Privacy Policy

2.1 Information You Provide

We collect information you or your organization provides when using the Service, including:

• Account information: name, email address, job title, and organization name when your account is provisioned.
• Project data: projects, tasks, phases, deliverables, notes, comments, and other content you create or upload within the Service.
• Time and financial data: time entries, timesheet records, expense details, receipt images, invoice data, and billing rates.
• Communications: messages sent through the Service, including client portal communication threads and in-app notifications.
• Support communications: information you provide when contacting us for support.

2.2 Information Collected Automatically

When you use the Service, we automatically collect certain technical information:

• Log data: IP address, browser type, operating system, pages viewed, timestamps, and referring URLs.
• Usage data: features used, actions taken, session duration, and interaction patterns within the Service.
• Device information: device type, screen resolution, and browser capabilities.
• Cookies and similar technologies: see Section 7 for details.

2.3 Information from Third-Party Integrations

When you connect third-party services to PM Manifest, we receive data from those services as authorized by you:

• QuickBooks Online: chart of accounts, customer records, expense categories, invoice data, and payment status. This data is synchronized to support the accounting integration features of the Service. We access QuickBooks data only to the extent authorized by your QuickBooks connection and as necessary to provide the integration functionality.
• Other accounting integrations (e.g., Xero): similar financial data as described above, scoped to the integration’s authorized permissions.

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Process and synchronize data with connected third-party integrations;
• Generate AI-powered features including project summaries, health scores, predictive alerts, and status report drafts, using the project and activity data in your account;
• Send transactional emails including account notifications, invitations, and digest reports;
• Respond to support requests and communicate with you about the Service;
• Monitor and enforce compliance with our Terms of Service;
• Detect, investigate, and prevent security incidents and fraudulent activity;
• Analyze usage patterns in aggregate and anonymized form to improve the Service; and
• Comply with applicable legal obligations.

We do not sell your personal information or Customer Data to third parties. We do not use Customer Data to train AI models for any purpose other than providing the Service to your organization.

PM Manifest integrates with QuickBooks Online and other accounting platforms to enable expense synchronization, invoice generation, and financial reporting. This section describes our specific practices with respect to data obtained through these integrations.

4.1 Data Access and Scope

When you connect QuickBooks Online, PM Manifest requests access to accounting data including chart of accounts, customer records, vendor information, expense entries, and invoice records. We request only the permissions necessary to provide the integration features you have enabled.

4.2 How We Use QuickBooks Data

QuickBooks data is used exclusively to:

• Synchronize approved expenses from PM Manifest to your QuickBooks account;
• Push finalized invoices from PM Manifest to QuickBooks;
• Import chart of accounts and customer data to enable field mapping within PM Manifest;
• Receive payment status updates from QuickBooks to reflect invoice payment in PM Manifest.

We do not use QuickBooks data for advertising, profiling, or any purpose beyond providing the Service to your organization.

4.3 Data Retention for Integration Data

Synchronized financial data is retained within PM Manifest for as long as your subscription is active and for 30 days following termination, consistent with our general data retention practices described in Section 8.

4.4 Disconnecting Integrations

You may disconnect the QuickBooks integration at any time through your organization’s settings. Disconnecting will stop future synchronization but will not delete data that has already been synchronized into PM Manifest. Previously synced data is subject to our standard retention and deletion practices.

4.5 Intuit Developer Policy Compliance

Our use of data obtained through the QuickBooks API complies with Intuit’s developer policies and data handling requirements. We do not share QuickBooks-sourced data with any third party except as necessary to provide the Service or as required by law.

We do not sell or rent your information. We share information only in the following circumstances:

5.1 Service Providers

We share information with trusted third-party vendors who help us operate the Service. These vendors process data only on our behalf, under confidentiality obligations, and only as necessary to provide their services to us. Our current sub-processors include:

• Supabase — database hosting, authentication, and file storage (US West region);
• Vercel — application hosting and edge delivery;
• Anthropic — AI feature processing (project summaries, health scoring, status reports);
• Upstash / Redis — rate limiting and session caching;
• Resend — transactional email delivery.

