Privacy Policy

1. Who We Are

MANO is operated by MANOAI Limited, a company registered in England and Wales ("we", "us", "our"). For the purposes of UK data protection law, we are the data controller in respect of account and platform data we collect and process directly.

Contact: manoaisolutions@gmail.com | manoai.org

This Privacy Policy explains what data we collect, why, how we use it, who we share it with, and your rights under UK GDPR and the Data Protection Act 2018.

2. Data We Collect

Account and profile data: full name, email address, hashed password (managed by Supabase Auth), organisation name, broker association, plan tier, referral code, account approval status, last active timestamp, and account preferences.

Deal and commission data: deal names, lender names, fee amounts, commission figures, deal dates, payout status, deal notes, and month-by-month deal history entered by the user.

Lead and pipeline data: customer names, application URLs, vehicle details, callback dates and times, pipeline stage, notes, heat status, and checklist actions.

Calendar and booking data: when users activate the Calendar Booking feature, customer name and phone number submitted by customers via the public booking page, together with selected date and time slots.

Smart Send data: deal pack content, shared link identifiers, customer interaction events (link opened, quote requested, car portal clicked, proceeded), and pack metadata.

Feedback and attachments: feedback titles, descriptions, category, vote counts, and any image or screenshot attachments uploaded by users. Attachment files are stored in cloud storage.

Connect messaging data: messages, timestamps, conversation identifiers, and read status within the MANO Connect internal messaging system.

Analytics and usage data: feature usage events (e.g. calculator used, template copied, AI message sent, MOT check performed, deal logged), timestamps, and user and organisation identifiers. This data is used for platform improvement and, for Business and Enterprise plans, to power manager and admin analytics dashboards.

Referral data: referral codes generated per user, referral relationship records (who referred whom), referral status, and broker request submissions.

Browser and session data: browser type, device type, and preferences stored via localStorage and sessionStorage for theme, settings, and session state. We do not use third-party tracking cookies.

Notification and email data: email notifications sent via Formspree relating to account activity such as signup notifications to administrators.

3. How We Use Your Data

We use the data we collect to:

• provide, operate, and maintain the MANO platform and its features
• authenticate users and manage account access and plan entitlements
• power AI assistant functionality (data is passed to third-party AI providers — see Section 6)
• provide deal, commission, and pipeline tracking features
• operate the callback, calendar, and booking features
• generate and deliver Smart Send packs to customers on behalf of users
• provide MOT and FCA lookup results via third-party data sources
• calculate and display analytics for users and administrators
• process referrals and manage the referral scheme
• send administrative notifications where required
• send product updates, offers, and marketing emails where permitted by law
• improve, develop, and secure the platform
• comply with legal obligations

We may send occasional email marketing and product updates about MANO features, plan changes, offers, and account-manager productivity tips. You can unsubscribe from marketing emails at any time. We will still send essential service, security, billing, and account emails where needed to operate the Platform.

4. Lawful Basis for Processing (UK GDPR)

We process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the MANO service you have signed up for
• Legitimate interests — platform security, analytics for platform improvement, fraud prevention, and referral scheme operation, where these interests are not overridden by your rights
• Consent — where you actively choose to enable optional features such as calendar booking pages or AI assistant usage
• Legal obligation — where we are required to retain or disclose data by law

5. Customer Data Entered by Users

MANO enables account managers to input data about their own customers, including names, contact details, vehicle information, application references, and financial figures. In relation to this data:

• You (the user) or your employer act as the data controller
• MANOAI Limited acts as a data processor on your behalf
• You are solely responsible for ensuring you have a lawful basis under UK GDPR to input and process that customer data through MANO
• You must not enter special category personal data (health data, financial vulnerability indicators, biometric data, etc.) into MANO

Enterprise and Business customers may wish to enter into a Data Processing Agreement (DPA) with us. Please contact us at manoaisolutions@gmail.com to request one.

