Machine Mesh

1. Who we are

Machine Mesh is a product of NordMind AI Ltd, a company registered in England and Wales.

Company number: 16934489

Registered address: 3A College Place, Derby, DE1 3DY

Website: machinemesh.ai | App: app.machinemesh.ai

Contact: info@machinemesh.ai

NordMind AI Ltd is the data controller for personal data collected through this website and the Machine Mesh platform. We are subject to UK GDPR and the Data Protection Act 2018.

2. What personal data we collect

Website visitors

When you visit machinemesh.ai we may collect:

• IP address and browser/device information (via analytics)
• Pages visited and time on site
• If you fill in a contact or demo request form: your name, email address, company name, and job title

Machine Mesh platform users

When your organisation uses the Machine Mesh platform, we collect:

• Account details: name, work email address, job role
• Usage data: queries submitted, documents uploaded, feature activity
• Content you or your team upload: maintenance manuals, SOPs, drawings, logs, and similar operational documents
• Authentication data: hashed passwords; password reset requests
• Usage and cost logs: query volume, token usage, estimated processing costs

What we do not collect

We do not collect sensitive personal data (health, financial, or biometric data) and we do not intentionally collect personal data about individuals other than the authorised users of our platform.

3. How we use your data

We use personal data to:

• Provide and operate the Machine Mesh platform for your organisation
• Manage your account and authenticate users
• Respond to demo requests, sales enquiries, and support queries
• Send transactional emails (account setup, password resets, trial notifications)
• Monitor platform performance and diagnose technical issues
• Track usage for billing and trial management purposes
• Improve our product based on aggregate, anonymised usage patterns

We do not use your data for advertising. We do not sell your data to third parties.

4. Legal basis for processing

Under UK GDPR, our legal bases for processing personal data are:

• Contract: to provide the Machine Mesh service you or your organisation has signed up for
• Legitimate interests: to improve our product, monitor system health, and conduct B2B marketing to relevant prospects
• Consent: where you have opted in to marketing communications
• Legal obligation: where we are required to retain records

5. Third-party services we use

We use a limited set of trusted third-party services to operate Machine Mesh:

• OpenAI – to process queries and extract information from documents (data processed under OpenAI's enterprise API terms; not used to train OpenAI models)
• Neon – PostgreSQL database hosting
• Resend – transactional email delivery
• Replit / hosting infrastructure – application hosting
• Google Analytics or equivalent – website analytics (anonymised)

Each of these processors is bound by a data processing agreement. We select providers that operate appropriate security standards and, where relevant, UK or EU data transfer safeguards.

6. International data transfers

Some of our third-party providers process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy decisions. If you would like more detail on the safeguards we rely on, contact us at info@machinemesh.ai.

7. How long we keep your data

• Account and user data: retained for the duration of your subscription, plus up to 12 months after account closure
• Uploaded documents and extracted knowledge: deleted within 30 days of account closure on request
• Usage and billing logs: retained for up to 7 years for financial record-keeping purposes
• Website enquiry data: retained for up to 24 months
• Marketing contact records: retained until you opt out or we determine the contact is no longer relevant

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data (“right to be forgotten”)
• Object to processing based on legitimate interests
• Restrict how we use your data in certain circumstances
• Data portability – receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is consent-based

To exercise any of these rights, email info@machinemesh.ai. We will respond within one calendar month. There is no charge for reasonable requests.

9. Cookies

Our website uses cookies for basic analytics and session management. We do not use advertising or tracking cookies. You can control cookies through your browser settings. A cookie notice will be displayed on your first visit to machinemesh.ai.

10. Security

We take reasonable technical and organisational measures to protect your data, including:

• Encrypted data storage and transmission (TLS in transit, encrypted at rest)
• Role-based access controls within the platform
• Organisation-scoped data isolation (your data is not visible to other organisations)
• Regular review of access permissions

No system is 100% secure. If you suspect a security issue, please contact us immediately at info@machinemesh.ai.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first at info@machinemesh.ai and we will do our best to resolve it.

You also have the right to lodge a complaint with the UK's data protection regulator:

Information Commissioner's Office (ICO)
ico.org.uk | 0303 123 1113

12. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For material changes, we will notify active platform users by email.