Significant Machine, LLC ("Significant Machine," "we," "us," or "our") operates The Ledger, a research intelligence platform. This Privacy Policy describes how we collect, use, share, and protect information when you use our Service.
By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. This Privacy Policy is incorporated into and subject to our Terms of Service.
| Category | Examples | Source |
|---|---|---|
| Account Information | Name, email address, password (hashed) | Registration |
| Customer Data | Meeting recordings, transcripts, research documents, notes, attendee names and roles | User uploads, recordings, and input |
| Contact Information | Names, email addresses, roles of meeting attendees and contacts | User input |
| Payment Information | Stripe customer ID, subscription status (we do NOT store card numbers — Stripe handles PCI compliance) | Stripe integration |
| Category | Examples |
|---|---|
| AI Outputs | Extracted insights, syntheses, themes, executive briefs, meeting summaries, search answers, deliberation panel reports |
| PHI Detection Results | Automated flags indicating potential Protected Health Information (heuristic, not guaranteed) |
| Embeddings | Vector representations of text used for search (not human-readable) |
| Category | Examples |
|---|---|
| Usage Data | Pages visited, features used, timestamps |
| Device and Technical Data | Browser type, operating system, IP address (hashed in audit logs) |
We use the following third-party services to process Customer Data. We impose data protection obligations on each Sub-Processor that are materially consistent with this Privacy Policy. We will provide at least thirty (30) days' notice before adding or replacing a Sub-Processor.
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic (Claude) | AI text generation — insight extraction, synthesis, themes, search, executive brief, voice pass, deliberation panel | Transcripts, research text, notes, insights (text only, no audio) | United States |
| OpenAI | Text embedding for vector search | Transcripts, research text, notes, insight text | United States |
| AssemblyAI | Audio transcription and speaker diarization | Meeting audio recordings | United States |
| Supabase (AWS) | Database hosting, file storage, authentication | All Customer Data | United States (AWS us-east-1) |
| Vercel | Application hosting and serverless functions | Request/response data in transit; no persistent Customer Data storage | United States |
| Stripe | Payment processing | Customer email, Stripe customer ID, subscription status (NOT card numbers) | United States |
| Upstash | Rate limiting (Redis) | Hashed user IDs, request counts | United States (AWS us-east-1) |
As of the date of this Privacy Policy, our AI Sub-Processors (Anthropic and OpenAI) have committed in their commercial API terms that data submitted through their APIs is not used to train their general-purpose AI models. AssemblyAI deletes audio data after transcription processing is complete.
Significant Machine monitors its AI Sub-Processors' terms and will notify customers of any material change to these commitments within thirty (30) days of becoming aware of such change. In the event an AI Sub-Processor changes its terms to permit training on Customer Data, Significant Machine will either (a) migrate to an alternative provider or (b) provide the Customer with the option to terminate without penalty.
We retain Customer Data for as long as the Customer's account is active or as needed to provide the Service. Customers may configure project-level retention periods (90, 180, or 365 days, or indefinite).
Upon account termination:
Meeting recordings are stored in encrypted cloud storage (Supabase Storage) and are subject to the same retention and deletion policies as other Customer Data.
We implement commercially reasonable administrative, technical, and organizational measures to protect Customer Data, including:
No method of transmission or storage is 100% secure. We cannot guarantee absolute security.
Under the Virginia Consumer Data Protection Act (VCDPA) and other applicable state privacy laws, you have the following rights regarding your personal data:
To exercise these rights, contact privacy@significantmachine.com. We will respond within 45 days.
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we learn that we have collected personal data from a child under 16, we will take steps to delete that information.
Customer Data is processed and stored in the United States. By using the Service, you consent to the transfer and processing of data in the United States. All Sub-Processors listed above operate within the United States.
In the event of a breach of security involving Customer Data, we will notify affected individuals and applicable regulatory authorities in accordance with the FTC Health Breach Notification Rule (16 CFR Part 318) and applicable state breach notification laws. Notification will occur without unreasonable delay and no later than sixty (60) calendar days after discovery of the breach.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy on the Service and sending an email to the account owner at least thirty (30) days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance.
If you have questions about this Privacy Policy or our data practices, contact us at:
Significant Machine, LLC
Email: privacy@significantmachine.com
This Privacy Policy has been prepared based on current legal guidance for B2B SaaS platforms, including VCDPA, FTC Act, and FTC Health Breach Notification Rule requirements. It is not a substitute for advice from a qualified attorney.