Privacy policy

This policy explains how Learning Machine LLC (“we”, “us”) processes personal data when you visit this website or use the EchoMention service (the “Service”). We process personal data in line with the EU and UK General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Controller and contact

Learning Machine LLC
Azerbaijan, Baku
E-mail: [email protected]

Write to this address for any privacy question or to exercise your rights (section 8).

2. Data about our customers

• Account data: e-mail address, a password hash (we never store your password), sign-up and last login time, whether your e-mail address is confirmed. Purpose: providing your account (Art. 6(1)(b) GDPR, contract).
• Workspace settings: keywords, selected sources, digest time, time zone and language, delivery channels (Slack/Discord webhook URLs, Telegram chat id, e-mail recipients). Webhook URLs and other channel settings are encrypted at rest. Purpose: running the monitoring you configured (Art. 6(1)(b)).
• Billing data: your plan, subscription status, billing period and the customer and subscription identifiers assigned by Paddle. We do not receive or store card or bank details (see section 5). Purpose: contract and legal obligations such as bookkeeping (Art. 6(1)(b) and (c)).
• Technical data: IP address and request metadata in server logs and short-lived rate-limit counters, used to keep the Service secure and to prevent abuse (Art. 6(1)(f), legitimate interests). Rate-limit counters expire within one hour; server logs are kept for up to 14 days.
• Cookies: one strictly necessary session cookie that keeps you logged in and protects forms against cross-site request forgery. We use no advertising or analytics cookies, so no cookie banner is required.

3. Public content we collect (mentions)

The Service searches publicly available sources (news sites and Google News, RSS/Atom feeds, Hacker News, Reddit (where available), Bluesky, YouTube, public Telegram channels, and web search results for the sites a customer chooses, obtained from the Brave Search API) for the keywords our customers configure. For every matching item we store: title, a text excerpt, the link, the author or channel name as published, the publication time, the source, and a sentiment score. These items may contain personal data of the people who wrote them or who are mentioned in them.

We process this data on the basis of legitimate interests (Art. 6(1)(f) GDPR): our customers’ interest in learning what is said publicly about their brand, products and markets, and our interest in providing that service. We collect only content that its authors have made public, we do not build profiles of individuals, and we do not collect special categories of data on purpose. Each customer workspace only sees the mentions of its own keywords.

If you are the author of, or mentioned in, a stored item, you can object to the processing or ask for erasure at any time by writing to [email protected] with the link to the item. Content deleted at its original source is not updated automatically but is removed on request.

4. Retention

Stored mentions are deleted automatically when they are older than the history period of the workspace’s plan:

Account and workspace data are kept while your account exists. When you delete your account (or ask us to), we delete your account, workspace and its mentions within 30 days; encrypted backups are overwritten within a further 30 days. Billing records are kept as long as tax and accounting law requires (generally up to 10 years).

5. Processors and recipients

• Hosting: Hetzner Online GmbH, Germany — servers that run the Service, its database and cache.
• Paddle (Paddle.com Market Limited and its affiliates) — our online reseller and Merchant of Record. Paddle sells the subscription to you, processes payments, handles taxes, invoices and refunds, and processes your payment details as an independent controller under its own privacy notice. Paddle tells us your subscription status and identifiers, not your card details.
• Anthropic (Anthropic PBC) — optional AI analysis. Only if a workspace on a plan that includes it turns AI analysis on, the text of new mentions is sent to Anthropic’s API to produce summaries. Under Anthropic’s commercial terms, API data is not used to train its models. Workspaces that do not enable AI analysis never send data to Anthropic.
• Brave Search (Brave Software, Inc.) — for workspaces that enable the Web search source, their keywords and chosen sites are sent to the Brave Search API as search queries. No account data is sent.
• Cloudflare (Cloudflare, Inc.) — content delivery network in front of the Service: it terminates TLS and protects against attacks, so it processes all traffic to the website and app, including IP addresses and request metadata.
• Mailgun (Mailgun Technologies, Inc., part of Sinch) — sends account e-mails and e-mail digests (US region, servers in the United States). It processes recipient addresses and the message content.
• Source services — to find mentions, a workspace’s keywords are sent as search queries to the services it monitors: Google News and the YouTube Data API (Google LLC), the Hacker News search API (Algolia, Inc.), Bluesky (Bluesky Social PBC); public Telegram channels are read through Telegram’s public web preview. No account data is sent.
• Your delivery channels: digests are sent to the Slack, Discord or Telegram destinations and e-mail addresses you configure; those services process the digest under your agreement with them.

We do not sell personal data. Where a recipient is located outside the EU/EEA or the UK, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

6. Security

Traffic is encrypted with TLS. Passwords are hashed with Argon2, channel secrets are encrypted at rest, and access to production systems is limited to the people who operate the Service.

7. Automated decisions

Sentiment scores and AI summaries describe content; they are not used to make decisions with legal or similarly significant effects about anyone.

8. Your rights

Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. To exercise a right, write to [email protected]; we answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.

9. Changes

We will update this page when our processing changes and tell customers about material changes by e-mail.