Privacy Policy

Machines Like Me GmbH ("MLM", "we", "us", "our") believes that protecting the security and privacy of your personal data is important. This Privacy Policy explains how we collect, store, use, disclose and transfer (hereinafter "process") your personal data. The personal data that we collect about you depends on the context of your interactions with us, the products, services and features that you use, your location, and applicable law.

Unless stated otherwise on a specific page, the controller responsible for processing your personal data under this Privacy Policy is:

We have appointed an external Data Protection Officer: Philip Essinger — dsb@datenschutz-berater-muenchen.de, +49 89 461389-0.

Categories of personal data processed, and purpose of the processing

When visiting our external and internal websites or using our applications or services (each an "Offering"), we may process the following categories of personal data:

• Your contact information, such as full name, address, telephone number, mobile phone number and email address;
• Organizational information, including job position and company name;
• Information submitted as part of a support request, demo request, survey, comment or forum post;
• Further personal data that you provide by filling in forms in our Offerings;
• Information on your interaction with the Offering, including your device and user identifier, information on your operating system, sites and services accessed during your visit, the date and time of each visitor request; and
• Personal data accessed through permissions you grant to any MLM application (such as file uploads to submit context or attachments for support), insofar as you choose to use features that require such access. You may grant or deny such permissions at any time via your device or account settings.

We process your personal data for the following purposes:

• To provide the Offering's services and functions, which includes creating and administering your online account, updating, securing and troubleshooting the Offering, providing support, and improving and developing our Offerings;
• To verify your identity;
• To answer and fulfill your requests or instructions;
• To process your order or to provide you with access to specific information or offers;
• To contact you with information and offers concerning our AI agents and related services, to send you further marketing information or to contact you in the context of customer satisfaction surveys as explained under "Direct marketing & surveys"; and
• As reasonably necessary to enforce the Offering's terms, to establish or preserve a legal claim or defense, to prevent fraud or other illegal activities, including attacks on our information technology systems.

Offerings provided by your organization

Our Offerings may be provided to you for your use by the organization to which you belong, such as our enterprise customers. If your organization provides you with access to an Offering, our processing of personal data provided by or collected from you or your organization in connection with the Offering's content is performed under the direction of your organization and is subject to a data processing agreement between your organization and us. In such instance, your organization is responsible for any personal data contained in such content and you should direct any questions about how personal data contained in such content is used to your organization.

MLM designs, builds and operates custom AI agents that run inside our customers' own infrastructure. All AI processing described in this section is governed by our Governance Envelope discipline — traceable test cases, human oversight per operation, decision provenance, client-owned code from day one, and EU-resident inference.

On our website and marketing channels

When you interact with any AI-powered feature made available on our websites, marketing channels or public demos (each a "Public AI Feature"), we may process the following categories of personal data:

• Information contained in input that you actively provide as part of the Public AI Feature's use, such as your prompts, questions, uploaded content, preferences, search queries, documents you share for analysis, contextual information you provide about your needs, feedback on responses, and other information you share in the context of using the Public AI Feature;
• Information contained in output that is generated by the Public AI Feature as a response to your input; and
• Information on your interaction with the Public AI Feature, including your device and user identifier, session data, and usage patterns.

We process your personal data for the following purposes:

• To provide you with the Public AI Feature;
• To monitor the quality of the Public AI Feature and ensure that the output is appropriate, respectful and does not contain illegal or offensive language or materials;
• To debug, secure and improve the Public AI Feature; and
• As reasonably necessary to establish or preserve a legal claim or defense, to prevent fraud or other illegal activities, including attacks on our systems or networks, and to comply with applicable law.

No automated decision-making with legal or similarly significant effects. Our Public AI Features do not carry out solely automated decision-making, and do not carry out profiling, that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.

No training on personal data collected through our website. We do not use personal data collected through our website, marketing channels or public demos to train, fine-tune or otherwise develop our own foundation models, and we do not permit our sub-processors to use such data to train, fine-tune or improve their foundation models for other customers.

