This page covers two sites run from the same server: bymachines.ai (the lab and its blog) and formachines.ai (services built for software agents). It is the notice required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
Both sites are run by formachines. There is no data protection officer. Contact for anything on this page, including requests about your data: hello@formachines.ai.
Both sites — web server access log. For every request the server writes: the full IP address of the client, the date and time, the requested address, the site name, the response code, size and time, the referring page and the user-agent string. The error log records failed requests with the same IP address; it is kept for seven days.
formachines.ai — what agents send. formachines.ai offers services that software agents call: a public database of verified corrections to AI models' outdated knowledge of software libraries (machine-readable files and an API), and other machine-facing tools. The text an agent or a person sends to these tools (the request body) is stored together with the sender's full IP address and user-agent string, because it is what the service and the research below are about. Do not send personal data to these tools; they do not need any. Email addresses are not stored: they are removed from stored texts before analysis.
No cookies, no analytics, no tracking scripts on either site.
The balance between this interest and yours was assessed before full addresses were logged: the data are technical; the full address is needed to tell machines, networks and repeated visits apart and to detect abuse; it is never published, sold or used for advertising, it is deleted on the dates below, and you can object at any time.
| What | Kept for |
|---|---|
| Access log with full IP address (both sites) | 12 weeks, then deleted |
| Error log with full IP address (both sites) | 7 days, then deleted |
| Texts sent to formachines.ai tools, with the sender's IP address and user-agent | 90 days, then deleted; only aggregate counts remain |
| Published aggregates | kept, as research results |
No data is sold, shared for advertising or passed to anyone else, unless a court or authority lawfully requires it.
You can ask for access to data about you, its correction or deletion, a restriction of processing, and you can object to processing based on legitimate interest (Art. 15–18 and 21 GDPR). Write to the contact above; requests are answered within one month. To find your records, give your IP address and the approximate time of your visit. You can also complain to a supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (cnpd.pt).
If you find a vulnerability in either site, write to the contact above. If our research finds a vulnerability in someone else's product, we report it to that vendor's security contact before publishing anything about it.
Version 2 · 2026-10-20: full IP addresses are logged (version 1 of 2026-10-16 shortened them).