We process account details, project metadata, build and test information, usage records, and the files or credentials you choose to provide so that Mach can deliver its build, release, testing, and support services.

Mach uses this information to authenticate your account, run requested work, protect the service, provide support, calculate usage, and improve reliability. We do not sell personal information or project data.

When you explicitly connect an AI client through Mach MCP, we store the client identity, the read-only permissions you approve, connection timestamps, and hashed connection tokens. The connected client receives only the Mach data covered by those permissions. It cannot access your password, personal access tokens, project secrets, certificates, build artifacts, or build logs through this integration.

We share data only with service providers needed to operate Mach, such as cloud infrastructure, payments, authentication, and communications providers, or when required by law. We do not share your project data with an AI client unless you approve that specific connection.

We use reasonable technical and organizational safeguards to protect data in transit and at rest. Access is limited to the people and systems needed to operate Mach. Build artifacts are ordinarily retained for up to 90 days, while other information is retained only as long as needed for the service, legal obligations, dispute resolution, or security purposes.

You can revoke an AI connection at any time from Dashboard Settings under Security. You can also contact us to request access, correction, or deletion of your personal information, subject to applicable law and legitimate operational requirements.

We may update this policy as Mach evolves. Material changes will be posted here. For privacy questions or requests, contact support@getmach.dev.