On customer engagements

Where we deliver custom AI agents to an enterprise customer, the agents run inside that customer's tenancy (typically the customer's cloud subscription or on-premise environment). In that context:

• MLM acts as a processor on behalf of the customer, or as a joint controller where expressly agreed, in each case pursuant to a written Data Processing Agreement ("DPA");
• MLM does not access the customer's operational data (including any personal data contained in it) unless expressly authorized under the DPA for a defined purpose (e.g., incident response, model evaluation, contractually agreed audit);
• MLM does not use customer operational data — including prompts, uploads, outputs, or any personal data contained in them — to train, fine-tune or improve foundation models used for other customers;
• Every deployment is designed to include human oversight at the operational level and to record decision provenance, in alignment with the Regulation (EU) 2024/1689 on Artificial Intelligence ("EU AI Act") requirements applicable to the relevant AI system risk class;
• Inference is EU-resident by default. Any transfer outside the EEA is subject to the safeguards described under "Regional provisions".

Further details of the specific AI processing performed under a customer engagement are set out in the DPA and, where applicable, in a Model Card or System Card provided to the customer.

In the context of the business relationship with us, we may process the following categories of personal data of contact persons at (prospective) customers, suppliers, vendors, resellers and partners (each a "Business Partner"):

• Contact information, such as full name, address, telephone number, work mobile phone number and email address;
• Organizational information, including job position and company name;
• Payment data, such as data necessary for processing payments and fraud prevention, including bank account details, credit/debit card numbers, security code numbers and other related billing information;
• Further information necessarily processed in a project or contractual relationship with us or voluntarily provided by the Business Partner, such as personal data relating to orders placed, payments made, requests, and project milestones;
• Personal data collected from publicly available resources (including business and employment oriented social networks and websites), integrity databases and credit agencies; and
• Information that is legally required for Business Partner compliance screenings or export control checks, such as date of birth, nationality, place of residence, ID numbers, identity cards and information about relevant and significant litigation or other legal proceedings against Business Partners.

We may process the personal data for the following purposes:

• Communicating with Business Partners about our AI agents, services and projects, e.g., by responding to inquiries or requests or providing you with information about purchased products or ongoing engagements;
• Planning, performing and managing the (contractual) relationship with Business Partners, e.g., by performing transactions and orders of services, processing payments, performing accounting, auditing, billing and collection activities, providing support and delivery services;
• To create a business-related profile containing information on interactions between you and us with the aim of being able to offer you and the company you work for relevant information and suitable offers for our services, and to improve our personal communication with you;
• Administering and performing market analysis and customer activities or events;
• Contacting you with information and offers concerning our services, sending you further marketing messages and conducting customer satisfaction surveys;
• Maintaining and protecting the security of our sites, facilities, services and websites, preventing and detecting security threats, fraud or other criminal or malicious activities;
• Ensuring compliance with legal obligations (such as record-keeping obligations), export control and customs, Business Partner compliance screening obligations (to prevent white-collar or money-laundering crimes), and our policies or industry standards; and
• Solving disputes, enforcing our contractual agreements and establishing, exercising or defending legal claims.

When you register for or attend one of our in-person events or webinars (each an "Event") — for example, conferences we host, industry roundtables, customer workshops, or webinars — we process:

• The personal data described under "Your business relationship with us";
• Your name, organization and contact details ("Participant Information");
• Additional information you provide during registration, such as food or accommodation preferences.

To the extent that your food or accommodation preferences reveal sensitive personal information (such as dietary requirements indicating religious beliefs or health information), we will process such data only where permitted or required by applicable law, which may include obtaining your consent, fulfilling our legal obligations, or protecting your vital interests.

We may process the personal data for the following purposes:

• To organize and manage the Event (including registration, access control and logistical arrangements);
• To provide Event access and networking opportunities;
• To track session attendance where required, and to improve future Events.

Where an exhibitor, sponsor or co-host scans your badge or registration QR code at an in-person Event, we will share your Participant Information with that exhibitor, sponsor or co-host, if you choose to have your badge scanned by them. Such third parties use the Participant Information for their own follow-up and networking purposes under their own privacy notices and based on your direct relationship with them.

If you participate in a virtual meeting hosted or scheduled by MLM (using standard collaboration tools such as Microsoft Teams, Zoom, Google Meet or similar) where — to the extent permitted by applicable law — recording, transcription, or AI-assisted features are activated, we may process the following categories of personal data:

• Audio, video and text content of your contributions during the meeting, including your voice, your image, content shared by you, and messages you send in the chat;
• Information about your participation, such as your name, your email address, the times of joining and leaving the meeting, details of your interactions during the meeting, as well as technical connection data (e.g., IP address).

The purposes for processing your personal data in this context are:

• To provide the requested recording, transcription or AI-assistance features to participants;
• To create meeting recordings, transcripts and AI-generated summaries;
• As necessary, to establish or defend legal claims, prevent fraud and comply with applicable law.