5.2 Within Your Organization

Information you create within the Service is visible to other authorized users within your organization, subject to the role-based access controls your administrators configure. Client portal users see only the data your organization chooses to expose to them.

5.3 Legal Requirements

We may disclose information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public.

5.4 Business Transfers

If the Company is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website prior to your information becoming subject to a different privacy policy.

PM Manifest uses Anthropic’s Claude API to power AI features including project summary generation, health scoring, predictive alerts, and automated status report drafts.

When you use AI features, relevant project data (such as task records, time entries, activity logs, and budget data) is transmitted to Anthropic’s API to generate the requested output. This data is processed by Anthropic subject to their API terms and data handling policies. We do not submit personally identifiable information to the AI provider beyond what is necessary to generate the requested output.

AI-generated outputs are scoped strictly to your organization’s data. No cross-tenant data is included in AI processing.

We do not use your Customer Data to train AI models. AI-generated content is provided as a draft for human review and should not be shared with clients without review.

We use the following types of cookies and similar technologies:

• Essential cookies: required for authentication, session management, and core Service functionality. These cannot be disabled without impairing the Service.
• Analytics cookies: we use PostHog to collect aggregated usage data that helps us understand how the Service is used and improve it. This data is pseudonymous and not linked to your name.
• Error tracking: we use Sentry to detect and diagnose errors. Error reports may include technical metadata about your session and the action that caused the error.

Most browsers allow you to refuse cookies or be notified when a cookie is set. Disabling essential cookies will impair Service functionality.

We retain Customer Data for as long as your subscription is active. Upon termination of your subscription, we retain your data for 30 days to allow you to request an export. After 30 days, Customer Data is permanently deleted from our production systems.

Certain data may be retained longer where required by law or for legitimate business purposes such as fraud prevention, financial record-keeping, or resolving disputes. Aggregated, anonymized data derived from your usage may be retained indefinitely.

Activity logs are retained for two years in active storage and may then be archived to cold storage for an additional period before permanent deletion.

We implement technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data at rest (AES-256) and in transit (TLS 1.3);
• Row-level security at the database layer ensuring organizational data isolation;
• Role-based access controls within the Service;
• Rate limiting and monitoring on all API endpoints;
• Regular security monitoring and dependency vulnerability scanning.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of a potential security vulnerability, please contact us at support@pm-manifest.com.

Depending on your jurisdiction, you may have certain rights regarding your personal information. You can exercise these rights directly through our privacy request page or by contacting us at support@pm-manifest.com.

10.1 Access and Portability

You may request a copy of your personal information and Customer Data at any time. The Service supports data export in JSON format. Submit a request through our privacy request page or contact us at support@pm-manifest.com.

10.2 Correction

You may update your account information directly within the Service. If you identify inaccuracies in data we hold about you that you cannot correct yourself, submit a correction request through our privacy request page and we will work with you to resolve it.

10.3 Deletion

You may request deletion of your personal information at any time through our privacy request page. We will honor deletion requests subject to any legal obligations to retain certain records and subject to the 30-day post-termination retention period described in Section 8.

10.4 GDPR Rights (EEA/UK Users)

If you are located in the European Economic Area or United Kingdom, you have additional rights under the GDPR, including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with a supervisory authority. To exercise these rights, use our privacy request page or contact us at support@pm-manifest.com.

10.5 CCPA Rights (California Residents)

California residents have the right to know what personal information we collect, disclose, and sell (we do not sell personal information), the right to delete personal information, and the right not to be discriminated against for exercising these rights. To submit a CCPA request, use our privacy request page or contact us at support@pm-manifest.com.

The Service is intended for use by business organizations and professional teams. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided us with personal information, we will take steps to delete such information. If you believe a minor has provided us personal information, please contact us at support@pm-manifest.com.

PM Manifest is operated in the United States. If you are accessing the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

Our primary data infrastructure is hosted in the US West (Oregon) region via Supabase. We take steps to ensure that data transferred internationally is handled in accordance with applicable data protection laws.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page and notify active users by email. Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree to the revised policy, you must stop using the Service.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all privacy-related inquiries within 30 days.