Legal
Privacy
Last updated 29 October 2026
This page explains what Unfinished Machines (“we”, “us”) does with personal data: on this website, on our customer page at app.unfinishedmachines.com, and in our API and software development kit. Questions go to johnarchibald06@gmail.com.
This website
This website sets no cookies and runs no analytics, advertising or tracking scripts. Our hosting provider, Amazon Web Services, processes your IP address and browser details to deliver the pages and protect them from abuse; we don’t keep access logs for this website. If you email us, we keep your message and address to reply to you.
Two kinds of data in our service
Data our customers send us about their own users. Our customers send us their AI agents’ conversations, which can contain personal data about the people who talked to the agent. For this data we act on our customer’s behalf and only on their instructions (under the GDPR, we are their processor). If you talked to one of our customers’ agents and want to use a privacy right, contact that company; we’ll help them answer you.
Data about the people who use our service. We keep very little: your company’s account (an internal id and a hash of each API key, never the key itself), what you send us by email, and technical logs of each request to our API (IP address, address requested, browser headers other than your key, status and timing). Our services log which company made a request, never its content.
The customer page keeps your API key in your browser’s session storage, or in local storage only if you tick “Keep me signed in”, and sends it only to our server. It uses no cookies.
How we use it
- To provide the service: store your agent’s conversations, judge how each one went, find recurring failures and propose changes for you to review.
- To run and secure the service: authenticate requests, limit abuse and investigate errors.
- To talk with you about your account.
We don’t sell personal data, we don’t share one customer’s data with another, and we don’t use customer data to train AI models.
How we protect conversations
Before we store anything for analysis, and before any AI model sees it, we replace email addresses, bank account numbers (IBANs), card numbers, US social security numbers, phone numbers and common secrets such as API keys and passwords, plus any patterns we agree with you. Names, postal addresses and other identifiers are not caught unless we add patterns for them. We also keep one encrypted raw copy of exactly what you sent, with an encryption key used only for your company.
Who else handles the data
| Company | What it does | Where |
|---|---|---|
| Amazon Web Services | Hosts our servers, databases and file storage, and delivers this website | United States (Ohio); website pages are served from AWS locations worldwide |
| OpenAI | Runs the AI models that analyse conversations, after redaction | United States |
Redaction removes the patterns listed above, but names, postal addresses and other details in a conversation can still reach OpenAI. Under its API terms OpenAI doesn’t train on this data, and keeps it for up to 30 days to monitor for abuse before deleting it. We’ll update this list before we add another company that handles customer data.
All data is stored and processed in the United States. If you send us data from elsewhere, for example the EU or UK, we’ll sign a data processing agreement with the standard contractual clauses on request.
How long we keep it
- Conversations and analysis: for as long as you use the service, until you ask us to delete them or your pilot ends.
- Database backups and disk snapshots: 7 days.
- Server and service logs: 14 days. The web server’s access log is kept until it reaches its size limit, then the oldest entries are removed.
Deletion
Ask us at johnarchibald06@gmail.com and we delete your company’s data within 30 days of your request. On the day we run the deletion, your API keys stop working and we erase your conversations, the raw copies and every analysis of your agent from our live systems. Backups holding your data expire within 7 days after that, and logs within 14 days. The encryption keys for your raw copies are destroyed within 30 days of the deletion, so no remaining copy can be read. We keep only a record that your account was deleted and when. We confirm in writing when the deletion is done.
Your rights
Depending on where you live, you can ask to see, correct, export or delete the personal data we hold about you, or object to how we use it. Email us and we’ll answer within 30 days. You can also complain to your local data protection authority.
Changes
If we change this policy, we’ll update the date at the top, and tell customers by email before a change that affects their data.