Law Enforcement Guidelines

Last updated: 2026-06-30

This page explains how Machai (the "Service") handles requests from law-enforcement and other public authorities for user data. It is an operational guideline that describes our standard process — it is not legal advice, and it does not create any contractual obligation, waiver, or admission. Nothing here limits the rights or defences available to us or to our users under applicable law.

1. Scope and purpose

This guideline applies to requests for user data made to Machai by law-enforcement, judicial, and other competent public authorities. Its purpose is to set out who may make a request, what legal basis we require, and what we may disclose, so that legitimate investigations can be handled efficiently while we protect our users' fundamental rights under EU data-protection law.

2. Who may submit a request

We accept requests from competent German and EU law-enforcement and judicial authorities acting within their jurisdiction and statutory powers. Authorities outside the EU should route requests through the applicable channels for international cooperation — a mutual legal assistance treaty (MLAT), a European Investigation Order where applicable, or another recognised instrument of international legal assistance — rather than directly to us. We are not obliged to act on direct requests from foreign authorities that bypass these channels.

3. Required legal process

We require a valid legal basis for every request. Depending on the data sought, this generally means a court order, a public-prosecutor request, or an equivalent instrument issued under the German Code of Criminal Procedure (Strafprozessordnung, StPO) or comparable EU law. We review each request individually for lawfulness, specificity, and proportionality. We will reject — or ask the requesting authority to narrow — requests that are overbroad, vague, or that lack a sufficient legal basis.

4. Data we may disclose

What we can disclose is limited to what we actually hold and to what the law requires, applying the principle of data minimisation. Depending on the request and its legal basis, this may include account data (such as the email address associated with an account), profile information, and conversation transcripts. We disclose only the specific data that is legally required and proportionate to the request; we do not provide bulk access. The categories of data we hold are described in our Privacy Policy.

5. Emergency disclosure

Where we believe in good faith that there is an imminent risk of death or serious physical harm to a person, we may disclose the information reasonably necessary to address that emergency without waiting for full legal process. Such disclosures are limited to what is necessary to prevent the harm.

6. User notification

We aim to notify users whose data is requested before we disclose it, so that they can seek to protect their rights. We will not give notice where we are legally prohibited from doing so (for example, by a statutory non-disclosure or secrecy order), where we believe notice would create a risk to life or safety, or where an emergency disclosure under Section 5 applies. Where notice is delayed by a legal prohibition, we aim to notify the affected user once the prohibition lapses.

7. Data retention and preservation requests

We retain data in accordance with our Privacy Policy and our applicable retention obligations. We may honour a properly issued request to preserve specified data for a limited period pending the service of formal legal process. A preservation request does not by itself oblige us to disclose any data — disclosure still requires the valid legal process described in Section 3.

8. How to submit a request

Submit requests by email to ashkan.taremi@machaiapp.com. To allow us to process a request, it should set out: the requesting authority and the name and contact details of the responsible official; the legal basis for the request; the specific account identifier(s) concerned (for example, the email address); the precise categories of data sought and the relevant time period; and any applicable deadline. We may ask for clarification or additional documentation before we respond.

9. Legal framework

We process and disclose personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German law, including Article 6(1) GDPR as the basis for lawful processing and, where disclosure is mandated, Article 6(1)(c) GDPR (compliance with a legal obligation). For a full description of how we process personal data, see our Privacy Policy; for the contractual framework governing use of the Service, see our Terms of Service.