Privacy notice

Who we are

Machine Standard (“we”, “us”) is an applied AI systems lab based in New Jersey, United States. We are responsible for the information described in this notice. You can reach us at andy@machinestandardusa.com.

This notice covers this website only. It does not cover any product we may release later; a product that handles your data will carry its own notice.

Information we collect

Information collected automatically. When you load a page, our analytics provider records an anonymous, aggregate data point. It may include the timestamp, the page path, the referring URL, an approximate location derived from the request (country, region, city), and general device, browser, and operating-system information. Before a pageview is sent, this site strips query strings and URL fragments, so anything after ? or # is never transmitted. Our hosting provider also processes request data, including IP address, as needed to deliver and secure the site.

Information you choose to send us. If you email us, we receive your email address, your message, and anything else you put in it. Email is the only way to reach us from this site: there is no contact form and no chat.

A contact endpoint exists at /api/connect but is disabled— it accepts nothing and returns “not found”. If we ever re-enable it, we will update this notice first and describe exactly what it stores before it stores anything. Any records it created while it was reachable contain the submitted email, name, and company, the length and a one-way digest of the message, the delivery outcome, and salted one-way hashes of the sending IP address and user agent, which were used only to rate-limit abuse. The message text itself was never stored in those records, and you can have any record about you deleted by asking.

What we do not collect. There are no visitor accounts, logins, or passwords on this site, and no newsletter or waitlist signup. Nothing is for sale here, so we do not collect payment card or billing information. We do not run advertising trackers, and we do not buy personal information about you from third parties.

Why we use it

We use this information to operate, secure, and debug the site; to understand aggregate traffic patterns, such as which pages are read and roughly where readers are; to reply to you if you contact us; and to prevent abuse of our contact endpoint. We do not use it to build profiles of individuals, to advertise to you, or to make automated decisions about you.

If you are in the European Economic Area or the United Kingdom, we process this information on the basis of our legitimate interest in running and securing a website and in responding to people who contact us. Where you send us a message, processing is also necessary to act on your request.

Categories of third parties

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use a small number of service providers who process information on our instructions:

• Vercel— hosting, content delivery, and Web Analytics. Vercel states that Web Analytics uses no third-party cookies, that data points are not associated with an IP address, and that the visitor hash derived from the request is discarded after 24 hours. See Vercel's Web Analytics privacy documentation.
• Resend — email delivery. Used by the contact endpoint described above; with that endpoint disabled, it currently carries no visitor mail.
• Supabase — storage of any contact-request records described above, in a private schema in a United States region.

We may also disclose information if we are legally required to, or where necessary to investigate abuse or protect our rights. If we ever add a provider that changes what is collected, this section changes with it.

Cookies and similar technologies

This site sets no cookies. Our analytics are cookieless, and we use no local storage for tracking, no advertising pixels, and no third-party scripts — the site's content security policy blocks them by default. Because we set no cookies, there is no cookie banner to click.

Do Not Track and Global Privacy Control

We do not track you across other websites or over time, so there is nothing for a Do Not Track (DNT) or Global Privacy Control (GPC) signal to switch off. We do not change site behavior based on those signals; we treat them as already satisfied, because we neither sell personal information nor share it for targeted advertising for any visitor, whether or not a signal is present.

How long we keep it

Aggregate analytics are retained by Vercel for the period associated with our plan and are not tied to you. Contact-request records are kept only as long as we need them to respond to you and to maintain a short abuse-prevention trail, and we delete them on request. Email you send us lives in our founder mailbox until we delete it.

Your rights, and how to use them

Depending on where you live, you may have the right to access a copy of the personal information we hold about you, to correct it, to delete it, and to object to or restrict certain processing. We extend these on request to anyone who asks, regardless of where they live.

To exercise any of them — including reviewing or requesting changes to information you have sent us — email andy@machinestandardusa.com and say what you would like us to do. We will respond within 45 days. In practice we hold very little: unless you have emailed us or posted to the contact endpoint, we most likely hold no information that identifies you at all, and we will tell you so. We will not treat you differently for making a request.

If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

Children

This site is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, email us and we will delete it.

Security

The site is served over HTTPS with HSTS, sends a strict content security policy, denies framing, and uses least-privilege credentials for the providers above. Contact-request records store one-way hashes rather than raw IP addresses or user agents. No system is perfectly secure, and we do not claim otherwise.

Where your information is processed

We are based in the United States and our providers process this information in the United States. If you visit from outside the United States, the information described here is transferred to and processed in the United States, where privacy laws differ from those in your country.

Changes to this notice

If we make a material change — for example, if we begin collecting a new category of information or add a service provider — we will update this page, change the effective date at the top, and describe what changed. The current version is always at this URL. Material changes are not applied retroactively to information already collected.

Contact

Questions, requests, or corrections: andy@machinestandardusa.com. Please do not send passwords, secrets, or sensitive personal information by email.