Data Processing Agreement
This agreement covers one thing: the enquiries your visitors leave in the configurator you have embedded in your own website. Those enquiries are your customers' data. You decide what happens to them; we hold them on your instructions and do what you tell us. Everything below says what that means in practice, and every commitment in it is something the software enforces rather than something we intend.
1. Who is who
You are the controller. The visitor is on your website, the enquiry is addressed to you, and you decide why it is collected and what is done with it.
We are the processor. We hold and deliver that enquiry on your instructions and for no purpose of our own. We do not market to your visitors, we do not add them to our own sales pipeline, and an enquiry captured inside your configurator is never sent to our CRM — a copy exported into our systems could not be undone by a later deletion, so it is not made.
The processor is Elena Denezhkina, who develops and provides Machinae Build and is the same party you contract with under the Terms — not a separate company. Machinae Albae is the house mark the products share, and it is a mark rather than a legal entity: no company of that name is a party to this agreement or to anything else you sign here. A data question or a notice under this agreement reaches that party at cx@machinaebuild.com.
That party is established in Mexico, in the State of Jalisco, at Colonias 362, Guadalajara, Jalisco, Mexico, which is also where post for it goes. Delaware is the law this agreement is read under, stated at the foot; it is not where the party is, and no company is incorporated there or anywhere else.
2. What we process, and for whom
- Contact details your visitor typed: name, email address, phone number and their message.
- What they were looking at: a one-line summary of the building, and a reference to the design itself.
- Which of your sites it came from, an interest score, and the times it was received and delivered.
- A partitioned visitor identifier, which exists so your monthly design allowance can be counted and so one visitor cannot exhaust it. It is scoped by the browser to your website alone.
We do not process special categories of data, we do not profile your visitors, and we do not use their data to train anything. What a visitor types as a building description is sent to our model provider so that a design can be generated — that is the purpose of the product, and the provider is named on Sub-processors.
3. Your instructions
We process on your documented instructions, which are: the settings on your partner account, this agreement, and anything you tell us in writing. Your settings are instructions in the ordinary sense — the retention period you choose, the destination you nominate, and any erasure you request are carried out by the software rather than by somebody remembering to.
If an instruction we receive appears to require us to break a law that applies to us, we will tell you rather than act on it or ignore it.
4. How long it is kept
You choose, between 30 and 1,095 days, and the default is 365. The date is written onto each enquiry when it is captured, so changing the setting later never reaches back: shortening it does not retroactively delete enquiries you already had, and lengthening it does not resurrect ones already deleted. A sweep runs every hour and deletes what has passed its date, whether or not delivery to you ever succeeded.
5. Erasure, and what it cannot reach
You can erase any enquiry at any time. Erasure removes the contact details irreversibly and keeps the row's dates and counts, so your own reporting does not silently change; what remains cannot answer a subject access request. Every erasure leaves a record that it happened, which is what lets you evidence it.
We cannot erase what you have already exported. Once an enquiry has been delivered to your inbox or your CRM, that copy is in your systems, where you are the controller and the obligation is yours. We say this plainly because a promise we cannot keep is worse than the gap it papers over.
6. Confidentiality and our own people
Our staff do not browse your enquiries. Administrative views show counts and dates rather than people, and the one route that displays a contact writes an audit record naming who opened it and when. Access is limited to what is needed to run the service and to answer a delivery failure you have reported.
7. Security
- Everything is served over TLS; the configurator is displayed only on the websites you have listed, enforced by the browser through a per-partner frame policy.
- Enquiries are reachable only through your own credentials. The partner identity comes from the credential presented, never from a parameter, and a request for another partner's enquiry is answered as though it does not exist.
- A CRM token you give us is encrypted at rest with AES-256-GCM and is never shown again — the interface displays a fingerprint and the last four characters.
- Debug logs hold identifiers, a score and an email domain rather than your visitors' details, so that the retention above is not quietly undone by a log file.
- Analytics never load inside your frame, because your visitors are under your consent regime and never saw ours.
8. Sub-processors
The current list, with what each one receives, is at machinaebuild.com/subprocessors and its date changes when the list does. We will tell you before a new sub-processor begins handling your data, using the contact details on your account, and you may object.
That notice is given at least 15 days before the new sub-processor begins. If you object and we cannot reasonably keep providing the service to you without it, you may end this agreement and the subscription it supports without penalty, and we refund what you paid for the period you will not use.
9. Your visitors' rights
Requests come to you, because you are who they gave their details to. What we provide is the means to act on them: read one enquiry, export them, erase one irreversibly, and set how long any of them are kept. We will assist you with a request you cannot satisfy through those, and we will not answer your visitors directly on your behalf unless you ask us to.
10. If something goes wrong
If we become aware of a personal data breach affecting your enquiries, we will notify you without undue delay, with what we know, what we are doing, and what we do not yet know. We will not wait for a complete picture before telling you, because your own notification clock starts when ours does.
A breach notice is sent from cx@machinaebuild.com to the address on your partner account, and a report of one reaches us at the same address — there is no separate security mailbox, and /contact says the same.
That notice is sent within 72 hours of our becoming aware of the breach.
11. When it ends
Every enquiry is deleted on its own retention date whether or not your account is still open, so closing it never leaves data here indefinitely. If you want what remains gone sooner than those dates, ask and we will delete it; if you want to keep it, export it while the account is open, because the export needs a working credential.
Backups age out on their own schedule and are not restored selectively. We say that rather than promising an instant deletion that reaches into them.
12. Transfers
We are established in Mexico, and the service runs in the United States. Its sub-processors operate internationally — each one is named, with what it touches, on the sub-processors page — so your visitors' data may be processed outside the country it was collected in.
Because we are established in Mexico, sending that data to us is a transfer to a party in another country for any partner outside Mexico, a US builder included. Whether that transfer needs a mechanism depends on the law where you and your visitors are; for the EEA and the UK it does.
The mechanism relied on is the standard contractual clauses, for every sub-processor on the sub-processors page.
13. Audit
We will answer reasonable questions about how your data is handled and point at the parts of this service that keep the commitments above. We do not offer on-site audits of the infrastructure our own providers run; for those, their published certifications are what exists.
14. Accepting this
Acceptance is recorded against your partner account with the date and the person who accepted. Your configurator is not enabled for live traffic until that record exists. If your legal team needs a signed counterpart instead of a click, say so and we will handle it as a signature rather than pretending the click is one.
This agreement is governed by the law of the State of Delaware, United States, and a dispute arising out of it is heard in the state or federal courts sitting in Delaware — the same choice as section 15 of the Terms, so the two documents cannot be read against different law. As there, it is a choice of law and not a claim about where we are established.
A signed PDF counterpart of this agreement is available on request from cx@machinaebuild.com for partners whose own legal team requires one.
Where else to look
Sub-processors names everyone who touches this data. Privacy Policy covers what we collect about you as our own customer, which is a different question from this page. Contact is where a data question goes.