mechgram.

Privacy notice

5 October 2026 · Version 2026-10-05-v1

Your data controller

EchelonMind Ltd. Contact our privacy team

Information we use

We store account details, linked sign-in identifiers, private source images, brand kits, campaign briefs, generated media, job records and coin transactions. At registration, we send internal account notifications containing your name, email and approximate network-derived location, when available, to the operator’s designated mailboxes for account administration. This does not collect GPS coordinates or a street address. Passwords are hashed. Session and security cookies keep you signed in and protect OAuth and administrator access. We do not store your complete card details.

Why information is processed

Account and campaign information delivers the service you request. Payment records support purchases, refunds and accounting obligations. Security records and rate limits help prevent misuse and protect accounts. We process account and requested campaign data to perform our contract with you, financial records to meet legal obligations, and proportionate security and abuse-prevention information for our legitimate interests in protecting the service.

Service providers

Selected campaign and Studio text, reference images, videos, audio, documents and webpage references are sent to Higgsfield for the generation or editing you request. Character Vault sends your selected photographs for character training only when you confirm that separately priced action. When OpenAI planning is enabled, your brief, high-level script, supplied facts and brand preferences are sent to OpenAI to prepare the campaign plan; uploaded photographs are not sent to that text planner. When you use Video Studio, selected timecoded video frames, source speech and your edit brief are sent to OpenAI to analyse and plan the edit. Approved spoken lines are sent to OpenAI when you choose AI narration. Stripe processes card payments, payment verification and refunds for EchelonMind Ltd through Standard Checkout. Stripe collects the payment and billing details required for those services under its privacy notice. EchelonMind handles customer support, billing records and applicable customer taxes. Earlier Managed Payments purchases remain subject to the arrangement shown on their saved contract and receipt. Mechgram receives payment identifiers and status to credit your wallet and process reversals; it does not receive your full card details. Resend sends verification, recovery, purchase-confirmation, cancellation-support and internal registration-notification emails. Google or Microsoft provides identity information only if you choose that sign-in method. Contabo hosts the application, database and private media. Cloudflare protects website traffic and administrator access; its R2 service holds encrypted recovery backups.

AI supplier data use

Higgsfield’s API terms provide a workspace training opt-out and incorporate a data-processing addendum where applicable. Mechgram enabled the training exclusion on 27 September 2026. Higgsfield allows up to 10 business days to process it; completion is not yet confirmed. Partner models may have different processing terms. We do not promise universal exclusion from training or zero retention. Do not upload confidential client work or sensitive personal information. Workspace access controls do not change a supplier’s data-use terms.

These providers may process data outside the UK. Our review of the applicable contracts and transfer arrangements is still in progress; we are not claiming that a UK-only processing arrangement is in place. Importing a website asks Mechgram to fetch the address you supply. Avoid submitting information that is unnecessary for your campaign.

Access, retention and deletion

Campaign media requires authenticated workspace access. New generated files are scheduled for deletion 60 days after completion; new source images can expire 60 days after upload when no active job requires them. Other new Studio reference uploads also have a 60-day schedule. Character Vault references are scheduled for deletion from Mechgram and the training service after 60 days, when you remove them, or on account closure; unconfirmed supplier deletion is retried. Active or unresolved training must settle first. Files created under the earlier 90-day schedule keep their recorded expiry dates. Private narration source files become eligible for deletion after seven days once their jobs have settled; the published video keeps its audio until that video expires. Video Studio source clips, previews, sampled frames and transcript checkpoints become eligible for deletion after seven days, once active work has settled. Saved edit plans remain with the campaign. In-use brand logos remain with their brand kit. Account export and closure are available in account settings. Closure revokes access immediately and queues private media and campaign content for removal after unresolved jobs and payments are settled.

Purchase, refund, usage and saved contract records are retained for seven years from the transaction, then reviewed for deletion or minimisation. Unused paid balances, disputes, investigations and documented legal holds can require longer retention. This is a review schedule, not an automatic deletion of accounting records. Duplicate sent customer-email copies are removed after 90 days. Recovery backups are encrypted: we keep hourly recovery points for 48 hours and daily points within 35 days, plus the latest checked recovery point. Expiry pauses if a fresh backup cannot be verified, so a backup outage can extend that period while it is resolved. Deleting live content does not immediately remove an older backup copy. Separate deletion records are reapplied and private content purged before a restored service is reopened. Security records should not include passwords, API credentials or complete payment details.

Your choices and rights

You can download account data, request correction or closure, and contact the operator about applicable data-protection rights, including access, erasure, restriction or objection. Some information must remain where a legal obligation or unresolved payment requires it. You may raise a concern with the UK Information Commissioner’s Office.

Only necessary account/security cookies are included in this build. Future analytics or advertising tools require a separate privacy and consent review.