Privacy Policy

Last updated: November 11, 2026. The previous version is dated November 4, 2026; see the version history at the end of this policy.

1. Who we are and what this policy covers

This Privacy Policy explains how Machinations S.àr.l., 8 Op Bierg, Mamer, Luxembourg 8217 (“Machinations”, “we”, “us”), processes personal data when you visit machinations.io, use the my.machinations.io app and our other Services, view a Machinations embed on another website, or contact us. Words defined in our Terms of Service have the same meaning here.

We are the data controller for the personal data described in this policy. If you use the Services through a team or organization that has a separate data processing agreement with us, we process the content of that team’s workspace on the organization’s behalf, as its processor, and the organization’s own privacy notice also applies to you.

“Personal data” means any information that identifies you or can be linked to you, directly or indirectly. For questions about this policy or to exercise your rights, write to contact@machinations.io.

2. Personal data we collect

Information you give us:

• Account information: your email address (required), password (stored only as a cryptographic hash), user name, and optionally your first and last name and profile picture.
• Profile and onboarding answers: information you choose to give, such as your company or organization, job title, company size, role and what you want to use Machinations for.
• Billing information: your billing name and address, invoicing email, tax identification number, phone number if you give it, your plan, seats, Credits and payment history. Card and wallet details are collected by Stripe; we receive only limited details, such as the card brand, last four digits and expiry date.
• Your content: diagrams, version history, Plays and their results, dashboards, comments, descriptions and everything else in your User Content, which may include personal data you choose to put in it.
• AI interactions: the prompts and messages you send to the AI Features, the parts of your diagram sent with them, the AI’s answers and Output, whether you applied an answer, your ratings and feedback, and the number of tokens and Credits each request used.
• Attachments and links: files you attach or import into the AI Features (for example images, PDFs, spreadsheets, documents, presentations, archives and app packages), the text we extract from them, and the content of web pages and documents at links you paste.
• Community activity: diagrams you publish, likes, views, remixes, comments and follows.
• Communications: messages you send us by email, chat or forms, including the whitepaper and demo request forms on our website (name, email address, company and whether you want a demo), and your email and notification preferences.

Information we collect automatically:

• Usage data: the features and pages you use, the actions you take (for example creating, Playing, sharing or remixing a diagram), and when.
• Device and log data: your IP address, browser and operating system, device type, language, referring page, approximate location derived from your IP address, request times, error reports and security logs.
• Cookies and local storage: see section 7.
• Embed data: when a Machinations embed is loaded on another website, we record the address of that website and count loads per website. The embed itself does not sign you in or carry your Machinations session.

Information from third parties:

• Sign-in providers: if you sign in with Google, Google gives us your name, email address and profile picture. If your organization uses single sign-on (SAML), its identity provider gives us your identifier, email address and the attributes your organization configures.
• Google Drive and Google Sheets: if you connect them, we access the files and spreadsheets you select or create through the integration, as needed to import or export data; section 5 explains in full how we handle data from Google. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• Payment provider: Stripe tells us whether a payment succeeded and gives us the limited payment details described above.
• Your team: if a team administrator invites you, we receive your email address and role from them.
• Connected Apps: if you connect an AI assistant or other app through our MCP connector or API, we receive the requests it sends on your behalf and information about the connection.

Providing your email address is required to create an account, and billing information is required to buy a paid plan. Everything else is optional, although some features need it to work.

