Privacy policy

There are no analytics, advertising or tracking cookies, and no third-party scripts. The site sets one cookie, Cloudflare's __cf_bm, which the network in front of our hosting provider uses to tell people from bots. It lasts 30 minutes and is used for nothing else.

Like any web server, ours sees your IP address and your browser's details. We use them to keep the site running and to stop abuse, such as too many waitlist sign-ups from one address. Our application logs are kept for three days.

If something breaks in your browser, an error report goes to Sentry, our error-monitoring service, with personal data left out. A small sample of page timings goes the same way.

When you join, we keep your email address; your name and company, if you give them; how big your team is; and the campaign tags in the link that brought you, if there were any.

We use them to invite you to Mechane and to write to you about it, and for nothing else. Only the people at Alchemy Lab who run marketing, and our administrators, can see the list. We keep your entry while the waitlist is open, and delete it whenever you ask.

The form never says whether an address is already on the list, so nobody can use it to find out who signed up.

Each customer has its own deployment: its own application, database and configuration. What goes into it belongs to your organisation, which decides what that is. We handle it on your organisation's behalf, to provide the service, so your organisation's own privacy notice is the one that applies to you. Ask your organisation first; we will help it answer.

• Signing in. You sign in with your organisation's Microsoft account, so we receive your name, your email address, the identifiers Microsoft uses for you and your organisation, and your groups. Someone invited by email gets a one-time sign-in link at that address instead. We also record each sign-in: when it happened, how you signed in, and whether it used multi-factor authentication. The record is kept for 12 months. We also keep a record of each administrative change and export: who made it, when, and whether it was confirmed with multi-factor authentication. We keep it for 12 months. An approval records the same, kept with the approval.
• AI features. Some features use AI models made by Anthropic. Before a feature sends anything to Anthropic, email addresses and phone numbers are replaced and the people in your directory are named by their role and department instead. The software-delivery pipelines are the exception: they send the documents and code they work on as they are, because stripping would break them. The trust page says what can still come through. Under Anthropic's commercial terms it may not train its models on what we send, and neither do we. An organisation can run with AI switched off, or with its own Anthropic key under its own agreement with Anthropic.
• Our access. We look at a deployment's data only to run it and keep it secure, when the law requires it, or when your organisation asks for our help and opens a support session for it. Your organisation can end a session at any time, and each one is recorded.
• Backups. Our hosting provider keeps a daily backup of each database for seven days. Offsite copies, where an organisation has set them up, are kept as its backup settings say. Information deleted from a deployment can remain in a backup until the backup expires.
• Leaving. When an organisation stops using the service, we give it a copy of its database, then delete its deployment and database.

A small number of services run Mechane for us, and each receives only what its job needs: Anthropic, Microsoft (Entra ID + Graph), DigitalOcean, Sentry, Exa, Stripe, Better Stack, GitHub, Doppler, JumpCloud, Backblaze B2, Azure Sentinel. Several apply only when a deployment turns on the feature that uses them. The trust page lists what reaches each one, why, and where.

• Sell personal information, or share it for advertising.
• Use it to train AI models, or let our AI provider do so.
• Run advertising or tracking on this site.

You can ask us what we hold about you, to correct it or delete it, and to stop writing to you. Write to [email protected] with "Privacy" in the subject and we will answer within 30 days. Depending on where you live, the law may give you more rights than these, and we will honour them.

If your request is about information your organisation put into its deployment, we will pass it to your organisation and help it answer, since the decision is its own.

Our servers are in the United States, in New York. If you write to us from another country, your information is handled in the United States.

Everything travels encrypted, and each customer's data is kept in its own database. How we run it, in more detail, is on the trust page.

Mechane is a tool for work. It is not directed at children, and we do not knowingly collect information from anyone under 13.

If this policy changes, the new version will be posted here with a new date. If a change matters to customers, we will tell them before it takes effect.

The Alchemy Lab LLC, [email protected]. Using Mechane is covered by our terms of use.