Privacy Policy

Last updated 6 November 2026

This Privacy Policy explains how Antelligen Private Limited (CIN U62011AP2026PTC128809), the company that runs Wheelmachine, handles your personal data.

In short

We collect what we need to run your account and machines: who you are at GitHub or Google, your sign-ins, what is done in your account, and what you use.
We do not sell your personal data or use it for advertising. Our sites set no cookies and do not track you.
Paddle takes payments; we never see your card.
Indian law makes us keep some records for set periods, also after your account closes. We keep them apart and locked.
You can see, correct, delete and take your data: write to privacy@wheelmachine.ai.

A summary to help you read. The full text below is what applies.

1. Who we are

Antelligen Private Limited, Assessment No. 207, Survey No. 42, Rajaveedhi, Narava Village, Gantyada Mandal, Vizianagaram, Andhra Pradesh 535215, India, runs Wheelmachine and is the controller of the personal data described here: we decide what is collected and why. For anything about your data, write to privacy@wheelmachine.ai.

What you put in your machines - files, programs and data - we keep and use only to run the service for you, as you ask. Where it holds other people's personal data, we handle that for you, as your processor, under the Data Processing Addendum.

Our representative in the EU, under the EU's General Data Protection Regulation (GDPR):

Name: Euverify Limited
Address: Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23 AT2P, Ireland
E-mail: gdpr@euverify.com
Appointment: Check it on Euverify Limited's page

Our representative in the UK, under the UK GDPR:

Name: Euverify Ltd
Address: 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom
E-mail: gdpr@euverify.com
Appointment: Check it on Euverify Ltd's page

2. What we collect, why, and on what legal basis

The legal bases are those the EU and UK GDPR name; the same care applies wherever you live.

A. Your account

When you sign in with GitHub, we keep your GitHub user number, login, profile name and the e-mail address GitHub has verified. We ask GitHub only for your profile and e-mail addresses - nothing that reads your code. As you first sign in, we also read when your GitHub account was made (see Automated checks); we do not keep it.

When you sign in with Google, we keep your Google account number, your name and the e-mail address Google has verified. We ask Google only for these - nothing that reads your mail, files, contacts or calendar - and use Google's token once, to learn who you are, then drop it. We use what we receive from Google only to sign you in and run your account, and we follow Google's API Services User Data Policy, including its Limited Use requirements.

When you sign in, your browser tells us its time zone; we use it only to choose a new account's currency.

Why: To make your account, sign you in, give free credit once to each person, and reach you about your account.
Legal basis: Our contract with you; and our legitimate interest in stopping misuse of free credit.

B. Sign-ins

For each sign-in, to the dashboard or from the command line: the IP address and the browser or program it came from, when it began, and when it was last used. And the browsers you signed in to the dashboard from, each known by a cookie of its own, of which we keep only a one-way digest, with when it was first and last seen: so that we can e-mail you when your account is signed in to from a new one. And when you last signed out everywhere, so that a program you let in before then is given no key.

Why: To keep your account safe, and to show you your sign-ins so that you can end any you do not know.
Legal basis: Our legitimate interest in keeping accounts safe.

C. The audit log

What is done in your account: what it was, who did it and with which key or sign-in, when, to what, and the IP address it came from, with details such as a file's path or the browser used.

Why: So that you - and in an organisation, its owners and admins - can see what happened, and to protect the service.
Legal basis: Our legitimate interest in keeping accounts safe and accountable, and our contract with you.

D. Usage and credit

Your machines' sizes, running time and prices, and your credit: every amount added or taken.

Why: To charge you correctly, to show you what you use, and to keep accounts as Indian company and tax law requires.
Legal basis: Our contract with you, and our legal duty to keep accounts. For people in the EU and the UK, that duty is Indian law's, so the basis for it is our legitimate interest in meeting the law that applies to us.

E. Payments

Paddle takes your payment, and we never see your card details. Paddle tells us what you paid and its number for the payment, so that we add the credit to the right account.

Why: To give you the credit you bought, and to refund it.
Legal basis: Our contract with you.

F. What you put in the service

Your machines and what is in them, your backups, the files you keep in folders, and the secrets and AI keys you add. Folders' files are kept sealed in our storage in the EU; the names of folders and files are in our database in Helsinki. Secrets and AI keys are kept sealed. A secret you give a machine is inside it. AI keys and secrets kept outside are not: our servers add them to requests on their way out, and log each use - the key's name, the machine, the address it went to and when - never the key itself or what was sent. Where an organisation limits the AI models its members may use, our servers read which model each request made with the organisation's AI keys asks for, and refuse those its list does not hold.

Why: To run your machines as you ask.
Legal basis: Our contract with you.

G. Organisations

In an organisation, its owners, admins and billing see its members' names, e-mail addresses and GitHub logins; its owners and admins see its audit log; and the people it puts in charge of a member - such as its owners, admins and team managers - can watch the screens of that member's machines. An invitation names the person by e-mail address or GitHub login. The organisation decides what happens to the work in its machines and to its audit log, and we handle them for it under the Data Processing Addendum.

