Privacy notice

Last updated: 24 October 2026

This notice explains how personal data is handled in The Machine's hosted service at app.themachine.computer.

1. Who we are

Salesflare BV, Delacenseriestraat 14, 2018 Antwerp, Belgium, enterprise number 0564.785.369 ("we"). Contact for anything about privacy: support@themachine.computer. To report a security issue: security@themachine.computer.

2. Two roles

  • Controller for your account. We decide how your account, billing and service data are handled. This notice covers that data.
  • Processor for what your machine reads. Your mail, calendar, chats and other sources you connect are processed on your own server, on your behalf. For that data you, or the organization you act for, are the controller where data-protection law applies and we follow your instructions, as set out in the data processing terms.

3. What we collect, why, and on what basis

Account data. Your Google or Microsoft sign-in: name, email address and account ID (for Microsoft, also your organization's ID).

Why: to create your account and let you sign in. Basis: performing our contract with you.

Security data. Your second-factor settings (stored encrypted), recovery codes (stored only as hashes), sign-in sessions (stored only as hashes), and failed sign-in attempts. If you add a passkey, we store its public key, identifier, device or password-manager information and verification counters, never its private key.

Why: to keep your account safe. Basis: our legitimate interest in security, and the contract.

Billing data. Your name, billing address, VAT number if you give one, subscription status and invoices. We also retain the terms accepted, your express immediate-start request and the subscription-confirmation delivery record. Stripe handles your card; we never see the full card number.

Why: to charge you and keep the books. Basis: the contract, and our legal duties under tax and accounting law.

Google and Microsoft access. The account addresses, granted scopes and Work or Personal boundaries for Google and Microsoft accounts you connect. New refresh tokens wait encrypted on our control plane for at most 15 minutes (60 minutes when moving an older sign-in), until your Machine confirms saving them. They then live encrypted on your own Machine. It sends them through our broker to obtain short-lived access tokens; the broker does not retain those requests. Older connections may retain an encrypted refresh token on our control plane until that move completes.

Why: so your server can reach your own mail and calendar. Basis: the contract, at your request.

Zoom and Intercom access. For Zoom accounts you connect, we keep the account address, granted scopes and Work or Personal boundary. Its encrypted refresh token waits in a temporary handoff for at most 15 minutes until your Machine saves it; later token refreshes are relayed without retaining the refresh token. For Intercom, its access token waits encrypted in the setup command until your Machine first reports taking it, when it is removed from those arguments. Your Machine then holds the credential; it reads conversations and can reply as your own Intercom admin only when you approve the exact reply. A shared Fleet connection stays read-only.

Why: to connect the accounts you choose and return their data to your own server. Basis: the contract, at your request.

Enrichment requests. The organization domains your server looks up (never personal mail domains such as gmail.com), the full name and company domain of work contacts it looks up (never email addresses), and how many lookups you make.

Why: to give your machine public company data and keep usage within the fair limit. Basis: the contract, and our legitimate interest in preventing misuse.

Photos. When a work contact has no photo from the lookup, your server asks Gravatar (Automattic, US) for one using a SHA-256 hash of their work address. Gravatar never receives the address itself, but can match the hash to an address it already knows.

Place search. When you type in the Calendar's Where field, your server asks Photon (komoot GmbH, Germany), a free address search on OpenStreetMap data, for matching addresses. It sends the words you typed, which may themselves contain a private address, at most once a second. Like any network request, Photon also receives your server’s IP address and the app’s User-Agent, but no account identifier or other calendar or message fields. Your own earlier places and organizations are suggested first, from your server alone.

Service logs. Sign-ins, changes to your machine (such as created, resized, paused or deleted), its health, and technical errors.

Why: to run the service, fix problems and detect abuse. Basis: our legitimate interest in a reliable and secure service.

