Privacy Policy
This policy explains what information Mechanism collects, how we use it, and the choices you have. It covers our website, our waitlist, and the Mechanism workspace.
Last updated: 7 August 2026
Information we collect
We collect the following categories of information:
- Account information. Your name, email address, username, and password (stored only as a cryptographic hash). If you join our waitlist before launch, we collect the email address you submit.
- Documents and content you provide. Files you upload to your workspace, the text extracted from them, and the questions you ask our assistant.
- Usage information. Log data such as IP address, browser type, pages viewed, and timestamps, which we use to operate and secure the service.
- Communications. Messages you send us by email or through support channels.
We do not intentionally collect special categories of personal data. Please avoid uploading documents containing such data unless it is necessary for the matter you are working on.
How we use your information
We use the information described above to:
- provide, maintain, and improve the Mechanism service;
- create and manage your account and authenticate your access to it;
- process the documents you upload so you can search, review, and ask questions about them;
- respond to your support requests and communicate with you;
- detect, investigate, and prevent fraud, abuse, and security incidents; and
- comply with our legal obligations.
We do not sell your personal information, and we do not use the contents of your documents for advertising.
Your documents and AI processing
Mechanism uses artificial intelligence to help you work with your documents. Understanding how that works matters, so we want to be specific:
- Indexing. When you add a document to your workspace, we extract its text, split it into passages, and generate numeric representations (embeddings) so relevant passages can be retrieved when you ask a question.
- Answering questions. When you ask a question, we send your question together with the relevant passages from your documents to our AI model providers so they can generate a response.
- Training. We do not use the contents of your documents to train our own models, and we contract with our model providers on terms that prohibit them from training their models on your content.
- Isolation. Your documents are indexed to your own workspace and are not used to answer other customers’ questions.
Our current AI subprocessors are listed in section 6. We will update that list before adding a new subprocessor.
Legal bases for processing
If you are in the United Kingdom or the European Economic Area, we rely on the following legal bases under the UK GDPR and EU GDPR:
- Performance of a contract — to provide the service you have signed up for.
- Legitimate interests — to secure our service, prevent abuse, and improve how Mechanism works, where those interests are not overridden by your rights.
- Consent — for optional communications such as product updates, which you can withdraw at any time.
- Legal obligation — where we must retain or disclose information to comply with the law.
Data retention
We keep your information for as long as your account is active. When you delete a document, we remove it and its derived index entries from our production systems promptly; residual copies may persist in encrypted backups for up to 30 days before being overwritten.
When you close your account, we delete or anonymize your personal information within 30 days, except where we are required to retain it to comply with a legal obligation, resolve disputes, or enforce our agreements.
Waitlist email addresses are retained until launch or until you ask us to remove them, whichever comes first.
Security
We take the confidentiality of your documents seriously and use technical and organizational measures designed to protect them, including encryption in transit (TLS), encryption at rest, access controls that limit which staff can access customer data, and authentication using short-lived access tokens.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any relevant regulator as required by law.
Your privacy rights
Depending on where you live, you may have the right to access a copy of your personal information, correct inaccurate information, delete your information, object to or restrict certain processing, receive your information in a portable format, and withdraw consent you previously gave.
To exercise any of these rights, email hello@getmechanism.com. We will respond within the time required by applicable law. You also have the right to lodge a complaint with your local data protection authority.
If you are a California resident, you have the rights described in the CCPA/CPRA, including the right to know, delete, and correct personal information, and the right not to be discriminated against for exercising those rights. Mechanism does not sell or share personal information as those terms are defined under the CCPA.
International data transfers
Mechanism is operated from the United States, and our infrastructure is hosted in Amazon Web Services data centers located in the United States. If you access the service from another country, your information may be transferred to, stored in, and processed in the United States.
Where we transfer personal information out of the UK or EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
Children's privacy
Mechanism is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us at hello@getmechanism.com and we will delete it.
Changes to this policy
We may update this policy from time to time. If we make material changes, we will update the “last updated” date above and notify you by email or through the service before the changes take effect. Your continued use of Mechanism after that point means you accept the revised policy.
Contact us
If you have questions about this policy or how we handle your information, contact us at hello@getmechanism.com.
Mechanism, Inc.
14 Wall Street, 20th Floor
New York, NY 10005
United States