La Mashine Privacy Policy

This policy explains how data is used in the https://app.lamashine.com/ platform, intended for adult users invited by an organization in France. It covers accounts, projects, meetings, AI functions and support requests. It does not authorize new processing that would contradict the specific commitments made with your organization.

1. Who is responsible for your data

LA MASHINE, a simplified joint-stock company (SAS) with a share capital of 30,000 euros, registered with the Toulouse Trade and Companies Register under number 932 458 441, registered office 33 rue du Quatorze Juillet, 31100 Toulouse, France, publishes the service. You can write to contact@lamashine.com for any question or request about your data. The internal contact in charge of these questions coordinates the answers; no data protection officer is presented as having been appointed.

Your organization is responsible for the processing it determines to organize the support, the projects, the permissions and the meetings. La Mashine then acts as a processor on its instructions. The identity of this organization appears in your invitation and your workspace; it must give you its own information on the purposes, legal bases and relevant contacts.

La Mashine is responsible for its own processing, in particular managing its contractual relationships with client representatives, its accounting, the defense of its rights and the security of its service, for the purposes it determines. The information below distinguishes these uses from the processing carried out for your organization.

2. What data is processed

We receive information from your organization at the time of the invitation, from you when you contribute, from the members and contributors of your projects, as well as technical data produced during use. The categories include: last name, first name, email, organization, role, permissions, authentication data, project content and files, tasks, deliverables, exchanges with the AI, notes and meeting notes.

Projects may contain data about contacts, prospects or interviewees: professional identity, role, organization and statements useful to the project. The responsible organization and the people who import this data must ensure that it is collected lawfully and that these third parties are informed. Importing special categories of data, criminal data, identity documents and authentication secrets is forbidden.

Technical data includes the project pages opened, grouped by one-hour slots, permissions used and access denied, references to actions in the project, last activity, and AI volumes and costs per person. Action logs do not reproduce content. Usage statistics are therefore not all anonymous when collected.

The information needed for the account and permissions is essential to access the service. Content is provided according to the needs of the project. Audio recording is optional. Not agreeing to it does not prevent general use of the platform.

Content sent to the platform must not include data about minors, official identifiers issued by a public authority or payment card data. In the event of an accidental upload, it should be reported without delay so that it can be restricted and deleted.

3. Purposes and legal bases

For the processing of accounts, projects, support, reporting and assistance carried out on instructions, your organization determines and tells you the appropriate legal basis. Depending on its status and mission, this may in particular be a task carried out in the public interest, a contract applicable to the person or a legitimate interest where this is permitted. La Mashine does not presume that the commercial contract entered into with a school is a contract entered into with each student.

The recording of your voice and its transformation into a transcript and meeting notes are based on your personal, prior and revocable consent. The Organization must ensure that a refusal or withdrawal does not penalize you and that an unrecorded contribution remains possible.

For its own purposes, La Mashine uses the business contact details of client representatives to prepare and manage the commercial relationship on the basis of its legitimate interest; where a person is themselves a party to the contract, its performance may be the applicable basis. Keeping accounting records is a legal obligation. Security, abuse prevention, technical control of AI resources and the defense of rights are based on the corresponding legitimate interest, after taking into account the rights of individuals.

The statistics needed to monitor a program are processed for the organization. Product improvement uses limited usage indicators and statistics made anonymous before reuse, without reusing content, without individual commercial profiling and without pooling project data with other clients. Preparatory operations still involving personal data remain subject to the GDPR and to the commitments made to the organization.

4. Who can see the information

Members see their project; coaches the projects assigned to them; administrators the projects of their organization; experts the context needed for their intervention. Meeting notes follow these rights. Full transcripts and audio can never be viewed in the interface. Legal access requests are handled separately, while protecting other people.

The authorized La Mashine team accesses content when needed for support, security or maintenance. Technical administrators may view named activity and cost data for their duties. The organization sees aggregated indicators on its projects; through this statistical function, it does not have the detailed log of individual access or costs.

Data may be disclosed to strictly necessary service providers, to advisers bound by confidentiality or to legally authorized authorities. La Mashine does not reuse a project’s content for the benefit of another project, including within the same organization, nor as context for its AI responses. Project data is not sold and is not published for promotional purposes without the necessary authorizations.

5. Meetings and artificial intelligence

Each participant personally approves the recording for the session after being informed. The organizer cannot answer on their behalf. The absence of agreement or a refusal prevents the recording from starting. The approval is kept with its time stamp. New participants are only included after giving their agreement.

You can withdraw your agreement at any time. During a recording, you leave the recorded session and capture of your voice stops immediately. Contact the organizer or contact@lamashine.com about the handling of data already collected. Withdrawal does not cancel earlier lawful operations; deletion is carried out where the conditions of the GDPR so require. An unrecorded exchange or an equivalent means must be organized if necessary to avoid any harm linked to your refusal or withdrawal.

Only audio is recorded. Mistral transcribes it in the EU; the transcript needed for the summary is sent to the AI route authorized for the organization. The transcript is a technical medium that cannot be viewed, and only the meeting notes are shown to authorized users. Other AI functions may receive the messages, attachments and project context needed for the request. Recommendations concern projects; they are not used to automatically take an individual decision with legal or similarly significant effects, nor to grade or validate students’ studies.

Two configurations are offered. The default configuration uses Anthropic in the United States for assistance and content generation. At the documented request of the Organization, the La Mashine team activates a European configuration covering all AI functions, including assistance, diagnosis, drafts, analysis of attachments and meeting notes. In this configuration, the GLM-5.3 model is run by Mistral in the European Union. Mistral also provides audio transcription in the EU.

