MechCircle

Privacy Policy

Last updated: October 2026

MechCircle (“we,” “us,” “our”) is currently operated by Mech Source (Bangalore, India), with a dedicated MechCircle entity planned for the future. This policy explains what information we collect, how we use it, and your choices.

Information We Collect

Account information: company name, your name, email address, and optionally your GST number, phone number, and address.

Business content you create: tasks, notes, messages, files, and (where applicable to your subscription tier) business documents you send through the platform.

Messages to MechCircle Support: what you write to us and any screenshots or PDFs you attach, and our replies, together with the page you were on, your name and company, the time and any error code the app showed you — all of which you see before you send. A support conversation can be read by you and by MechCircle (the person who runs the platform), and by nobody else: not your colleagues, not your company's admin. It is never sent to an AI service and never read by MechCircle's AI features. Attached files are stored privately and opened only through links that expire within minutes. Support conversations, files included, are never deleted automatically — they are kept until you ask us to remove them.

Technical information: basic error and performance data, collected automatically to help us keep the platform reliable.

We do not sell your data, and we do not use your business content for advertising.

How We Use Your Information

  • To provide and operate the platform (your account, your workspace, communication with your contacts)
  • To send you emails you’ve requested or that relate to your account (invitations, notifications, password resets)
  • To improve reliability by monitoring for and fixing errors
  • To verify GST numbers you choose to enter, for your own convenience

Third-Party Services We Use

We rely on a small number of trusted service providers to operate MechCircle. We do not use any other third parties beyond these:

  • Supabase — hosts our database and stores your account and business data securely.
  • Resend — sends emails on our behalf (invitations, notifications, password resets, documents you choose to email, and the codes for the free drawing reader). Resend keeps a record of each email it sends, including the address, for 30 days.
  • Sentry — receives technical error reports from our production environment only, to help us detect and fix problems. This does not include your message content, file contents, or personal data — only technical/crash information.
  • GSTZen — when you choose to look up a GST number, that number is sent to GSTZen to retrieve publicly available government registration data (company name, address, status). This only happens when you initiate a lookup.
  • Anthropic— when someone at your company has turned AI features on and then uses one, or when anyone uses the free drawing reader, the specific text or file that feature needs (for example, a reminder typed in your own words) is sent to Anthropic's API to be processed. This only happens on that action, never in the background. Anthropic's commercial terms say they may not train models on it, and they delete it within 30 days, with an exception for content their safety systems flag, which can be kept up to two years. What is sent, what is kept and what we record is set out in full on our AI and Your Data page. AI features are off for every company until they are switched on.
  • Cloudflare — on the free drawing reader only, Cloudflare Turnstile checks that a person, not a program, is using the page before a code is sent. It sees your IP address and signals from your browser, not your email address or your drawing. See the free drawing reader on our AI and Your Data page.
  • Razorpay— when you type an IFSC while entering bank details, your browser asks Razorpay's public IFSC service which bank and branch it belongs to. Only the IFSC, a bank branch code, is sent — not the account number or the name. The request goes from your browser, so Razorpay also sees your IP address.
  • Postal Pincode (api.postalpincode.in) — when you type a pincode in an address, your browser asks this public service, which serves India Post's pincode list, for the city, state and area. Only the pincode is sent. The request goes from your browser, so the service also sees your IP address.
  • Your browser's notification service — if you turn on notifications and allow them on a device, MechCircle can notify you even when it is closed. The notification travels through the push service of that device's browser maker (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox, Microsoft for Edge). It is encrypted so that service cannot read it, and it says only who and what kind (for example, “New message from Adithya”) — never the message, a file name or any figure. We keep the address that service gives your device so we can reach it; it is removed when you turn notifications off, sign out, or the device stops accepting them.

Data Sharing

We do not share your data with anyone beyond the service providers listed above, except:

  • With your own Connected contacts, when you choose to communicate or share documents with them
  • With colleagues at your own company, according to the access rules you and your company’s admin set

Your Rights

You can update or correct your account information at any time from your Profile. You can contact us using the Contact Us form to request deletion of your account or ask any question about your data.

Contact

Questions about this policy can be sent via our Contact Us page.

Registered address: C/o Mech Source, 15/28/B, G J Industrial Area, Doddakallasandra, Bangalore - 560062