Careful MachinePrivacy policy
Who we are
Careful Machine is run by Labyrinth Brazilian Jiu Jitsu LLC, doing business as Careful Machine ("we", "us"), of 6615 W Cross Creek Bend Ln Ste 400, Fulshear, TX 77441. It is a team of software agents, watched over by people, that does repetitive work for a small business: reading its records, preparing replies, posts and reminders, and counting what needs chasing.
This page says what we collect, why, who else handles it, how long we keep it, and how to have it removed. To ask us anything, write to support@carefulmachine.com.
What we collect, and when
When you visit our public pages
Our host, Cloudflare, receives your internet address and browser details in order to send you the page. Our pages set no cookies of their own. They load nothing from other companies' servers, and nothing on them counts or watches visitors.
When you use the team builder
At /start you answer questions on the page. Your name, your business and its email leave your browser only when you press the button that asks us for an account, and they go only to us, with the network address the request came from. Nothing else on that page sends anything.
If you drop a file on the page, it is read in your browser tab and goes nowhere. The tab keeps only a summary (figures and dates, never a name, an email or a sentence from your file), and "Forget" removes it.
When you write to us
We keep the emails and messages you send us, and our replies, for as long as we work with you and for a year after, so that we can help you. If you ask us to delete them sooner, we do.
When you have an account
We keep your name, your work email, the business you belong to, and when you last signed in. We keep your password only as a scrambled form, so nobody, including us, can read it back.
We also record every sign-in attempt: the time, the email typed, the internet address, and whether it worked. This is to stop password guessing and to see who got in. An attempt typed by someone who has no account is deleted after 30 days. The attempts on an account are deleted with the account.
When you sign in we set one cookie. It keeps you signed in and is used for nothing else.
Messages in your room
Messages between you and us are kept with the time and the name of the person who wrote them.
Your business's records
To count what needs chasing, we read the records you give us: exports you send, or a read-only key you create. We keep the fields we count (for example a customer's name, an amount, a due date, the text of a review) and where each one came from. We do not keep your whole export.
What we hold to reach your systems
Sometimes the work needs a way into one of your systems. You can hand us a login, an app password, the setup for a sign-in code, or a key. You hand it over only through a one-time link, never by email or chat.
It is stored encrypted, apart from our website, and it can be used only for your business. After you save it, no page, person or tool can show it again: to change it, you give us a new one. You can take our access back at any time, at the source, without asking us.
Payment
Stripe handles payment. Your card details go to Stripe and not to us. We keep Stripe's reference for you and whether your plan is paid or has ended.
What the team writes for you
Drafts, notes, approvals (with the name of the person who approved) and what each figure was counted from are kept in your business's room, so that you can check them.
What we use it for
We use it to do the work you asked for, to show you what the team found, to keep your account secure, to take payment, and to answer you. We do not sell your information, and we do not use it for advertising. We do not use your information to train a model.
Who else handles it, and who on our team sees it
Companies that help us run the service, working for us: Cloudflare (hosting, the network and our database), Stripe (payment), Google (our email), and the AI services that help the team draft work, Anthropic (Claude) and Meta (Muse). We do not give your information to anyone else, except where the law requires it, to protect people from harm, or to a buyer if the business is sold, who must keep to this policy.
People on our team can see what the service holds for your business, because they run it and support it. Our team uses your systems to do the work you asked for, inside the access you gave and the approvals you give, and every use of a key we hold is written to a log.
One business's work never reads another's. Each business's records are kept apart in our code, and our tests check it on every release.
Accounts you connect
When you connect an account (Google, Facebook, Instagram, Stripe or another service), we ask for the least access that does the job, read-only first, and you can remove it yourself at any time. While you are only looking, nothing is posted, sent, changed or paid for, and the team cannot act until you start. After you start, anything that reaches your customers or changes your records waits for your yes, item by item, and paying, filing and signing are never done by us.
To remove our access, do it where you made it: in your Google Account under Linked apps, in Facebook under Apps and Websites, in Stripe by expiring the key under API keys, or in the settings of whatever service you used. Removing access stops us reading anything new. To have what we already copied deleted, see our data deletion page.
Google. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. Our team reads your Google data only to do the work you asked for, and only because you agree to that in the proposal you accept.
Facebook and Instagram. We handle information from Facebook and Instagram only as this policy describes, we delete it when it is no longer needed or when you ask, and we do not sell it.
How long we keep things
- Emails and messages you send us, and our replies: for as long as we work with you and for a year after.
- A look you do not start ends two weeks after it opens, and what we read for it is deleted.
- When a plan ends, or you ask us to stop, nothing more is sent or changed. Within 30 days we delete the keys we hold and the data we copied, your account, and the messages in your room. We keep only what the data deletion page lists.
- A sign-in attempt typed by someone who has no account: 30 days.
- Billing records: for as long as tax law requires.
Keeping it safe
Keys are encrypted and held apart from our website. Passwords are kept only as a scrambled form. Our pages are sent over a secure connection. If we find a problem that affects your information, we will tell you. No system is perfectly safe, and we do not claim ours is.
Your choices
You can ask to see, correct, export or delete what we hold about you or your business, and you can disconnect us at any time. Write to support@carefulmachine.com. We answer within ten business days. To have your data deleted, follow the data deletion page.
Children
Careful Machine is for businesses. It is not meant for children, and we do not knowingly collect information from anyone under sixteen.
Changes
If we change this policy we will change the date at the top. If the change matters, we will tell account holders by email before it applies.
Contact
Labyrinth Brazilian Jiu Jitsu LLC, doing business as Careful Machine, 6615 W Cross Creek Bend Ln Ste 400, Fulshear, TX 77441. support@carefulmachine.com.