Where recording or transcription is used, participants will be notified at the start of the meeting and, where required by applicable law, asked for their consent.

All relevant information on the processing of personal data in connection with cookies may be found in our Cookie Policy, including the categories of cookies we set, the providers involved, their retention periods and how to change your choices at any time.

Where and as permitted under applicable law, we may process your contact information for direct marketing purposes (e.g., event invitations, newsletters with further information and offers concerning our AI agents and services) and to carry out customer satisfaction surveys, in each case also by email.

You may object to the processing of your contact data for these purposes at any time by writing to info@machineslikeme.com or by using the opt-out mechanism provided in the respective communication you received.

When you apply for a job with MLM through our careers page or any other recruiting channel we operate, we process your personal data for the purpose of assessing your application, communicating with you about the role, and — where you are selected — preparing an employment contract.

Categories of personal data processed typically include: your name, contact details, CV/résumé, cover letter, work history, education, professional certifications, references, portfolio material you choose to submit, and any additional information you provide during the recruiting process (including interview notes and assessment results).

Your application is seen only by the people involved in the decision: our HR team, the hiring managers for the role and, for roles in their region, our regional partners.

Please do not send sensitive data, such as a photo or health information. If you do, we use it only for this application.

We retain applicant personal data for the period required to process the application and, where you are not hired, for a further period reasonable to defend against potential claims under applicable employment or anti-discrimination law (typically six months in Germany), unless you have consented to a longer retention period (e.g., inclusion in our talent pool).

Applications submitted through our careers page, including your CV, are received and stored in HubSpot, which we use as our applicant tracking system (see Sub-processors).

Where MLM engages sub-processors to process personal data on our behalf, we do so under written agreements that impose data-protection obligations no less protective than those set out in our own agreement with you or your organization. The current indicative categories and providers are:

A current list of sub-processors, together with their location and applicable transfer safeguards, is available on request to info@machineslikeme.com. Enterprise customers with a DPA in place will be notified of material changes to sub-processors in accordance with the DPA.

We only transfer your personal data as below:

• Affiliated companies and partners. For the purpose of and to the extent necessary to conduct our business relationship with you, we may share your personal data with our foreign offices, subsidiaries and partners. MLM operates from Grünwald (HQ), Amsterdam, Kiel, Luxembourg, Silicon Valley (California, USA), Stockholm and Wilmington (Delaware, USA).
• Service providers (sub-processors). We employ affiliates and other companies to perform functions on our behalf, such as cloud hosting, model inference, IT services, CRM, analytics or payment processing. These affiliates and other companies process personal data only for the purpose of such services, and only on documented instructions from us.
• Other third parties. We may transfer personal data to other third parties in connection with complying with legal obligations or establishing, exercising or defending rights or claims (e.g., for court and arbitration proceedings, to regulators, law enforcement and government authorities, to attorneys and consultants).

The recipients of your personal data may be located outside the country in which you reside.

Personal data published by you on Offerings (such as public forums or comment threads, if we offer any) may be globally accessible to other registered users of the respective Offering.

Unless indicated otherwise at the time of the collection of your personal data (e.g., within a form completed by you or within a DPA), we erase your personal data if the retention of that personal data is no longer necessary for the purposes for which it was collected or otherwise processed, or to comply with legal obligations — such as statutory retention duties. Under § 147 AO, examples include ten years for books and annual accounts, eight years for accounting vouchers, and six years for business correspondence. The applicable period depends on the record and may be extended where the law requires.

To protect your personal data against accidental or unlawful destruction, loss, use or alteration and against unauthorized disclosure or access, we use adequate physical, technical and organizational security measures. These measures are aligned with our Governance Envelope discipline and with recognized information-security good practice.

At this time our Offerings do not recognize or respond to "Do Not Track" (DNT) browser signals. There is no finalized industry or legal standard for how websites should respond to DNT signals. Where you wish to limit tracking, please use the controls provided in our Cookie Policy or in your browser's privacy settings.

The data protection laws in the jurisdiction in which you reside may entitle you to specific rights in relation to your personal data. In particular, and subject to the legal requirements, you may be entitled to:

• Obtain from us confirmation as to whether or not personal data concerning you are being processed and, where that is the case, access to the personal data;
• Obtain from us the correction of inaccurate personal data concerning you;
• Obtain from us the erasure of your personal data;
• Obtain from us restriction of processing regarding your personal data;
• Data portability concerning personal data which you actively provided;
• Object, on grounds relating to your particular situation, to further processing of personal data concerning you; and
• Withdraw your consent to our processing of your personal data.