The Fleet (beta). When you create or join a Work Fleet or a Family Fleet: which Fleet you are in, your role in it, the name it shows your teammates, invite links (looked up by a hash; an encrypted copy lets its manager copy or send an open invite; it is removed when used or withdrawn, or when the expired invite record is cleaned up), and per question who asked whom, what kind of question and when. Questions and answers between the Machines in a Fleet pass through our control plane: a question is kept until it is answered or expires after at most 3 days; an answer is kept until your Machine acknowledges saving it or it expires after at most 3 days, and their content is not displayed in our administration pages. Machines encrypt and sign all relayed content end to end, and the service accepts nothing else: it holds sealed content and public keys, not the private keys needed to open it. In a Work Fleet, the team Graph (shared Work records and client email) passes through the same way, encrypted and signed end to end: it lives on the Machines, and each sealed item is kept only until every Machine it is for has acknowledged it, or at most 30 days. We keep the statements its admins' Machines sign (whether the team Graph is on, which Work connections it requires, who was taken out of it) while the Fleet exists, and show whether it is on and what it requires to someone invited before they join. We see routing, timing, message size and delivery status. Claims on shared emails are stored as hashes of a Fleet secret and the Message-ID, not the email content or recipient address. We know that secret, so matching hashes reveal matching claims and a Message-ID obtained elsewhere could be tested; these claims are not end-to-end encrypted. If you pair a self-hosted Machine: its label, a hash of its key, when it was last seen, and the work addresses it tells us, so your teammates' Machines recognize them. If a Work Fleet turns on company sign-in: its domain, and per account the company domain Google or Microsoft confirmed at your last sign-in (Google Workspace or a verified Microsoft 365 domain). If you ask to join that Fleet, your request, its outcome, and your name and email for its owner and admins. If a Fleet pays for your Machine (a seat), its owner, as the payer, sees your name, email and the size of your server; never what your Machine holds.

Why: to let your Machine and your teammates' Machines help each other, as you choose. Basis: the contract, at your request.

Friends. Your chosen username, friend requests and their outcome, accepted friendships, blocks, and the paired Machine that answers for you. There is no public username directory. Optional contact discovery lets someone who looks up your exact account email, or a connected mailbox address you leave enabled, find your chosen username, only after you turn discoverability on. Connected addresses are kept as cryptographic representations, not as a plaintext address book; OAuth verifies hosted Google and Microsoft connections, while a paired self-hosted Machine declares its own connected addresses. Shared or conflicting address claims do not resolve to a person. Exact-email lookup does not prove that the requester is already a contact. Lookups use blinded contact values and coarse buckets; we receive the number looked up, then the actual email addresses of successful matches for resolution. We do not receive your whole address book. You can turn either discovery setting off. Friends use the same question-and-answer Network as Fleets, under your separate rules for each friend. An availability answer contains busy time blocks, not event names, attendees or locations. A Network for Friends subscription started before Friends became free adds its billing state until it ends; Stripe handles its payment in the same way as other subscriptions.

Why: to connect the people you choose and relay their permitted answers. Basis: the contract, at your request.

Shared skills and task links. Skills you choose to share travel through the Network like other sealed content; recipients choose whether to install their instructions. Email task links hold a sealed task for at most 30 days. The opening key stays in the link fragment, so anyone you give the complete link can read the task. We record the sender, kind, time and first opening, and whether a new account signs up or a Machine requests the task. These are delivery stages, not proof that the person completed it. Share links only with intended recipients.

Why: to coordinate tasks you choose to share. Basis: the contract, at your request.

Coding-agent results. When you hand a task to your own remote Claude Code session, its final summary, draft, diff and links pass through our control plane so your Machine can retrieve them. We store the result encrypted at rest, a hash of its job ticket, the sending account and Machine, and delivery times. This is not end-to-end encryption: our service holds the key needed to relay the result. It is not displayed in administration pages. Your brief goes through the coding provider you chose, under your agreement with that provider.

Why: to return the result of a task you requested. Basis: the contract, at your request.

Learnings you choose to share. Now and then your Machine may ask to send our team a few general tips it learned from how you use it, to improve The Machine. It is opt-in each time: you see every item first, can edit or remove it, and nothing is sent until you press Send. Your Machine removes known names, addresses, links, numbers, dates and amounts first; filtering is best effort, so you review the exact text before sending. An error log is added only if you tick it and review it. Learnings are encrypted for our team and come from a made-up name, unless you choose to add your email so we can reply. You can turn the asking off in Settings.