6. Third-Party Data Processors

We use the following third-party services which may process personal data on our behalf or alongside us:

• Supabase Inc. (USA / EU infrastructure) — our primary database, authentication, and file storage provider. Personal data including account details, deal data, messages, and uploaded files is stored on Supabase-managed infrastructure. Supabase is SOC 2 certified and complies with GDPR standards. See: supabase.com/privacy
• OpenRouter / DeepSeek — AI model providers used to power the MANO AI assistant. Queries submitted through the AI feature may be processed by these providers. Do not submit sensitive customer financial or personal data through the AI assistant. See their respective privacy policies for details.
• Cloudflare Inc. (USA) — used to operate our FCA proxy and infrastructure workers. Request data may pass through Cloudflare's network. See: cloudflare.com/privacypolicy
• Stripe — subscription payment processing. We do not store card details; Stripe handles payment data in line with its own privacy and PCI compliance standards.
• DVLA / MOT API — vehicle registration numbers submitted for MOT checks are passed to the relevant government API to retrieve MOT history data.
• FCA Register API — firm names or FRN numbers submitted for FCA lookups are passed to the FCA's public API via our proxy.
• Formspree — used to deliver administrative email notifications. Limited data (name, email, organisation) may be included in these notifications.
• Netlify / GitHub — used for platform hosting and code deployment. No personal data is intentionally passed to these services beyond standard web hosting activity.

7. Public-Facing Features

Smart Send: When an account manager sends a Smart Send pack link to a customer, the customer may interact with a public MANO-hosted page. Interaction events (link opened, quote requested, etc.) are logged against the pack and made visible to the sending account manager. Customers are not required to create an account.

Calendar Booking Pages: Account managers may share a booking link with customers. Customers who use this link submit their name and phone number to book a call slot. This data is stored in MANO and made visible to the account manager. Customers should be informed by the account manager that their data will be processed through MANO for the purpose of arranging a callback.

8. Data Sharing

We do not sell personal data. We do not share personal data with third parties for marketing purposes. Data is only shared with the third-party processors listed above, in accordance with this Policy, or where required by law or legal process.

Within an organisation using a Business or Enterprise plan, administrators and managers may have visibility of data entered by account managers within their organisation, including deal data, pipeline data, analytics events, and usage information.

9. Data Retention

We retain account data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations and handle disputes. Inactive accounts may be removed after a prolonged period of non-use. Deal, lead, and pipeline data is retained in accordance with your plan and any deletion actions you take within the platform. Uploaded files (such as feedback attachments and Call Coach recordings) are retained until deleted by you, an administrator, or us according to platform retention settings. Analytics event data is retained for platform improvement purposes.

You may request deletion of your account and associated data at any time by contacting us at manoaisolutions@gmail.com.

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data where there is no overriding legal reason to retain it
• Right to restriction — request that we restrict processing of your data in certain circumstances
• Right to data portability — request your data in a structured, machine-readable format where technically feasible
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at manoaisolutions@gmail.com. We will respond within one month in accordance with UK GDPR requirements.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your personal data.

11. International Data Transfers

Some of our third-party processors (including Supabase and Cloudflare) may transfer or store data outside the UK. Where this occurs, we rely on appropriate safeguards including standard contractual clauses or adequacy decisions under UK GDPR. By using MANO, you acknowledge that your data may be transferred internationally in connection with the services described in this Policy.

12. Security

We implement reasonable technical and organisational measures to protect personal data, including encrypted data transmission (HTTPS), password hashing via Supabase Auth, row-level security on our database, and restricted access controls. However, no online system is completely secure and we cannot guarantee absolute protection against all threats.

You are responsible for maintaining the security of your account credentials. Do not share your password or access details.

13. Cookies and Local Storage

MANO uses browser localStorage and sessionStorage to store your preferences, session state, theme settings, and cached data locally on your device. We do not use third-party advertising or tracking cookies. Supabase Auth may use session cookies for authentication. You can clear local storage via your browser settings, which may log you out and reset your preferences.

14. Children

MANO is not intended for users under 18 and we do not knowingly collect data from minors.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via an in-platform announcement. Continued use of MANO after changes are published constitutes acceptance of the updated Policy. The date at the top of this Policy reflects the most recent update.

16. Contact

For any privacy, data protection, or legal enquiries:

Email: manoaisolutions@gmail.com
Website: manoai.org