To exercise any of these rights, please contact info@machineslikeme.com.

Right to object to direct marketing: You may object at any time, without giving reasons, to processing for direct marketing, including related profiling. We will then stop processing your personal data for those purposes. Where processing is based on consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing before withdrawal.

Our Data Privacy Organization provides support with any data-privacy-related questions, comments, concerns or complaints, or in case you wish to exercise any of your data-privacy-related rights.

The Data Privacy Organization will always use reasonable efforts to address and settle any requests or complaints you bring to its attention. Besides contacting the Data Privacy Organization, you always have the right to approach the competent data protection authority with your request or complaint.

The Governance Envelope is the discipline MLM applies to every AI agent we build and operate. It includes:

• Scenario and regression testing of models and agents before deployment and on a recurring basis;
• Human oversight per operation, so that a human is meaningfully in the loop for decisions that affect individuals or material business outcomes;
• Decision provenance, so that each output of an AI agent can be traced back to the inputs, model version, and policies that produced it;
• Client-owned code from day one, so that our customers retain full control of the artifacts we build for them;
• EU-resident inference by default, so that model calls made in the course of a customer engagement are routed to EU-region endpoints unless the customer expressly agrees otherwise.

The Governance Envelope informs — and is complemented by — this Privacy Policy. Where a customer engagement requires additional safeguards (for example under the EU AI Act's high-risk regime, or under sectoral regulation such as banking, insurance or healthcare), those additional safeguards are set out in the DPA and, where relevant, in a Model Card / System Card.

Read more about our governance discipline →

This section applies and provides you with further information if your personal data is processed by Machines Like Me GmbH (which is established in the European Economic Area) or by any other MLM office located in the European Economic Area.

Data controller

Machines Like Me GmbH, Nördliche Münchner Straße 9c, 82031 Grünwald, Germany, is the controller responsible for processing your personal data under the General Data Protection Regulation, unless a different MLM entity is identified as the operator of the relevant website, application, or service.

Business Partner personal data shared with affiliated offices and partners

In the course of our business relationship with you, we may share Business Partner contact information with our affiliated offices and partners. Where this constitutes joint controllership (Art. 26 GDPR), we will provide the essence of the arrangement on request. To exercise your rights or request a copy of the relevant section of a joint-controller arrangement, you may reach out to info@machineslikeme.com.

Legal basis of the processing

The General Data Protection Regulation requires us to provide you with information on the legal basis of the processing of your personal data. The legal basis for our processing data about you is that such processing is necessary for the purposes of:

• Exercising our rights and performing our obligations under any contract we make with you (Article 6(1)(b) GDPR) ("Contract Performance");
• Compliance with our legal obligations (Article 6(1)(c) GDPR) ("Compliance with Legal Obligations"); and/or
• Legitimate interests pursued by us (Article 6(1)(f) GDPR) ("Legitimate Interest"). Generally, the legitimate interest pursued by us in relation to our use of your personal data is the efficient performance or management of your use of the Offerings and our business relationship with you, and in particular the achievement of the purposes described in the table below. Where the table states that we rely on our legitimate interests for a given purpose, we are of the opinion that our legitimate interest is not overridden by your interests and rights or freedoms, given (i) the regular reviews and related documentation of the processing activities described herein, (ii) the protection of your personal data by our Governance Envelope and data-privacy processes, (iii) the transparency we provide on the processing activity, and (iv) the rights you have in relation to the processing activity. If you wish to obtain further information on this balancing test approach, please contact us at info@machineslikeme.com.

In some cases, we may ask if you consent to the relevant use of your personal data. In such cases, the legal basis for us processing that data about you may (in addition or instead) be that you have consented (Article 6(1)(a) GDPR) ("Consent").

International data transfers

In the event that we transfer your personal data outside the European Economic Area, we ensure that your data is protected in a manner consistent with the General Data Protection Regulation. In particular, and if required by applicable law, we take the following measures:

• We transfer personal data to affiliated MLM offices or to external recipients outside the European Economic Area only if the recipient has (i) entered into the current EU Standard Contractual Clauses with us (Commission Implementing Decision (EU) 2021/914), (ii) is located in a country covered by an adequacy decision of the European Commission, or (iii) has implemented equivalent safeguards recognized under Chapter V GDPR;
• Where required following the Schrems II decision, we carry out a Transfer Impact Assessment and implement supplementary technical, organizational and contractual measures.