Messages to support. What you write to us and our replies. When you report a problem with "Something's wrong?", also its diagnostics, unless you untick them: your server's status, versions, memory, disk and how each source is doing, and the last warnings and errors of its services. These are filtered on your server and again before reaching support to remove quoted text, email addresses, long numbers, link paths and recognizable keys. Filtering is best effort: an unusual log line may still contain personal information. You can leave diagnostics out, and they are deleted after 90 days.

Why: to help you. Basis: the contract, or our legitimate interest in answering you.

Why you canceled. When you cancel or wipe everything, you may tell us why: a reason from a short list, an optional follow-up and anything else you want to write. It is all optional. We keep it with the plan you were on and the date. Your own words may contain personal data, so only write what you are happy for us to read. We pass only the reason category, not your words, to Stripe with the cancellation.

Why: to understand why people leave and improve the service. Basis: our legitimate interest in improving the service.

We do not sell your data, use it for advertising, or use it to train AI models.

4. How long we keep it

  • Account and security data: while you have an account, then 30 days.
  • Connected-account access: until you disconnect the account or delete your machine. Temporary credential handoffs and setup-command secrets are removed as described above; recovery backups follow their stated periods.
  • Your server and everything on it: until 30 days after your subscription ends, or right away when you delete everything. If a payment stays open, until 6 months after your machine was paused for it (see the terms, "Failed payments").
  • Backups of your server: each night your server makes an encrypted backup of your data, stored in Microsoft Azure in the Netherlands (EU). We keep the last 7 daily, 4 weekly and 3 monthly backups, so about 3 months back. They go with your server: deleted right away when you delete everything, and when your server is deleted after your subscription ends. No other copy is kept.
  • Payment reminders: which reminders we sent you, while you have an account.
  • Why you canceled: 2 years. When your account is deleted, the answers are no longer linked to it.
  • Sign-in sessions: 14 days at most.
  • The Fleet: your membership and paired self-hosted Machines until you leave or disconnect them, or your account goes. Questions until answered, at most 3 days; answers until the asker's Machine acknowledges saving them, at most 3 days; who asked whom and when, without content, 30 days; claim hashes 14 days.
  • Discovery: your discoverable account-email and enabled connected-address representations until you disable them, release your username or delete your account; lookup counts for 3 days.
  • Task links: sealed content for at most 30 days; associated delivery metadata for at most 90 days, or earlier when the sending account is deleted.
  • Coding-agent results: until your Machine acknowledges the exact result, or seven days from ticket creation, whichever is earlier. Account deletion removes its live tickets and results. Encrypted control-plane recovery backups expire within 30 days; deleted or expired records must not be restored to active use.
  • Friends: friendships and blocks until you remove them or your account goes; pending requests expire after 30 days, and request history is removed after 90 days. Relayed questions, answers and metadata follow the Fleet periods above. Your username is kept while reserved under the account terms.
  • Invoices and billing records (including accepted contract and withdrawal receipts): as long as Belgian tax and accounting law requires (currently up to 10 years).
  • Service logs: 12 months.
  • Enrichment requests: the daily counts 12 months. We do not keep which domains you looked up; the public company data we fetched is cached without any record of who asked. We do not keep the names we looked up or what came back about a person: it goes straight to your server. To have someone forgotten, use Delete permanently on their page in your dashboard: your server removes their contact profile, direct messages and learned notes, redacts their name and addresses on linked cards, and keeps a keyed hash so they are not added again. Messages belonging to other people, manually saved files, provider originals and existing backups are not all erased by that contact control; contact us for help with a wider erasure request. We do not retain people-enrichment answers in the control-plane enrichment service.
  • Learnings you choose to share: until we have reviewed them. Dismissed items leave the inbox after 90 days, and integrated ones after 1 year. Their original sealed batch is deleted only when every item in that batch has expired; batches with undecided items remain until those items are reviewed. If you added your email, it is removed when your account is deleted; the learning stays without it.
  • Support messages: as long as needed to help you, and at most 2 years after your account ends. A report made with "Something's wrong?" stays on our control plane 12 months at most, its diagnostics 90 days, and goes when your account does.