3. How we use personal data and our legal bases

We process personal data only where we have a legal basis under the EU General Data Protection Regulation (“GDPR”) and other applicable laws:

• To provide the Services (create and secure your account, store and Play your diagrams, run the AI Features, sync collaboration, sharing, embeds and Remix, process payments, manage teams and Credits, and provide support): because it is necessary to perform our contract with you (GDPR Article 6(1)(b)).
• To keep the Services safe (prevent fraud, abuse, spam and automated sign-ups, enforce our Terms and limits, investigate incidents): our legitimate interest in protecting the Services, our users and us (Article 6(1)(f)).
• To understand and improve the Services (product analytics, measuring which features are used, evaluating and improving the quality of the AI Features and our instructions using prompts, Output and feedback, debugging): our legitimate interest in developing a better product (Article 6(1)(f)), and your consent where the law requires consent for the cookies or similar technologies involved (Article 6(1)(a)).
• To communicate with you (service messages about your account, security, billing and Credits; notifications, including the weekly summary of activity on your public diagrams; and product news and marketing): performance of our contract for service messages, and our legitimate interest or your consent, as the law requires, for notifications and marketing. You can opt out of non-essential emails at any time.
• To publish and promote Public Content (show it in the Community and on the Website, generate titles, descriptions and thumbnails for it, feature it): performance of our contract and our legitimate interest in running a public community.
• To comply with the law (keep accounting and tax records, answer lawful requests from authorities): our legal obligations (Article 6(1)(c)).
• To establish, exercise or defend legal claims: our legitimate interest (Article 6(1)(f)).

Where we rely on legitimate interests, we have balanced them against your rights, and you can object as described in section 13. Where we rely on consent, you can withdraw it at any time without affecting processing that took place before.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated checks, for example to detect abuse or to estimate Credit use, may restrict an action, and you can ask a person to review the result.

4. AI features and your data

• What is sent. When you use an AI Feature, we send your request, the relevant parts of your diagram and conversation, text extracted from your attachments, and the content of links you paste to our AI model provider, currently Google, through the Gemini API. Files may be held temporarily in the provider’s file storage so the model can read them. The provider processes this data on our behalf to generate the answer.
• Web search and links. Some AI Features may use web search provided by the model provider, which may use parts of your request as search queries. When you paste a link, our servers fetch it from the internet; we do not fetch links to private networks.
• What we store. We store your AI conversations (your messages, the diagram context sent, the answers and their token and Credit counts), your attachments and the text extracted from them, linked to your account and to the diagram, so that you can return to them and so that we can bill Credits, provide support and investigate problems.
• Training. We do not use your private User Content or your prompts to train generative AI models, and our agreements with our AI model providers do not allow them to use your content submitted through the Services to train their models. Providers may retain data for a limited period to detect and prevent abuse, as their terms allow.
• Quality and improvement. Authorized members of our team and our affiliate Machinations Labs may review AI conversations, Output and feedback, and may use them in internal test sets, to provide support, investigate abuse and improve the quality of the AI Features. We limit this access to people who need it. This review does not include Google user data (section 5).
• Public diagrams. We may use AI to generate descriptions, names and thumbnails for Public Content.
• Your choices. Do not include personal data about others, special categories of personal data, or secrets in prompts, attachments or links. You can remove an attachment from a conversation in the app, and you can ask us to delete your conversations as described in section 13.

5. Google user data

This section explains how Machinations accesses, uses, stores, shares and deletes the data we receive from Google when you sign in with Google or connect Google Drive and Google Sheets (“Google user data”). It applies in addition to the rest of this policy; where they differ, this section prevails for Google user data.

What we access.

• Google sign-in (the “email” and “profile” permissions): your name, your email address and the address of your Google profile picture. We use them to create your account and sign you in. We never see or store your Google password.
• Google Drive and Google Sheets, only if you choose to connect them, which is separate from signing in and asks for your permission on its own Google screen:
  • the names and details of files in your Drive, but not their content, so that the file picker can show you your files (the “drive.metadata.readonly” permission);
  • the files you pick in the picker or that Machinations creates for you (the “drive.file” permission);
  • the content of the spreadsheets you choose to import from, read values from, or export and deploy to (the “spreadsheets” permission).

How we use it. We use Google user data only to provide the features you ask for: signing you in and showing your name and picture in the Services; showing your files in the picker; importing a diagram or data from a spreadsheet you choose; reading the live spreadsheet values a diagram of yours uses; and exporting a diagram or the results of your Plays to a spreadsheet you choose. We do not use it for any other purpose.

