Privacy Policy

Last updated: October 2026

Hansoft Industries Ltd, Sittingbourne, Kent, United Kingdom ("we", "us") is the data controller for personal data processed through the MachineSafe Compliance Suite at machinesafe.org. Contact: info@machinesafe.org.

1. 1. Data we collect

   • Account data — email address and authentication records when you register or log in.
   • Assessment content — machine descriptions, assessment inputs, evidence metadata and generated reports you create or upload. Avoid including third-party personal data in free-text fields.
   • Billing data — subscription plan and status. Card details are processed directly by Stripe; we never see or store them.
   • Usage and diagnostics — plan/entitlement state, AI generation counts for quota enforcement, error logs, and privacy-respecting page analytics.

2. 2. Why and on what basis (UK GDPR)

   • Contract — operating your account, saving assessments, providing paid features and support.
   • Legitimate interests — security, abuse prevention (rate limits, metering), service improvement and diagnostics.
   • Consent — where you opt into anything optional; withdraw anytime by contacting us.
   • Legal obligation — tax/invoicing records and responding to lawful requests.

3. 3. Subprocessors

   Provider	Purpose	Data
   Supabase	Authentication, database hosting	Account data, assessment content
   Stripe	Subscription billing	Billing data (card details stay with Stripe)
   Vercel	Hosting, serverless functions, analytics	Usage/diagnostics, IP-level logs
   Meta (Muse API)	AI drafts and assistant replies	Machine descriptions and prompts you submit for generation

   Some processing may occur outside the UK/EEA; transfers are protected by appropriate safeguards (e.g. adequacy decisions or standard contractual clauses via our providers).

4. 4. Retention

   Account and assessment data is kept while your account is active. Downgraded accounts keep existing data readable under Free-plan limits. On account closure we retain data for a reasonable export window, then delete or anonymise it, except records we must keep by law (e.g. invoices, typically 6 years for UK tax).

5. 5. Your rights

   Under UK GDPR you may request access, rectification, erasure, restriction, portability, or object to processing, including where based on legitimate interests. Email info@machinesafe.org and we will respond within one month. You may complain to the Information Commissioner's Office (ico.org.uk) if unresolved.

6. 6. Security

   Data is encrypted in transit (TLS) and at rest by our providers; access is restricted by authentication, row-level security policies and need-to-know service credentials. No system is perfectly secure — report suspected incidents to us immediately.

7. 7. Cookies and analytics

   We use only what's needed to run the Service: strictly-necessary session/authentication storage and privacy-respecting aggregated page analytics (Vercel Insights). No advertising trackers.

8. 8. Changes

   We will post updates here with a new "last updated" date and notify users of material changes by email or in-app notice.