If the main provider is unavailable before the response has started, a single fallback route may be used: for the EU configuration, GLM-5.3 run by TensorX in Ireland via Requesty EU; for the Anthropic configuration, Claude run on Google Vertex in the EU via Requesty EU. Each fallback uses a specific deployment, with no substitution of host. If this fallback fails, the request fails with an understandable message. The EU configuration never falls back to Anthropic or to AI processing outside the EU. The Anthropic configuration remains a configuration involving processing in the United States, even though its fallback is European.

La Mashine does not use this data to train its models and does not authorize API providers to use it for training. Direct calls to Anthropic containing service data are reserved for the models, features and organizations actually covered by the Zero Data Retention (“ZDR”) agreement. Features not covered must not receive this data.

For direct calls to Anthropic, ZDR normally prevents requests and responses from being stored after the response has been returned. Limited technical data may remain depending on the feature; exceptions linked to legal obligations and to certain content flagged by the provider’s safety systems may lead to retention, in particular for up to two years for the latter. ZDR means neither the absence of processing nor processing exclusively in the European Union.

ZDR has been enabled on the Mistral account used since 20 October 2026 and across the whole Requesty organization. Requesty processes content in transit without keeping requests, responses, attachments or tool-call content and without any persistent content cache on its side. The selected fallback deployments exclude content retention and its use for training under the applicable provider terms. Billing metadata without content remains at Requesty for six years. La Mashine separately keeps raw requests and responses for ninety days at OVH in France, for debugging, under restricted technical access; they are not used to train models or to feed other projects.

6. Service providers and countries of processing

The entire platform, including files, database and backups, is hosted by OVH in France. AI and technical services may involve other countries; European hosting does not rule out these flows.

The list of authorized models and the region restrictions are enforced on the Requesty side; calls to other models or endpoints are refused. The developer of an open model is not, for that reason alone, a recipient of the data: the GLM-5.3 routes described use Mistral and TensorX, without calling the Z.ai API service. The restrictions apply to the AI processing described; the other platform providers follow the scopes in the table.

Transfers of personal data outside the EEA must benefit, depending on the recipient and the actual scope, from an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, supplemented where necessary. La Mashine checks these conditions and the organization’s instructions before transfers. You can obtain information on the applicable safeguards and a copy of them, redacted only of the protected elements that must be, at contact@lamashine.com.

7. Retention periods

The following periods are retention limits for the stated purposes. A lawful erasure request, an instruction from the organization or a legal obligation may lead to a different period. The specific rules of your organization’s contract prevail when they impose a shorter period or a specific end-of-service instruction.

Requesty’s retention periods are separate from La Mashine’s. Its DPA provides for erasure within thirty days of the end of the contract, then the expiry of backups within a further thirty-five days, subject to the legal retention requirements indicated. Under ZDR, these copies do not contain requests and responses.

La Mashine’s database backups are renewed on a cycle of no more than seven days. Deleted data remains isolated in them until the cycle expires, is not used and is erased again if a restoration takes place. Deleted active files are removed from production storage. A legal retention obligation or an applicable provider exception is documented and the data concerned is isolated; a deletion certificate does not wrongly present these copies as already erased.

Deleting an account cuts off its access and erases profile data that is no longer needed. Shared contributions may remain where a legal basis allows it; personal elements that are still identifying are reviewed. Replacing the name with “Deleted account” is not a guarantee of anonymization. The same applies to the statements of a contact whose name has been removed.

8. Cookies and storage on your device

The platform does not use any external advertising measurement or audience tracking tool such as Google Analytics. It uses mechanisms needed for authentication, security and the interface preferences requested. The internal usage tracking described above remains personal data processing even when it does not use an analytics cookie.

These mechanisms are used without prior consent only insofar as they are needed for the requested service or for the expected customization of the interface. No tracker subject to consent may be added without information and prior collection of the required choice. You can clear the site data in your browser; this may log you out and reset your preferences.

The IP address used by the login attempt limiter is kept for fifteen minutes and is not recorded in the database by this mechanism. The information that you are present on a page is kept in memory for forty-five seconds. Any other technical traces needed for security follow the technical log limits above.

9. Your rights and requests

Depending on the situation, you have the rights of access, rectification, erasure, restriction and objection. The right to data portability applies when its conditions are met, in particular for data provided and processed automatically on the basis of consent or a contract with the person. You can withdraw your consent at any time for processing based on it and set out instructions concerning your data after your death under the conditions of French law.

You can write to contact@lamashine.com or to the contact indicated by your organization, specifying your account and your request. La Mashine forwards to the organization the requests that fall within its responsibility and assists it; requests about La Mashine’s own processing are handled directly. A proportionate identity check may be requested in case of reasonable doubt, without systematically requiring an identity document or its upload into a project.

An answer is given within one month. A legal extension of up to two further months is possible given the complexity or number of requests, with reasoned information within the first month. A refusal or limitation is explained. The rights of third parties, legal obligations and applicable exceptions are taken into account; an export must not disclose other participants’ data without a right to do so.

You can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés: https://www.cnil.fr/ ; CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. You do not have to wait for an amicable approach before contacting the competent authority.

10. Security and changes to this policy

La Mashine implements appropriate measures: encryption of communications, separation by organization, role-based permissions, account protection, logging, and incident and deletion procedures. The detailed contractual measures are set out in the DPA. Absolute security cannot be guaranteed; any incident is handled and notified to the required recipients according to each party’s role and obligations.

The applicable version is made available in the platform. Any substantial change to uses, recipients or retention periods is brought to your attention. A new purpose or a change requiring your consent is subject to a separate request; updating this policy does not, on its own, amount to your consent.