How we store and protect it. Your name, email address and picture address are stored with your account. Values you import from a spreadsheet become part of your diagram, which is your User Content. To read and write the spreadsheets you choose, we store the access and refresh tokens Google gives us, in our database, linked to your account. Only our servers use them, to act on your request; they are never shown to anyone, and they are never included in what our API or MCP connector returns to an AI assistant. We protect Google user data with the measures described in section 12.

How we share it. We do not sell Google user data, use it for advertising, or transfer it to data brokers or information resellers. We share it only:

• with the service providers that host and run the Services for us (section 9), under contracts that limit them to doing so;
• with our AI model provider, when you yourself use an AI Feature on a diagram that holds data you imported from Google, only to answer your request (section 4);
• with other people, when you choose to share or publish a diagram that holds it (section 6);
• when the law requires it, to protect the security of the Services and their users, or as part of a merger, acquisition or sale of assets, after telling you.

No AI or machine-learning training. We do not use Google user data, including any data obtained through Google Workspace APIs such as Google Drive and Google Sheets, to develop, improve or train generalized or non-personalized artificial intelligence or machine-learning models, and we do not allow our AI model provider or anyone else to do so.

Who at Machinations can read it. People at Machinations do not read your Google user data unless you give us permission for specific data (for example, to help with a support request you send us), it is needed for security purposes such as investigating abuse, it is needed to comply with the law, or it has been aggregated and anonymized for our internal operations. The quality review of AI conversations described in section 4 does not include Google user data.

How long we keep it and how to delete it.

• Your name, email address and picture address are kept while you have an account and are deleted when you delete your account, as described in section 11.
• The Google Drive and Google Sheets tokens are kept until you delete your account, when we delete them, or until you ask us to remove them. You can withdraw Machinations’ access at any time on your Google Account’s Third-party apps and services page; after that, the tokens no longer work. To have them removed from our systems sooner, write to contact@machinations.io.
• Data you imported into a diagram stays in that diagram until you delete the diagram or your account.

Limited Use. Machinations’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Public content and what others can see

Anything you make public can be seen by anyone, including people without an account, and may be indexed by search engines, embedded on other websites and copied through Remix. This includes your public profile (your user name, name and picture if you added them), your public diagrams with their descriptions, your comments on public diagrams, and the fact that you liked or remixed a public diagram where we show it. On the Community plan, your diagrams are public. Copies others have made remain after you make a diagram private or delete your account. Members of your team can see what you share with the team, and team administrators can see the team’s content and members.

7. Cookies, local storage and similar technologies

Cookies are small files a website stores in your browser. Local storage and session storage are similar browser features. We and the providers listed below use them as follows:

• Strictly necessary: keeping you signed in across machinations.io and my.machinations.io, security and fraud prevention (including Google reCAPTCHA on sign-in, sign-up and password reset), payment processing by Stripe, load balancing, remembering your cookie choices, and remembering which website or campaign brought you to Machinations when you create an account (the utm_source, utm_medium and utm_campaign cookies, kept for 180 days). These are needed for the Services to work and do not require consent.
• Preferences: remembering your light or dark theme, open panels, recent diagrams and similar settings in your browser’s local storage.
• Analytics: Google Analytics and Mixpanel measure how this website, the app and public diagram pages are used. Mixpanel also records how you move through the website and the app (clicks, scrolling, the pages you open and what you type into their fields) so that we can see where they are hard to use. Mixpanel is linked to your account identifier when you are signed in. Google may use data collected through Google Analytics as described in its own policies.
• Support: the Intercom chat widget, which may record your use of the pages where it is loaded and keeps a log of chat conversations.

Embeds. A Machinations embed on another website stores your light or dark theme choice in your browser’s local storage. It tells the host page how tall it is so the page can size it; that message contains no personal data. The embed may load Google Analytics. Its share buttons open X, LinkedIn or Reddit only when you click them, and its Remix and “See all possible outcomes” buttons take you to Machinations to sign in or sign up.