5. Who receives it

  • Hetzner Online GmbH, Germany, with data centers in Germany and Finland: hosting your server and the Network standby in Germany. The standby receives account/member names and addresses, routing data and authentication hashes (not OAuth credentials or private encryption keys), plus end-to-end sealed messages. Membership changes reach it on the next successful minute sync; during an outage its last copy can remain in use. The same message and metadata retention periods apply there.
  • Microsoft Ireland Operations Limited (Microsoft Azure), with data centers in the Netherlands: hosting our control plane, some customer servers, and the encrypted backups of all customer servers.
  • Stripe, EU and US: payments, invoices and tax.
  • Twilio Inc. (SendGrid), US: sending our emails to you, such as notices about prices, these terms or the service. It receives your name and email address and the email itself. It also delivers your problem reports to our support inbox.
  • Google, EU and US: sign-in, the Google access you grant, and our support inbox.
  • Microsoft, EU and US: sign-in and the Microsoft 365 or Outlook.com access you grant.
  • Cloudflare: DNS for our domain. It does not see your data or the contents of your traffic.
  • Salesflare's lead API, run by us on Google Cloud (Google Cloud EMEA Limited, Ireland) in Europe: looking up public company data for organization domains and public work profiles (job title, company, photo, location, LinkedIn) for work contacts.
  • Automattic Inc. (Gravatar), US: a photo for a work contact without one from the lookup. It receives a SHA-256 hash of their work address, never the address itself (see Photos).
  • komoot GmbH (Photon), Germany: address suggestions for an event's location. It receives the text typed in the Calendar's Where field and ordinary connection metadata (see Place search).
  • Telegram Messenger Inc.: messages from your machine to you, through the bot you set up under your own Telegram account. For users in the EEA and the UK, Telegram stores data in the Netherlands. Our team chat receives a technical support-report reference, not the report's free text or diagnostics. Staff open the report in the authenticated administration page.

Your teammates in a Fleet and accepted friends receive the answers their questions get from your Machine, and only as far as your rules in your dashboard allow: answers start with Ask me first; nothing is shared until you approve an answer or enable a rule. Your Machine keeps a log of every question and answer for you.

A Work Fleet's team Graph is separate from those question-and-answer rules.

  • When it's on. It is off until a Fleet admin turns it on; the admin confirms that the organization may share this mail and has told its people.
  • What goes. When it is on and an admin has confirmed your Machine as a member, your Machine shares Work people, organizations and projects, plus client email threads and their attachments, with the other confirmed members' Machines. For projects on a board the team sees, their meetings, meeting notes and chats go too. Each thread, meeting and chat is sorted first.
  • Automatic filtering. Threads classified as personal or sensitive (such as deals, HR and hiring, legal, health, money and security), automated (receipts, invoices, alerts, newsletters) and colleague-only threads are not shared automatically with the team, not even as a mention that they exist. Classification is best effort and can be wrong; review and correct it with Keep private. Your explicit Team choice can override sensitive or automated classifications.
  • Shared by name. You can share a board, or a single thread, with chosen teammates. Their Machines then get each project's full timeline, sealed only to them: its email threads (sensitive ones too), meetings and meeting notes, Intercom conversations, chats, cards and stage moves. Personal accounts, people in your family or friends, another company's accounts and colleague-only threads stay out. Board sharing alone excludes automated mail, but an explicit thread share can include it. Setting it back to only you takes it back from their Machines.
  • Your choices. You choose which connections take part: the Fleet's own Work accounts start on, another company's start off, and personal accounts are never shared. An admin may require your Work email and calendar of that organization. Nothing goes until you have looked it over and started, and you can keep any thread, person or project private, or unshare it.
  • Removing. Unsharing, turning a connection off or an admin's removal deletes the copies on teammates' Machines when they next sync; someone may have read it before then. What was shared stays on teammates' Machines when someone leaves; leaving or deleting your own account does not erase those copies.
  • Responsibilities. The relevant organization must establish the lawful basis, access rules and notices for this processing, and coordinate wider erasure requests with recipients.

