Privacy Policy
Last updated: October 21, 2026
This policy explains what personal data we collect when you use the machined.ai website and the Machined.ai app (together, the "Service"), why we collect it, who we share it with, and your rights. By using the Service, you agree to this policy.
We follow the UK GDPR, the EU GDPR and the California Consumer Privacy Act (CCPA).
Who we are
The Service is run by Sibu Ventures Ltd ("we", "us"), which is the data controller for your personal data.
Registered office: Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom
Company number: 14958943
Contact: privacy@machined.ai
What we collect
What you give us
When you sign up, use the Service or contact us, you may give us:
- Contact details: your name, business name, email address and website.
- Login details: passwords, authentication data and any API keys you add.
- Payment details: these go to our payment provider, Stripe, which meets the card industry's security standard (PCI-DSS), and are never stored on our servers (Stripe's privacy policy).
What we collect automatically
- Usage data: your IP address, browser, the pages you visit and when, how long you spend on them, and device identifiers.
- Approximate location: we never ask for your precise location. Some of our providers (Intercom, PostHog, Sentry and Vercel) work out your rough location, such as country or city, from your IP address. We use this to route support, produce overall analytics, fix errors and stop abuse. Stripe also uses the billing address you give it, for payments and tax.
What we received when we acquired Machined.ai
We acquired Machined.ai in November 2025. With it, we received:
- existing users' account data, including their billing history, so we could keep providing the Service to them
- their contact details and email preferences, so we only email people as they chose (see Emails we send)
Requests about our copy of this data come to us. If your request concerns data the previous owner still holds, such as a refund for a payment made to them, we'll give you their contact details so you can contact them directly.
Cookies
We never use cookies for advertising or to track you across other sites. In this section, "cookies" also includes similar browser storage, such as local storage.
On our website (machined.ai)
- Affiliate links: if you arrive through a partner's link, we ask whether we can set a cookie to credit them if you sign up. It lasts 30 days. If you say no, nothing is set. Our affiliate provider is Tolt.
- Analytics: we use PostHog to count visits. On our website it doesn't use cookies or store anything on your device.
- Embedded videos and charts: some articles include Flourish charts or YouTube videos. A Flourish chart loads with the page, so Flourish receives your IP address and browser details and may collect data under its own privacy policy (Flourish's privacy policy). A YouTube video loads nothing from YouTube until you press play. It then plays in YouTube's privacy-enhanced mode, and YouTube may store data on your device and collect data under its own privacy policy (Google's privacy policy).
We don't store anything on your device when you visit our website, and YouTube stores nothing unless you play a video, so we don't show a cookie banner. We only ask if you arrive through an affiliate link.
In the Machined.ai app
- Sign-in (Supabase): essential cookies that keep you signed in and your session secure.
- Site access: essential cookies for password or maintenance access, where needed.
- Product analytics (PostHog): cookies that show us which features are used, linked to your account. Email privacy@machined.ai if you'd like this turned off for your account.
- Abuse prevention (Fingerprint): a device identifier stored with your account, used only to spot duplicate signups (see Automated decisions).
How we use your data
- To run, maintain and improve the Service
- To tell you about updates and changes
- To let you use interactive features
- To provide support
- To understand how the Service is used, so we can improve it
- To keep the Service secure and working
- To take payments and meet our contract with you
- To meet our legal obligations
- To protect our rights, for example if there's a legal dispute
Emails we send
- Account emails: sign-in codes, security alerts, billing alerts and legal notices, such as changes to this policy. You can't turn these off while your account is open.
- Service emails: product onboarding, updates about changes to the product you use, and occasional requests for feedback. Turn them off any time in your notification settings or with the link in the email.
- Marketing emails: SEO and AI search tips, feature news and offers. We only send these if you agree, for example at signup. The exception is customers in the US who signed up before April 28, 2026: as US law (CAN-SPAM) allows, we email them until they opt out. Unsubscribe any time with the link in the email or in your settings. We never send marketing for other companies.
Closing your account doesn't unsubscribe you from marketing emails. Use the unsubscribe link, or ask us to delete your data.
When you turn off an email type, we keep a record of your choice so it sticks. You can turn off each type of service and marketing email separately, or all of them at once; account emails continue while your account is open.
We also keep a do-not-contact list of people who asked the previous owner to stop emailing them, so we never send them service or marketing emails, even if their address reaches us another way. It holds only the email address, where the request came from, and when.