The machinations.io website stores your theme choice and similar display settings in your browser’s local storage, and keeps a number in session storage to count anonymously which Home page message led to a sign-up; that count contains no cookie, IP address or other identifier. YouTube videos on the website load from youtube-nocookie.com only after you press play.

Your choices. If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, analytics, session recordings and support chat start only after you allow them in the cookie banner. Elsewhere they are on from your first visit, with no banner, until you turn them off. We tell where you are from your browser’s time zone, not your IP address, and treat every European time zone as needing your consent. One choice covers this website and the app, and you can change it at any time through Cookie settings at the foot of every page of this website or in the app's settings. You can block or delete cookies and local storage in your browser, although some features may then stop working. Where the law requires your consent for non-essential cookies, we rely on it. We do not respond to browser “Do Not Track” signals, because there is no common standard for them.

8. How we share personal data

We do not sell your personal data. We share it only as follows:

• Service providers (subprocessors) that process it on our behalf under contracts that require them to protect it and use it only to provide their services to us. See section 9.
• Our affiliates, including Machinations Labs in Romania, which develops and maintains the Services.
• Other users, as you direct: people you share diagrams with, your team, and everyone, for Public Content.
• Third-Party Services you connect, such as Google Drive or a Connected App, as needed for the integration you choose.
• Authorities and others where the law requires it, or where it is necessary to protect the rights, property or safety of our users, the public or us, to enforce our Terms, or to defend legal claims.
• A buyer or successor, if we are involved in a merger, acquisition, financing, reorganization or sale of assets, subject to this policy.
• With your consent, in any other case.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

9. Service providers

Our current subprocessors are:

• Amazon Web Services: hosting, databases, file storage (including your diagrams and AI attachments) and computing; European Union (Frankfurt).
• Google: the Gemini API that powers the AI Features; Google Analytics; reCAPTCHA; and Google sign-in, Google Drive and Google Sheets when you use them; United States and other countries where Google operates.
• Stripe: payments, subscriptions, invoices and tax calculation; United States.
• Mixpanel: product analytics; United States.
• Intercom: customer support chat and messages; United States.
• Resend: transactional emails, such as account and security emails; United States.
• Machinations Labs (our affiliate): development and maintenance services; European Union (Romania).

When you enter a phone number, the app may send your IP address to an IP geolocation service (extreme-ip-lookup.com) to preselect your country code. Live market data that you add to a diagram is fetched by your browser directly from the data source you choose, such as Binance or OpenSea, which then receives your IP address. We keep the list on our subprocessors page up to date and may add or replace providers, including AI model providers, as the Services change.

10. International transfers

We host the Services in the European Union. Some of our providers, including our AI model provider, process personal data in the United States and other countries outside the European Economic Area. Where those countries are not recognized by the European Commission as providing adequate protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or, where a provider is certified, the EU-U.S. Data Privacy Framework, together with additional measures where needed. You can ask us for more information about these safeguards.

11. How long we keep personal data

• Account, content and AI conversations: for as long as your account is active. When you delete your account, we deactivate it immediately, cancel active subscriptions, delete your name, password, sharing permissions and access keys, and sign you out everywhere. We then delete or anonymize the remaining personal data within a reasonable period, except where we must or may keep it for the purposes below. Public Content and copies others made under section 9 of the Terms are not affected.
• Billing and tax records: for the period required by accounting and tax law, which in Luxembourg is generally ten years.
• Security and server logs: for as long as needed to secure the Services and investigate incidents.
• Marketing data: until you unsubscribe or object, and for a limited period afterwards to respect your choice.
• Records needed for legal claims: until the claim is resolved or the limitation period ends.

Backups are overwritten on a rolling basis. If you want specific data deleted sooner, write to contact@machinations.io.

12. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse and alteration, including encryption of data in transit, hashed passwords, access controls that limit personal data to people who need it, and monitoring. No system is completely secure, and we cannot guarantee the security of your data. You are responsible for keeping your password and access tokens secret. If we become aware of a personal data breach that affects you, we will notify you and the authorities as the law requires. You can report vulnerabilities through our vulnerability disclosure program.

13. Your rights

Depending on where you live, and subject to conditions and exceptions in the law, you have the right to:

• access your personal data and receive a copy of it;
• correct inaccurate or incomplete personal data;
• delete your personal data;
• restrict our processing of it;
• receive the personal data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller (data portability);
• object to processing based on our legitimate interests, on grounds relating to your situation, and object at any time, without giving a reason, to direct marketing;
• withdraw consent at any time where we rely on it; and
• lodge a complaint with a data protection authority, in particular in the country where you live or work or where an infringement took place. Our lead authority is the Commission nationale pour la protection des données (CNPD) in Luxembourg.

You can update much of your information yourself in the app’s settings, export your diagrams, and delete your account. For anything else, write to contact@machinations.io. We will answer free of charge within one month, which the law allows us to extend by two further months for complex requests, and we may ask you to confirm your identity first. If you use the Services through an organization that controls your workspace, we may refer your request to that organization.

14. Additional information for United States residents

If you live in a US state with a consumer privacy law, such as California, you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of its sale, of its sharing for cross-context behavioral advertising, and of profiling with significant effects; and not to be discriminated against for exercising these rights. This policy describes the categories of personal information we collect (identifiers, commercial information, internet and network activity, approximate geolocation, professional information, and the content of your files and messages), their sources, the purposes for which we use them and the categories of recipients. We do not sell personal information and we do not knowingly sell or share the personal information of anyone under 16. Our use of analytics cookies may count as “sharing” under some state laws; you can opt out through Cookie settings at the foot of every page of this website or in the app's settings. To exercise your rights, write to contact@machinations.io. You can use an authorized agent, and we will verify requests before acting on them. If we deny your request, you may appeal by replying to our answer.

15. Children

The Services are not directed to children and are for people aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to contact@machinations.io and we will delete it.

16. Emails and notifications

We send service emails that are necessary for your account, such as confirmations, password resets, security alerts, billing and Credit messages, and team invitations. With your permission or where the law allows, we also send notifications, such as the weekly summary of who liked, viewed or remixed your public diagrams, and product news. You can change your email preferences in the app’s settings or use the unsubscribe link in any non-essential email. We may record whether you open our emails and click their links, to improve them.

17. Third-party websites and services

The Services link to and integrate with websites and services we do not control, such as social networks, Google, single sign-on providers, live market data sources and Connected Apps. Their own privacy policies apply to the data they collect. When you connect an AI assistant to Machinations through our MCP connector or API, the assistant’s provider processes what it receives from us under its own policy.

18. Changes to this policy

We may update this policy, for example when we add features or providers. We will post the new version here and update the “Last updated” date, and if a change is material we will tell you in advance on this page and by a notice in the app; we may also email you, but we are not obliged to. Where a change requires your consent, we will ask for it.

19. Contact

Machinations S.àr.l., 8 Op Bierg, Mamer, Luxembourg 8217. Email: contact@machinations.io.

Version history

• November 10, 2026: moved to its own page, machinations.io/privacy. New section 5, Google user data, says what we access through Google sign-in, Google Drive and Google Sheets, how we use, store, share and delete it, that people at Machinations do not read it except in the cases it lists, and that it is never used to train AI models; the sections after it moved down one number. Section 9, Service providers, no longer lists Customer.io: we closed that account and stopped sending it any data.
• November 4, 2026: section 17 says how we announce changes: on this page and in the app, with email optional.
• October 24, 2026: rewritten to describe the AI Features and the providers they use, attachments and links, Credits, Remix and the Community, embeds, the API and MCP connector, local storage, current service providers (adding Google’s Gemini API, reCAPTCHA and Resend and removing Mailchimp), international transfers, retention, account deletion and the rights of US residents.
• January 23, 2023: previous version.