Shared connectors. A confirmed Work Fleet admin may share an Intercom connection with approved members. Its credential is sealed for each recipient Machine, not visible to our relay, and the shared account only reads. Stopping or replacing a share removes it from recipients when their Machines next sync. Because a previous recipient may retain a credential outside the app, an admin must revoke or replace that token at Intercom when access needs to end.

Your AI model provider (such as OpenAI or Anthropic) receives what your machine sends it, under your own account and agreement with them. They are your chosen provider, not ours.

We may also share data when the law requires it, or to protect our rights or the safety of others.

6. Data outside the EU

Your server and our control plane are in the EU. Some recipients, such as Stripe, Google, Microsoft and Twilio (SendGrid), may handle data in the United States, and Telegram is based outside the EEA. For our processor transfers, we use an applicable adequacy decision (including a currently certified EU-U.S. Data Privacy Framework recipient) or the European Commission's standard contractual clauses with the necessary safeguards. Telegram and the AI provider you choose provide their services under your own agreements; the Data Privacy Framework does not cover every provider or country. Ask support for the safeguards applicable to a particular recipient. Transfers to the AI provider you choose fall under your own agreement with them.

7. Google and Microsoft data

The Machine's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide The Machine's features to you, is not used for advertising, is not sold, and is not read by people except with your permission, for security, or where the law requires.

The same applies to data from your Microsoft account: we ask Microsoft only for delegated access you approve (mail, sending what you approve, and your calendar), never for access to your whole organization.

8. Cookies

We use strictly necessary cookies: a session cookie that keeps you signed in, and short-lived cookies that carry a Fleet invite, task link or chosen account page through sign-in. Invite and navigation cookies last at most one day; the task-link cookie at most 30 days. If you add or use a passkey on a device, or choose "Not now" to adding one there, that browser keeps a cookie for up to 400 days so it does not ask again; it holds a one-way hash of the passkey's ID, not your account. These sign-in and navigation cookies are secure and not readable by scripts; the sign-in cookie expires after at most 14 days or when you sign out. A separate functional currency cookie remembers euro or dollars for up to 400 days, initially from your device's time zone or your own selection. The site's scripts can read and update that preference; it contains no account identifier. We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent. Stripe may set its own cookies on its checkout pages.

9. Security

  • Your server is yours alone, in the EU, behind a firewall that lets in only our control plane.
  • All connections use TLS encryption.
  • Your server's disk is encrypted at rest. On Hetzner, its key is kept only on our control plane, and wiping your server destroys it.
  • Google and Microsoft tokens and second-factor secrets are stored encrypted. Session tokens and recovery codes are stored only as hashes.
  • Signing in uses Google or Microsoft plus a second factor, or a previously registered passkey verified by your device. Repeated wrong codes lock sign-in for a while.
  • Your server holds your encrypted mail refresh tokens and uses short-lived access tokens for calls to your accounts.

No system is perfectly secure, but we work to keep your data safe and will tell you if a breach puts it at risk.

10. Your rights

You can ask us to:

  • show you the data we hold about you, and give you a copy;
  • correct it;
  • delete it;
  • restrict or object to processing, including processing based on our legitimate interests;
  • give you your data in a portable format.

Account identity and billing details are required to provide and charge for a hosted subscription; without them we cannot do so. Connecting sources, discovery, diagnostics and cancellation feedback are optional. Disconnecting a source stops future access; you can separately delete retained records on your Machine. Billing, abuse and technical controls can pause a Machine automatically. You may contact support to contest a pause, explain your circumstances and request a human review; these controls do not assess creditworthiness or make employment or other personal eligibility decisions.

You can delete everything yourself, any time, with "Wipe everything now" on your account page, and take a copy of your whole setup with "Export everything". For anything else, write to support@themachine.computer. We answer within one month. We may need to confirm it is you first.

For data in your mail or calendar about other people, you are the controller. If they contact us, we will pass their request on to you.

11. Complaints

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be, or to the authority where you live or work.

12. Children

The service is for adults only. Accounts are for people aged 18 or over. Connected messages, calendars and tasks may contain information about children; account holders must have a lawful basis to process or share it.

13. Changes

We may update this notice. For important changes, we email you before they apply. The date at the top shows the latest version.