Privacy Policy

1. Who we are

Data controller: Manda Labs.

Business address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

Privacy contact: privacy@mandalabs.ai

EU representative (Article 27 GDPR): To be appointed prior to general availability for EU-resident customers; contact details will be published on this page once contracted.

2. Data we collect

We collect only what we need to operate the Service. By category:

• Account data — first and last name, work email address, organization name and type, industry, organization size, your role and seniority. Provided by you at signup.
• Authentication data — email address and password hash (managed by our auth provider, Supabase). We never see your plaintext password.
• Payment data — subscription plan, billing status, Stripe customer identifier, billing address. Card numbers are tokenized by Stripe and never reach Manda systems.
• Connected platform data — the credentials needed to authenticate with each platform you connect (OAuth access and refresh tokens, API keys, database passwords, or per-tenant client secrets, all encrypted at rest using AES-256-GCM), plus the account identifiers, campaign / ad-set / creative metadata, performance metrics, schema metadata, and query result rows that the connector returns. Provided when you connect a platform via the Data Bank. The current list of supported platforms (ad networks, CRMs, marketing-automation tools, cloud warehouses, customer-managed databases, and analytics services) is published at /subprocessors.
• Conversation history — the prompts you send to the AI assistant, the assistant’s responses, and chart payloads generated as part of an analysis.
• Usage data — counters of chat messages and analyses per billing period for plan enforcement.
• Technical data — user-agent string, timestamps, request paths, status codes, and latency. Once our request-logging pipeline is enabled (post-launch), IP addresses are stored as salted SHA-256 hashes only; we do not store raw IPs in our application database. Until then IPs may appear in short-lived host-level access logs at our hosting provider.
• Cookies and similar storage — see Section 6 and our Cookie Policy.

3. How we use it

For each purpose we identify the GDPR Article 6 lawful basis:

• Provide the Service (deliver insights, run AI queries, ingest connected ad data) — performance of a contract (Art 6(1)(b)).
• Authenticate and secure accounts — legitimate interest in protecting our customers and platform (Art 6(1)(f)).
• Billing, tax, and accounting — legal obligation (Art 6(1)(c)).
• Service emails (trial expiry, password reset, data-export delivery) — performance of a contract.
• Marketing emails — consent (Art 6(1)(a)). Opt-in only via the signup form or your settings; you can withdraw at any time.
• Product analytics and telemetry — consent via the cookie banner. Off by default until you opt in.
• Error monitoring (via Sentry) — legitimate interest in keeping the Service reliable. Personally identifying information is scrubbed before transmission.
• AI processing of your data — performance of a contract. Our DPIA covers automated insights generation; outputs are advisory and do not constitute solely automated decisions producing legal or similarly significant effects under Art 22.

4. Sub-processors

Manda uses a small number of trusted vendors to deliver the Service. Each is bound by a Data Processing Agreement and may process personal data only on our instructions. The full, current list (with region and transfer mechanism) is published at /subprocessors and kept in sync with the platform’s actual integrations.

Core sub-processors — engaged for every customer: AI inference (Anthropic), database and authentication (Supabase), payment processing (Stripe), transactional email (Resend), error monitoring (Sentry), hosting (Vercel), and consent management (Iubenda).

Connector sub-processors — engaged only when you choose to connect a specific platform via the Data Bank. If you never connect a platform, no data is exchanged with it. The current list of available and pending connectors is published at /subprocessors.

5. Sharing & sale

We do not sell personal data. We do not share customer data with advertisers or data brokers. We do not use your data to train third-party AI models — our AI provider (Anthropic) does not train its models on Claude API inputs by default, and we have not opted in.

We disclose personal data only to: (i) sub-processors as described above; (ii) competent authorities when legally required; and (iii) prospective acquirers in the context of a corporate transaction, subject to confidentiality and continuity of this Policy.

6. Cookies

The Service uses the following cookies and browser-storage keys. Full detail is in our Cookie Policy.