You may request further information about the safeguards implemented in relation to specific transfers by contacting info@machineslikeme.com.

Your competent data-protection authority

In case of data-privacy-related concerns and requests, we encourage you to contact us at info@machineslikeme.com. Besides contacting us, you always have the right to lodge a complaint with the competent data-protection authority. The competent supervisory authority for Machines Like Me GmbH is:

If you reside in another EU/EEA Member State, you may also contact the supervisory authority of your habitual residence or place of work.

This section applies and provides you with further information if your personal data is processed by MLM under the Data Protection Act 2018 and/or the UK GDPR (meaning Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018).

Data controller

Machines Like Me GmbH, Nördliche Münchner Straße 9c, 82031 Grünwald, Germany, is the controller responsible for processing your personal data under the UK GDPR. To exercise your rights, you may reach out to info@machineslikeme.com.

Legal basis of the processing

The legal basis for our processing data about you is that such processing is necessary for the purposes of:

• Exercising our rights and performing our obligations under any contract we make with you (Article 6(1)(b) UK GDPR) ("Contract Performance");
• Compliance with our legal obligations (Article 6(1)(c) UK GDPR) ("Compliance with Legal Obligations"); and/or
• Legitimate interests pursued by us (Article 6(1)(f) UK GDPR) ("Legitimate Interest"). Where we rely on legitimate interests for a given purpose, we are of the opinion that our legitimate interest is not overridden by your interests and rights or freedoms, given (i) the regular reviews and related documentation of the processing activities described herein, (ii) the protection of your personal data by our Governance Envelope and data-privacy processes, (iii) the transparency we provide on the processing activity, and (iv) the rights you have in relation to the processing activity.

In some cases, we may ask if you consent to the relevant use of your personal data. In such cases, the legal basis for us processing that data about you may (in addition or instead) be that you have consented (Article 6(1)(a) UK GDPR) ("Consent").

The purpose-and-legal-basis table set out under "European Union (GDPR)" applies mutatis mutandis under the UK GDPR, reading references to Article 6 GDPR as references to Article 6 UK GDPR.

International data transfers

In the event that we transfer your personal data outside the United Kingdom, we ensure that your data is protected in a manner consistent with the UK GDPR. Where required by applicable law, we transfer personal data to recipients outside the United Kingdom only if the recipient has (i) entered into the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses with us, or (ii) is located in a country covered by UK adequacy regulations. You may request further information about the safeguards implemented in relation to specific transfers by contacting info@machineslikeme.com.

Your competent data-protection authority

In case of data-privacy-related concerns and requests, we encourage you to contact us at info@machineslikeme.com. You always have the right to approach the competent data-protection authority — in the United Kingdom, the Information Commissioner's Office (ICO), www.ico.org.uk — with your request or complaint.

If you are a U.S. resident, then please take note of the following. MLM has offices in Silicon Valley, California and Wilmington, Delaware.

Do Not Track

At this time our Offerings do not recognize or respond to "Do Not Track" browser signals. For more information on "Do Not Track", please visit your browser's support page.

Usage by children

This Offering is not directed to children under the age of thirteen. We will not knowingly collect personal data from children under the age of thirteen without insisting that they seek prior parental consent if required by applicable law. We will only use or disclose personal data about a child to the extent permitted by law, to seek parental consent, pursuant to local law and regulations, or to protect a child.

State rights

Depending on the US state in which you reside (including, as applicable, California under the CCPA/CPRA, Colorado, Connecticut, Virginia, Utah, Delaware and other states with comprehensive privacy statutes), you may have special rights with respect to your personal data — including the right to know, the right to delete, the right to correct, the right to opt out of "sale" or "sharing" of personal information, and the right to opt out of profiling with legal or similarly significant effects.

• MLM does not "sell" personal information for money.
• To exercise a US state privacy right, please contact info@machineslikeme.com with the state you reside in and the right you wish to exercise. We will verify your identity in a manner proportionate to the sensitivity of the request.

This Privacy Policy does not describe the processing of personal data of Machines Like Me employees in the context of their employment. Employees receive separate information about that processing directly from us.

This Privacy Policy may be updated from time to time. The revision date at the top of this page indicates when this policy was last revised. Material changes will be communicated through appropriate channels.

Last updated: 15/10/2026