Our legal reasons
Data protection law requires a legal reason for each use of your data. Ours are:
| Use | Legal reason |
|---|---|
| Your account and the Service | Our contract with you (Art. 6(1)(b)) |
| Account emails | Our contract with you (Art. 6(1)(b)) |
| Service emails | Our legitimate interests (Art. 6(1)(f)) |
| Marketing emails | Your consent (Art. 6(1)(a)). For US customers who signed up before April 28, 2026: our legitimate interests (Art. 6(1)(f)) in emailing existing customers, which US law (CAN-SPAM) allows until you opt out. |
| Do-not-contact list | Legal obligation (Art. 6(1)(c)) and our legitimate interests (Art. 6(1)(f)) |
| Affiliate cookies | Your consent (Art. 6(1)(a)) |
| Customer testimonials (name, words and photo; email privacy@machined.ai to have yours removed) | Your consent (Art. 6(1)(a)) if you gave the testimonial to us; our legitimate interests (Art. 6(1)(f)) if we quote something you posted publicly |
| Analytics and improving the Service | Our legitimate interests (Art. 6(1)(f)) |
| Legal and compliance | Legal obligation (Art. 6(1)(c)) |
| Fraud prevention, security and protecting our rights | Our legitimate interests (Art. 6(1)(f)) |
Who we share data with
We use these providers to run the Service. Each has a data processing agreement with us. Providers based outside the UK and EU, including those that store data in the EU, are covered by Standard Contractual Clauses unless noted below; email privacy@machined.ai for a copy. We may also share data if the business is sold, or where the law requires it.
| What for | Providers |
|---|---|
| Hosting and infrastructure | Supabase (EU), Vercel (US), Render (US), Inngest (US) |
| AI writing and research | Anthropic, OpenAI, Google Gemini, OpenRouter, Perplexity (all US), Langfuse (EU) |
| AI image generation | OpenAI, Google Gemini, OpenRouter (all US), Black Forest Labs (EU/US) |
| Research, keyword and stock image data | Firecrawl, Serper, DataForSEO, Keywords Everywhere, ProAPIs / SerpsBot, YouTube Data API, Unsplash, Pexels (all US) |
| Payments and billing | Stripe (EU), ChartMogul (EU) |
| Loops (US, EU-US Data Privacy Framework and its UK extension) | |
| Customer support | Intercom (US) |
| Analytics and error tracking | PostHog (EU), Sentry (US) |
| Fraud prevention | Fingerprint (EU) |
| Affiliate tracking | Tolt (US) |
Anthropic, OpenAI, Google, OpenRouter and Langfuse don't train AI models on your data under our agreements with them. Perplexity and Black Forest Labs may use prompts and outputs to improve their services (Perplexity, Black Forest Labs). We only send these providers what's needed to do what you asked.
How long we keep data
- Account data: while your account is open, and up to 3 years after you close it.
- Payment records: 7 years, for tax and accounting law.
- Marketing data: until you withdraw consent. We review inactive contacts after 2 years.
- Compliance records: records that show we've met our legal obligations, kept for as long as we may need to show it.
- Device identifier: as long as your account exists, then deleted with your account data.
- Refused signups: 30 days, in case you ask us to review the decision.
Data sent outside the UK and EU
Some of your data is processed outside the UK and EU. When it is, we protect it with the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or, for US providers certified under it, the EU-US Data Privacy Framework and its UK extension. The EU recognizes the UK as giving adequate protection, so data can move from the EU to the UK without extra safeguards. For a copy of the Addendum or Clauses we use, email privacy@machined.ai.
Your rights
Depending on where you live, you have the right to:
- Access: get a copy of the data we hold about you
- Rectification: have inaccurate or incomplete data corrected
- Erasure: have your data deleted (sometimes called the right to be forgotten)
- Restriction: limit how we use your data
- Portability: receive your data in a format you can take elsewhere
- Objection: object to direct marketing, or to our use of your data based on legitimate interests
- Withdrawing consent: at any time, without affecting anything we did before
Email privacy@machined.ai and we'll reply within one month.
You can also complain to a regulator: in the UK, the Information Commissioner's Office (ICO); in the EU, your local data protection authority.
Our EU representative
Our representative in the EU, for regulators and anyone in the EU with a question or request about their data, is Data Privacy and Security Services Ltd (trading as Data Privacy Services), at info@dataprivacyservices.co.uk.
California residents
Under the CCPA, you have the right to:
- Know what personal information we collect and how we use it
- Ask us to delete it
- Opt out of its sale or sharing (we don't sell personal data)
- Get the same service and prices if you use these rights
Email privacy@machined.ai to make a request.
Children
The Service is not for anyone under 18, and we don't knowingly collect their data. If you think a child has given us data, email privacy@machined.ai and we'll delete it.
Security
We protect your data with industry-standard security, and only people who need access to it have it.
Automated decisions
To stop people opening extra accounts for repeat free trials, we check each new signup automatically, using your device and browser details, a device identifier from Fingerprint, and your IP address. If the device already has an account, the signup is refused with no person involved.
If you think we got it wrong, email support@machined.ai. A person will review it, hear your side, and reverse it if we were wrong. Stripe also runs its own automated fraud checks on card payments.
Links to other sites
We link to other websites. We're not responsible for their content or how they handle your data, so check their privacy policies.
Changes to this policy
We may update this policy. We'll post any changes here and update the date at the top. If you keep using the Service after a change, you accept the new version.
Contact us
Questions about this policy or your data: privacy@machined.ai, or Sibu Ventures Ltd, Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom.