Privacy Policy

1. Who We Are

MANO is operated by MANOAI Limited, a company registered in England and Wales ("we", "us", "our"). For UK data protection purposes, we are the controller for account, billing, security, product, analytics, marketing, and direct MANO communications. For customer data entered into MANO by users or organisations, we usually act as a processor on behalf of that user or organisation.

Contact: manoaisolutions@gmail.com | manoai.org

This Privacy Policy explains what personal data we collect, why we use it, who we share it with, how long we keep it, and your rights under UK GDPR and the Data Protection Act 2018.

2. Data We Collect

Account and profile data: name, email address, authentication identifiers, organisation, role, department, permissions, plan tier, approval status, manager/admin status, invite/referral information, preferences, and last active timestamps.

Organisation and admin data: organisation names, settings, feature access, manager permissions, subscription state, usage counts, user lists, admin actions, and support/security records.

Deal, lead, payout, and pipeline data: customer names, deal notes, application links, callback details, vehicle details, lender names, fee and commission figures, payout stages, unwind markers, and related workflow history entered by users.

Templates, messages, and communications: quick templates, custom template sections, favourites, notes, Connect messages, read receipts, mentions, internal communications, and generated text copied or saved by users.

Customer-facing link data: Smart Send packs, e-sign tracking records, customer pack links, booking links, customer names or phone numbers submitted through booking pages, link open events, click events, quote/proceed actions, and related timestamps.

Risk, vehicle, MOT, dealer, and lookup data: vehicle registrations, MOT and vehicle health outputs, risk checker inputs, dealership names, FRNs, websites, postcodes, Google-style rating/review evidence, FCA lookup outputs, deal pack reports, and PDF/report metadata.

AI and decision-support data: prompts, inputs, extracted facts, draft outputs, classifications, summaries, risk-support outputs, confidence indicators, and audit records generated when users choose to use AI-assisted or cross-check features.

Files and uploads: screenshots, feedback attachments, documents, library uploads, call review files, and any metadata linked to those files.

Usage, device, and security data: feature usage, page/activity events, timestamps, browser/device information, local/session storage preferences, IP-derived security information where available, audit logs, error logs, and suspicious activity signals.

Billing and payment data: plan, billing status, Stripe customer/subscription identifiers, invoices, payment state, and billing contact information. Card details are handled by Stripe and are not stored by MANO.

3. How We Use Data

We use personal data to:

• provide, operate, secure, maintain, and improve MANO
• authenticate users, manage invites, approve accounts, and enforce permissions
• provide deal, lead, payout, calculator, calendar, template, messaging, and reporting features
• generate customer packs, e-sign tracking, booking pages, and PDF/report outputs
• provide MOT, vehicle, dealer, FCA, Google-style, website, and risk-support lookups
• provide AI-assisted drafting, extraction, cross-checking, ranking, and decision-support features
• show managers/admins organisation-level usage, performance, and security information
• process subscriptions, billing, referrals, support requests, and service communications
• monitor abuse, diagnose errors, investigate suspicious activity, and protect the Platform
• meet legal, tax, accounting, security, and regulatory obligations

4. Lawful Bases

We rely on different lawful bases depending on context:

• Contract: to provide MANO accounts, subscriptions, features, support, and billing.
• Legitimate interests: to secure the Platform, improve features, prevent abuse, maintain audit logs, understand usage, and communicate relevant product updates.
• Consent: where you choose optional features or where consent is legally required for a particular communication or setting.
• Legal obligation: for records we must keep for tax, accounting, legal, security, or regulatory reasons.

ICO guidance says organisations should tell people their purposes and lawful bases in privacy information. We have written this Policy to make those purposes clear.

5. Customer Data and Processor Role

Where users enter customer or third-party data into MANO, the user or their organisation is normally the controller and MANOAI Limited is normally the processor. The controller is responsible for telling customers how their data will be used, choosing the lawful basis, handling customer rights requests, and ensuring customer data is suitable to enter into MANO.

Users must not enter special category data, criminal offence data, highly sensitive financial vulnerability information, or unnecessary documents unless their organisation has agreed appropriate controls with us in writing.

Enterprise and Business customers can request a Data Processing Agreement by contacting manoaisolutions@gmail.com.

6. AI-Assisted Features

Some MANO features use AI-assisted or rules-based decision-support services to draft text, extract information, summarise records, check vehicle/MOT information, assess risk signals, or recommend review actions. These features are designed to support human users, not replace them.

MANO does not intend AI-assisted features to make solely automated decisions with legal or similarly significant effects on customers. Users must review outputs before relying on them. Do not submit information into AI-assisted features unless you have a lawful basis and the information is necessary for the task.

We may use third-party AI and decision-support API providers. Inputs and outputs may be processed by those providers for the purpose of returning the feature result, subject to contractual and technical safeguards where available.

7. Third-Party Processors and Services

We use third-party services to operate MANO. These may include:

• Supabase: database, authentication, file storage, and backend infrastructure.
• Netlify and GitHub: hosting, deployment, and code delivery.
• Cloudflare: infrastructure, security, proxy, and API routing.
• Stripe: subscription and payment processing.
• Email/form providers: service notifications, contact forms, and administrative alerts.
• Public data and lookup providers: vehicle/MOT, FCA, website, dealership, and search/rating style lookups where a user requests those checks.
• AI and decision-support API providers: optional AI-assisted drafting, checking, extraction, and risk-support features.

We do not sell personal data. We do not share personal data with third parties for their own advertising purposes.

8. Public-Facing Features

When a user shares a Smart Send, e-sign, customer pack, or booking link, the recipient may access a public MANO-hosted page without creating an account. We may record interaction events such as opens, clicks, booking submissions, quote/proceed actions, timestamps, and technical delivery information. These events are shown to the MANO user or organisation that created the link.

If you are a MANO user sharing those links, you are responsible for making sure the recipient understands that MANO is being used to process the information.

9. Organisation Visibility

If your account belongs to an organisation, managers, admins, owners, or authorised support users may see information linked to that organisation, including user profiles, usage, deal/pipeline records, customer pack activity, payout data, messages, risk checks, reports, audit records, and settings. This is part of providing team, compliance, security, and management features.

10. Retention

We keep data only for as long as reasonably needed for the purposes described in this Policy. Account and organisation records are normally kept while the account or organisation is active. Deal, lead, customer pack, risk, message, template, and uploaded data remain until deleted by the user, organisation admin, retention setting, or us where appropriate.

We may retain limited records after deletion or account closure where needed for legal, tax, accounting, security, fraud prevention, backup, dispute, or audit reasons. Backup copies may take time to expire from backup systems.

11. Your Rights

Depending on the context and lawful basis, you may have rights to access, correct, delete, restrict, object to processing, request portability, withdraw consent, or challenge certain automated processing. To exercise rights relating to your MANO account, contact manoaisolutions@gmail.com.

If your data was entered into MANO by a broker, employer, or other organisation, we may need to refer your request to that organisation because they are normally the controller for that customer data.

You can complain to the Information Commissioner's Office at ico.org.uk if you believe your data has been mishandled.

12. International Transfers

Some providers may process or transfer data outside the UK. Where this happens, we rely on appropriate safeguards such as adequacy regulations, standard contractual clauses, contractual commitments, or other lawful transfer mechanisms under UK data protection law.

13. Security

We use reasonable technical and organisational measures to protect personal data, including HTTPS, managed authentication, password hashing, database row-level security, restricted service-role access, audit checks, and security monitoring. No online system can be guaranteed completely secure.

You are responsible for using strong passwords, keeping credentials confidential, signing out of shared devices, and telling us promptly about suspected unauthorised access.

14. Cookies and Local Storage

We don't use advertising or tracking cookies, and our websites don't set cookies. The MANO portal uses your browser's local storage and session storage to keep you signed in, remember your settings and keep a working copy of your work so the portal loads quickly. This is strictly necessary for the service. Our Cookie Policy lists what is stored, why, and how to remove it.

15. Children

MANO is not intended for individuals under 18. We do not knowingly collect personal data from children.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material updates will be notified via the Platform, website, or email where practicable. The date at the top shows the latest update.

17. Contact

For privacy, data protection, or legal enquiries, contact manoaisolutions@gmail.com or visit manoai.org.