• sidebar:state — first-party cookie, functional, 7 days. Persists sidebar layout.
• manda_data_source_selection — localStorage, functional. Remembers your last data-source selection.
• manda_trend_keywords_draft — localStorage, functional. Keeps in-progress Models Hub trend-keyword fields so navigation does not lose them (cleared on seat switch).
• manda_trend_keywords_open — localStorage, functional. Remembers whether the Models Hub trend-keyword editor was expanded.
• manda_trial_banner_dismissed — localStorage, functional. Dismissed-banner state.
• manda_pricing_modal_seen — localStorage, functional. One-time pricing modal flag.
• manda.consent.v1 — localStorage, strictly necessary. Consent state mirror.
• manda:tenancy:accountId — localStorage, strictly necessary. Remembers your selected account across reloads.
• manda:tenancy:seatId — localStorage, strictly necessary. Remembers your selected seat (brand × market) across reloads.
• _iub_* — Iubenda cookies, strictly necessary. Stores your consent record.
• Supabase auth tokens — localStorage, strictly necessary. Keeps you signed in.
• Sentry breadcrumbs — in-memory only when enabled, analytics. PII-scrubbed.
• __stripe_* — third-party, strictly necessary. Loaded only on checkout for fraud prevention.
• mdl_ref — first-party cookie, functional, 60 days. Stores the referral code from a ?ref= link so we can credit the referrer when you sign up.
• mdl_waitlist_code — first-party localStorage, functional, until cleared. Stores your waitlist referral code so the waitlist page can restore your position and completed steps when you return.
• mdl_waitlist_modal_seen — first-party localStorage, functional, until cleared. Remembers that the waitlist popup has been shown so it does not auto-open on every visit.

7. Retention

We keep personal data only as long as we need to:

• Account profile and subscription records — until you delete your account, then removed from production within 30 days and from rolling backups within a further 30 days.
• Conversation history — 365 days from creation, unless you pin a conversation. You can delete any conversation at any time.
• Connected-platform datasets — 90 days from last sync.
• Audit logs — 730 days. Required for SOC 2 / ISO 27001 evidence.
• Consent records — retained indefinitely as legally required to demonstrate the basis for processing.
• Connector credentials (OAuth tokens, API keys, database passwords, per-tenant client secrets) — until you disconnect the platform or after 90 days of inactivity, whichever is sooner.
• Backups — encrypted, rolling 30-day retention with our hosting providers.

8. International transfers

Most of our infrastructure and several sub-processors are based in the United States. Where we transfer personal data outside the EEA, UK, or Israel, we rely on one of the following safeguards:

• The EU-US Data Privacy Framework (DPF) where the recipient is certified;
• Standard Contractual Clauses (Commission Decision 2021/914);
• Adequacy decisions (e.g. Canada, UK).

The transfer mechanism for each sub-processor is listed at /subprocessors.

9. Your rights

Under GDPR, UK GDPR, and Israel’s Privacy Protection Law, you have the following rights. We aim to respond within 30 days; in practice exports and deletions complete within 24 hours.

• Access and portability (Art 15, 20) — download a structured JSON copy of your data via Settings → Privacy → Download my data.
• Erasure (Art 17) — permanently delete your account via Settings → Privacy → Delete my account.
• Rectification (Art 16) — update your profile in Settings → Profile.
• Restriction and objection (Art 18, 21) — email privacy@mandalabs.ai.
• Withdraw consent (Art 7(3)) — via the cookie icon (bottom-left) or Settings → Privacy. Withdrawal does not affect processing carried out before withdrawal.
• Lodge a complaint with a supervisory authority — in Israel the Privacy Protection Authority; in the EU your local DPA.
• Automated decisions (Art 22) — we do not use solely automated decision-making that produces legal or similarly significant effects on you. AI-generated insights are advisory.

10. Security

We protect your data with a defence-in-depth approach:

• TLS 1.2+ for all data in transit.
• AES-256-GCM application-layer encryption for every credential we store on your behalf — OAuth access and refresh tokens, API keys, database passwords, and per-tenant client secrets — with key rotation supported.
• Disk-level encryption at rest provided by Supabase and Vercel.
• Row-level security on every database table; users can only read their own rows.
• HMAC-signed OAuth state tokens with a 15-minute expiry to prevent CSRF.
• Rate limiting and standard security headers (HSTS, CSP, X-Frame-Options) on API endpoints.
• Optional multi-factor authentication (TOTP) for end-user accounts via our auth provider.
• Error monitoring with PII scrubbing; access and audit logging for sensitive operations.

Should a personal-data breach occur, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, in accordance with GDPR Art 33-34.

11. Children

Manda is a B2B service not directed to anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@mandalabs.ai and we will delete it.

12. Changes

We may update this Policy as the Service evolves. The version and effective date at the top of this page always reflect the current Policy. Material changes will be notified by email and an in-app banner at least 14 days before they take effect.

13. Contact

privacy@mandalabs.ai for any privacy question, DSR, or complaint.

Manda Labs · 131 Continental Dr, Suite 305, Newark, DE 19713, USA · For anything not related to privacy, reach us at support@mandalabs.ai.