Why: So that an organisation can run its machines and its people.
Legal basis: Our contract with the organisation, and its legitimate interest in running its work.

H. Messages you send us

Your e-mail address and what you write, including reports of abuse and security problems.

Why: To answer you, and to act on what you report.
Legal basis: Our legitimate interest in answering you and in keeping the service safe; where the law makes us act on a report, our legal duty.

I. Our sites and our API

Our sites - wheelmachine.ai, docs.wheelmachine.ai and status.wheelmachine.ai - set no cookies, run no analytics or tracking, and load nothing from other companies: their fonts are their own. Our servers need your IP address to answer your browser. The status page is served by Cloudflare instead, from the part of its network nearest you, so that it still works when our servers do not; Cloudflare sees your IP address when you open it. Each call to our API is logged with a request number, the route, the result, how long it took, and the key or sign-in that made it - never what you sent.

Why: To show you our sites, and to run, mend and protect the service.
Legal basis: Our legitimate interest in a working, safe service.

3. What you must give us

To open an account, you need a GitHub or Google account with an e-mail address that GitHub or Google has verified. To buy credit, you give Paddle what it asks for at checkout. Where the law requires us to check who you are - and for customers in India it does - we will ask for your name, address and phone number, and may limit your account until you give them. Without these, we cannot open or keep your account. Everything else you give us is up to you.

4. Automated checks

To stop misuse of free credit, a GitHub account that is very new may be refused automatically when it is first used to sign in; an account made with Google gets free credit only once a GitHub account old enough is linked to it; and a new account gets no free credit when its GitHub or Google account, or an e-mail address it verified, had free credit here before. We also use automated signals, such as unusual traffic, to spot abuse; a person looks at what they find before we act on an account, except where we must act at once to stop serious harm. If an automated check has affected you, write to support@wheelmachine.ai, and a person will review it.

5. Who receives it

We do not sell your personal data, or share it for advertising. We share it only with:

Hetzner Online GmbH, whose data centre in Helsinki, Finland, holds our servers: your machines, our database and our logs.
Cloudflare, whose storage in the EU keeps the machines' files we put away there, such as backups and archived machines, and the files kept in folders. They are sealed with a key of your account's own, so Cloudflare cannot read them. Cloudflare also serves our status page.
Zoho, which holds our mailboxes in India: the e-mail you write to us, and our replies.
Resend, which sends our e-mail to you, such as invitations and spend alerts.
GitHub, which signs you in and tells us who you are.
Google, which signs you in and tells us who you are, if you sign in with Google.
Paddle (Paddle.com), our online reseller and Merchant of Record. It takes your payments and handles your card details - which we never see - any tax, your receipts and refunds, under its own privacy notice.
GPU providers. A machine with a GPU, in early access, runs on a GPU provider's server, in the city and country shown before you start it.
The AI companies you choose. Your agents send them what you ask, with your keys. Their own terms and privacy policies apply.
Your organisation, as described above, if you are in one.
Professional advisers, such as lawyers and accountants, bound to keep it confidential.
Authorities, when the law requires it - such as courts, the police, and India's CERT-In - once we have checked that the request is lawful.

The companies that handle personal data for us, what each does and where, are on our Subprocessors page.

6. Where your data is

We are a company in India, and our team works from India. Our servers are in Helsinki, Finland, and our storage is in the EU; our mailboxes are with Zoho, in India. Paddle is in the UK; GitHub, Google, Cloudflare and Resend are companies of the United States, and Resend keeps its record of the e-mail we send there; GPU providers are where their servers are, as shown before you start a machine. More on our Data location page.

When personal data goes from the EU, the EEA or the UK to a country whose protection the European Commission, or the UK, has not found adequate - India among them - we protect it with the standard contractual clauses the European Commission approved, with the UK's addendum where UK law applies, or with another safeguard the law allows. What your agents send to AI companies goes wherever those companies are, as you choose.

7. How long we keep it

What	How long
Your account	While it is open; then as When you close your account says.
Who held a closed account	5 years after it closes, if the account was verified in India; 180 days for every other account. Kept apart and locked; then deleted.
Sign-in records	180 days after the sign-in ends. A sign-in ends when you end it, or 30 days after it was last used. A code made to sign in the command line is deleted a day after it runs out. A browser you signed in from is remembered until 400 days after it last signed in. When you last signed out everywhere is kept while your account is open.
The audit log	Kept as it was written, never changed, while the account is open.
Logs of our servers and our API	180 days; from May 2027, one year, as India's data protection rules will require.
Usage, credit and billing records	8 years, as Indian company and tax law requires.
Machines, files and backups	Until you delete them, or close your account. Deleting a machine removes it and its disk at once. Encrypted pieces of its stored copy and backups can stay in our storage until we clear them.
Files in folders	Until you delete them, or close your account; what you delete stays 30 days in its folder's Trash first. Your own folder in an organisation stays 30 days after you leave it, for its owners to take what they need; then it is deleted. If an account's balance is not brought above zero within 30 days of its credit running out, the files in its folders are deleted, after e-mails saying when.
Secrets and AI keys	Until you delete them, or close your account.
Content we remove for breaking the law or our rules	180 days, locked, as Indian law requires for investigations; then deleted.
Messages you send us	As long as we need to answer you and follow up.

