PRIVACY NOTICE

Collect less. Explain why. Delete on schedule.

Effective and last updated: August 28, 2026

Who operates this service

Machine & Proof is a service brand operated by Sequoia GEO LLC.

Information we collect and its sources

We collect information directly from applicants and clients, from their authorized representatives, from the public business websites they identify, and from service providers that deliver and protect the Site.

Direct email scope requests collect the sender address and the information included in the message. If live application intake is later enabled, the form collects a name, business email, company name, public website, company location, the decision question submitted, eligibility attestations, contact authorization, and an optional referral source. If an order is accepted, we also process contract, delivery, invoice, payment-status, and service correspondence records. We do not request account credentials, customer lists, health information, full payment-card data, or other nonpublic customer data.

Hosting and security providers may process routine technical information such as request timestamps, browser or device information, network logs, and security events needed to deliver and protect the Site.

Direct scope-request messages remain in the hosted business mailbox and on authorized devices used to review and answer them. They are not entered into the intake database unless a separately disclosed process is activated.

How we use information

• Evaluate whether the business fits the locked Public Evidence Audit scope.
• Respond about the application and, if accepted, administer the order and delivery.
• Operate billing, accounting, evidence challenges, and the limited service guarantee.
• Protect the intake system, investigate abuse, and maintain the experiment ledger.
• Honor opt-outs and privacy requests and meet legal or dispute-resolution obligations.

AI processing and human authorization

A human reviews the application and contact information. AI systems may analyze the company's public website and a sanitized version of the submitted business question. Names, contact details, customer facts, credentials, and unique identifiers are removed before that model review. A human authorizes external responses, order acceptance, charges, publication, and other controlled actions.

Service-provider categories and disclosures

Information may be processed by vendors that provide hosting and database services, CRM and business email, electronic signature, hosted payment processing, security, and AI review. Professional advisors may receive the limited information needed for legal, accounting, tax, insurance, or dispute work. We may also disclose information when law requires it, to protect rights or security, or as part of a business transfer subject to appropriate safeguards. Access is limited to the purpose for which the recipient is used.

The application-alert webhook receives only an event label and the pseudonymous application reference. Applicant contact details and answers remain in the intake store unless a separately approved CRM workflow is activated and disclosed.

No sale, targeted advertising, or cross-site tracking

We do not sell personal information or share it for cross-context behavioral advertising. We do not currently use advertising cookies, advertising pixels, session replay, or third-party analytics that follow a person over time across unrelated websites. Because those practices are disabled, browser Do Not Track and Global Privacy Control signals do not change the Site's current behavior. Hosting and security providers may still observe requests as needed to deliver and protect the Site. We will update this notice and add any required controls before enabling materially different tracking or advertising practices.

Retention

Unaccepted scope-request messages and application records are scheduled for deletion within 90 days after the last recorded interaction. A reviewed status change refreshes that date. Client orders, evidence ledgers, invoices, and related records follow the retention periods stated in the order form and applicable record schedule. A deletion audit entry containing only pseudonymous application and one-way retry references, the reason, and time is retained for 12 months, then purged. During that 12-month window, the retry reference prevents a delayed duplicate request from recreating a deleted application. After the entry is purged, a later submission is handled as a new application. Rate-control hashes expire shortly after their protection window.

Paid-audit evidence is retained for 12 months after delivery, or until a timely evidence challenge is resolved, whichever is later.

A minimal address, reason, and timestamp may remain in a suppression register while we conduct email marketing so we can honor an opt-out, complaint, or hard bounce and avoid another unwanted message. Provider recovery history may retain a deleted database state for up to 30 additional days. Legal holds and statutory obligations may require longer retention. The stated periods govern the current service process unless law requires a different period.

Your choices

You may request access, correction, or deletion where applicable by emailing privacy@machineandproof.com. You may also use that address to ask about our practices or withdraw application-contact authorization. Identity verification may be required. We do not discriminate against a person for making a privacy request. This mailbox is active and routes to the service operator.

A deletion request may not remove a minimal suppression record when retaining it is needed to honor an opt-out or another legal obligation. Contract, tax, payment, security, or dispute records may also be retained when legally or operationally required. We will explain any applicable limitation in our response.

Children

This business service is not directed to children, and the application requires authority to act for a US business. We do not knowingly collect personal information from children. If we learn that a child submitted personal information, we will delete it unless law requires a different response.

Security

We use administrative, technical, and access controls designed for the limited information in scope. No storage or transmission system can be guaranteed completely secure. Do not submit credentials, payment-card details, or nonpublic customer information through the application.

Notice changes

The effective date and last-updated date will appear at the top of this notice. Material changes will be posted here before they apply. We will provide additional notice when law requires it. We will not use information already collected for a materially broader purpose without a lawful basis and any required notice or authorization.