health results; - billing, delivery and transaction information, including addresses, order totals, tax, payment status, refunds and Stripe identifiers; - communications, support requests, feedback, vendor inquiries and order-status messages; - technical and security information, such as IP address, browser, device, timestamps, authentication activity and audit events; and - privacy-respecting product-usage events if optional analytics are enabled, such as page or feature use and generalized funnel progress. EZCNC does not receive or store complete payment-card numbers handled by Stripe. Optional product analytics are designed not to include drawing contents, filenames, raw geometry, customer notes, payment details or unnecessary identifying information. ## 3. How we collect information We collect information directly from you when you upload a file, request a quote, create an account, place an order, contact support, submit feedback or apply as a vendor. We also collect limited information automatically from the website and security systems. Payment status and transaction identifiers are received from Stripe. Delivery or production updates may be received from an assigned EZCNC vendor or carrier. ## 4. Why we use information We use personal information to: 1. operate, secure and troubleshoot the website and accounts; 2. analyze files, generate previews and estimates, and identify files requiring review; 3. create, manufacture, deliver, support and document orders; 4. process and reconcile payments, taxes, refunds and disputes; 5. communicate about quotes, files, accounts, production, delivery and policy changes; 6. assign approved work to production vendors and provide the minimum information needed for fulfilment; 7. prevent fraud, misuse, infringement and security incidents; 8. comply with accounting, tax, legal, regulatory and dispute-resolution obligations; 9. receive and evaluate vendor inquiries and user feedback; and 10. improve the Services through optional, privacy-respecting analytics where consent or another lawful basis is required. We do not use an unpurchased customer upload as an EZCNC Library Asset, sell it, or reuse it as a catalogue design without a separate explicit agreement granting the required rights. Uploaded files may be parsed, converted, analyzed, previewed and otherwise processed automatically for quoting, file-health review, manufacturing preparation, fulfilment and support. Customer-uploaded files are not used to train public AI models and are not reused for unrelated AI training without the customer’s explicit authorization. ## 5. Consent and choices We seek meaningful consent appropriate to the sensitivity and purpose of the information. Information necessary to create an account, provide a quote, fulfil an order, prevent fraud or meet legal obligations is integral to those Services. Optional marketing and non-essential analytics are separate choices and are not conditions of receiving the core Service. You may withdraw consent to optional uses at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal may prevent us from providing a feature that genuinely requires the information. Transactional account, order, security and legal notices cannot be opted out of while the relevant relationship or obligation continues. ## 6. When we disclose information We may disclose personal information to: - an assigned EZCNC production vendor, only to the extent needed to review, manufacture, package, deliver and support an order; - Stripe for payment processing, fraud prevention and transaction administration; - Railway and other infrastructure or private-storage providers that host the application, database and order files; - Resend and Zoho for transactional delivery and human email services; - delivery carriers and service providers needed to complete an order; - professional advisers, insurers, auditors or collection providers where reasonably necessary; and - government, regulatory, law-enforcement or other parties when required or permitted by law, or to protect rights, safety and security. Service providers may use information only for authorized services, subject to their contracts and applicable law. EZCNC does not sell personal information. Vendors may not use customer information for their own marketing or solicit customers outside EZCNC. ## 7. Processing outside British Columbia or Canada Some service providers and systems may process or store information outside British Columbia or Canada, including in the United States. Information processed in another jurisdiction may be subject to that jurisdiction’s laws and lawful access by its authorities. EZCNC remains accountable for information under its control and uses contractual and technical safeguards appropriate to the service and sensitivity. ## 8. Retention and deletion We retain information only as long as reasonably necessary for the identified purposes and applicable legal requirements. Proposed retention schedule for counsel and operational approval: When retention is no longer required, information is securely deleted or anonymized. Backups may retain data for a limited rotation period before deletion propagates. Legal holds, fraud investigations, chargebacks or disputes may extend retention. Account closure does not require deletion of records EZCNC must lawfully retain. ## 9. Safeguards EZCNC uses administrative, technical and physical safeguards proportionate to the sensitivity of the information. Depending on the system and information involved, safeguards include encryption in transit; encryption at rest where supported and appropriate; role-based access controls; authentication safeguards; password hashing; expiring download links; verified payment webhooks; audit logging; backup and recovery procedures; restricted vendor access; and removal of unnecessary customer metadata from vendor production packages. These references describe our risk-based practices and do not guarantee that every safeguard applies identically to every system or that security is absolute. No internet service can guarantee absolute security. If a breach creates a real risk of significant harm or otherwise triggers a legal duty, EZCNC will investigate, keep required records and notify affected individuals and regulators as required. ## 10. Access and correction You may request access to personal information under EZCNC’s control and ask that inaccurate or incomplete information be corrected. We may need to verify identity before responding. Access may be limited where permitted or required by law, including to protect another person’s privacy, confidential commercial information or legal privilege. If access is refused, we will explain the reason where legally permitted and identify available recourse. ## 11. Cookies and similar technologies The site may use cookies or similar technologies in the following categories: - **Essential Cookies:** support authentication, security, session continuity, checkout and other requested core functions. They cannot ordinarily be disabled through the site without affecting operation. - **Functional Cookies:** remember optional preferences or enhance non-essential functionality. - **Analytics Cookies:** help measure generalized use, performance and feature effectiveness. - **Marketing Cookies:** support advertising, campaign measurement or cross-site marketing where implemented. Non-essential functional, analytics and marketing cookies will be described and offered through a consent choice where required by law. Essential Cookies may operate without optional consent where legally permitted because they are necessary to provide requested functionality. Users can also manage cookies through browser settings, although disabling essential storage may prevent parts of the Services from working. First-party analytics should use minimized, generalized events. They must not capture customer drawing contents, filenames, raw geometry, production notes or payment-card information. ## 12. Marketing communications EZCNC sends promotional email only with consent or another basis permitted by applicable anti-spam law. Marketing messages identify the sender and provide a working unsubscribe mechanism. Unsubscribing from marketing does not stop necessary account, quote, order, payment, security or legal communications. ## 13. Children The Services are intended for persons who have reached the age of majority in their jurisdiction. EZCNC does not knowingly create customer accounts for children. Contact the Privacy Officer if you believe a child has provided personal information. ## 14. Automated analysis EZCNC uses automated rules to parse supported files, generate previews, estimate material and machining requirements, and flag ambiguity. These tools support quoting; they do not make legal, employment, credit or similarly significant decisions. Complex or unclear files may be referred for human review. Customers can contact support to question a result or request manual review. ## 15. Privacy complaints and regulatory recourse Please contact the Privacy Officer first so EZCNC can investigate and respond. If the concern is unresolved, you may have the right to contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada, depending on which law applies. ## 16. Changes to this Policy We may update this Policy as practices, providers or legal requirements change. Each version will display an effective date and will be archived. We will provide notice of material changes and obtain new consent where required. Material new uses or disclosures will not be applied merely by silently editing this page.