8. When you close your account

When you close your account, we delete your profile, sign-ins and keys at once, and your machines with them. We also erase what your files and backups are encrypted with, so nobody can read them again; their encrypted pieces can stay in our storage until we clear them. Indian law makes us keep a short record of who held the account: your name, e-mail address, GitHub login and number (and your Google number, if you signed in with Google), when you signed up and from which IP address, and when each of your machines was made and deleted, with the web addresses it served - and, if you verified who you are in India, the name, address and phone number you verified.

We keep that record for 5 years if the account was verified in India, as CERT-In's directions require, and for 180 days for every other account, as India's IT Rules require. We also keep billing records for 8 years. We keep these apart and locked, use them only to meet the law and to answer lawful requests, and then delete them.

We also keep one-way codes made from the GitHub or Google account you signed in with, the GitHub account you link, and each e-mail address they verified, which cannot be turned back into them, so that free credit is given only once to each person. We keep them for as long as we give free credit to new accounts.

For people in the EU and the UK, our legal basis for keeping these records is our legitimate interest in meeting the Indian law that applies to us.

9. Your rights

Wherever you live, you can ask us to:

show you the personal data we hold about you, and give you a copy;
correct it, or complete it;
delete it, except what the law makes us keep;
only keep it, and use it no further, while a question about it is settled;
give it to you in a form you can take elsewhere;
stop using it where we rely on our legitimate interests, unless we have compelling reasons to go on;
stop using it, wherever we rely on your consent: you can withdraw it at any time.

Some you can do yourself in the dashboard: see and end your sign-ins, export your audit log, and delete machines, keys and secrets. For the rest, write to privacy@wheelmachine.ai from the e-mail address on your account, or tell us your GitHub login, so that we know the request is yours. We answer within one month, and sooner where we can.

You may also complain to a data protection authority, such as the one where you live or work.

10. Your rights in India

Under India's Digital Personal Data Protection Act, 2023, you can also name someone to use your rights for you if you die or cannot act yourself: tell us at privacy@wheelmachine.ai.

To complain, write to our Grievance Officer: we acknowledge your complaint within 24 hours and resolve it within 7 days. If you are not satisfied, you may complain to the Data Protection Board of India once its process applies to us, from May 2027.

11. Your rights in the United States

We do not sell or share personal information, as the California Consumer Privacy Act defines those words, and we do not use it for targeted advertising. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of selling and sharing - which we do not do anyway.

12. Children

Wheelmachine is not for anyone under 18. If we learn that an account belongs to someone younger, we close it.

13. How we keep it safe

What you send us travels encrypted, over HTTPS or SSH.
API keys and sign-in cookies are kept only as digests, never as they are.
Secrets and AI keys are kept encrypted. A secret you give a machine is inside it; AI keys and secrets kept outside are not.
Machines' files in our storage are sealed with a key of their account's own: without it nobody can read them - not the storage company, and not anyone holding a copy of our database.
Each machine is a virtual machine of its own.

If a breach puts your personal data at risk, we tell you without undue delay. We report incidents to India's CERT-In within 6 hours of noticing them; to the data protection authorities of the EU and the UK within 72 hours, where the law requires it; and, from May 2027, to India's Data Protection Board within 72 hours. More on our Security page.

14. Cookies

Our sites - wheelmachine.ai, docs.wheelmachine.ai and status.wheelmachine.ai - set no cookies. They keep a few things in your browser's own storage: whether you chose day or night, kept only once you choose; the language you chose for code in the docs; and the status page's recent checks. None of it is sent to us.

The dashboard, app.wheelmachine.ai, sets these cookies, all of them needed to sign you in and keep your account safe, and read by no other site:

Cookie	What it does	How long
`__Host-wm_session`	Keeps you signed in.	30 days from your last use
`__Host-wm_csrf`	Lets the dashboard's page prove a call is its own.	As long as your sign-in
`__Host-wm_flow`	Ties a sign-in at GitHub or Google to the browser that began it.	10 minutes
`__Host-wm_device`	Knows this browser again, so that we can e-mail you when your account is signed in to from a new one. We keep only its digest.	400 days from your last sign-in

The dashboard also keeps in your browser the account you chose last, and an invitation while you sign in to accept it. We use no advertising or analytics cookies, and no other company's cookies. These cookies are strictly necessary for the service you ask for, so the law does not ask for your consent to them, and we show no cookie banner.

15. Changes to this policy

When we change this policy, we update this page and its dates. Before a significant change takes effect, we e-mail you. We keep every earlier version: ask privacy@wheelmachine.ai for one.

16. Contact

Antelligen Private Limited, Assessment No. 207, Survey No. 42, Rajaveedhi, Narava Village, Gantyada Mandal, Vizianagaram, Andhra Pradesh 535215, India. Privacy: privacy@wheelmachine.ai. Our Grievance Officer in India: Madu Saikiran, grievance@wheelmachine.ai.