Privacy Policy

2.1 Information You Provide

We collect information you provide when using the Site, including:

• Account information: name, email address, job title, and organization name when your account is provisioned.
• Support communications: information you provide when contacting us for support.

2.2 Information Collected Automatically

When you use the Site, we automatically collect certain technical information:

• Log data: IP address, browser type, operating system, pages viewed, timestamps, and referring URLs.
• Usage data: features used, actions taken, session duration, and interaction patterns within the Site.
• Device information: device type, screen resolution, and browser capabilities.
• Cookies and similar technologies: see Section 5 for details.

We use the information we collect to:

• Provide, operate, and maintain the Site;
• Send transactional emails including account notifications, invitations, and digest reports;
• Respond to support requests and communicate with you about the Service;
• Monitor and enforce compliance with our Terms of Service;
• Detect, investigate, and prevent security incidents and fraudulent activity;
• Analyze usage patterns in aggregate and anonymized form to improve the Site; and
• Comply with applicable legal obligations.

We do not sell your personal information to third parties.

We do not sell or rent your information. We do not share visitor information with third parties except as described below:

4.1 Within Your Organization

Information you create within the Service is visible to other authorized users within your organization, subject to the role-based access controls your administrators configure. Client portal users see only the data your organization chooses to expose to them.

4.2 Legal Requirements

We may disclose information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public.

4.3 Business Transfers

If the Company is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website prior to your information becoming subject to a different privacy policy.

We use the following categories of cookies and similar tracking technologies (such as pixels and tags):

• Essential cookies: required for authentication, session management, security, and load balancing. These are active today and cannot be disabled without impairing the Site.
• Analytics cookies: would be used to collect aggregated usage data that helps us understand how the Site is used and improve it. Analytics cookies are not currently active. If we activate analytics tooling in the future, it will be gated behind visitor consent collected through our cookie preference tool.
• Advertising and marketing cookies: would be used to support advertising or marketing pixels. Advertising and marketing cookies are not currently active, and if activated in the future will likewise be gated behind visitor consent collected through our cookie preference tool.

Separately, we may use error-tracking tooling to detect and diagnose technical issues with the Site. This tooling is not currently active. If activated, it is intended purely for security and reliability debugging; to the extent any such tooling handles non-essential tracking data, it will be gated behind visitor consent in the same way as analytics and advertising cookies described above.

You can review or change your cookie choices at any time on our cookie preferences page. Most browsers also allow you to refuse cookies or be notified when a cookie is set. Disabling essential cookies will impair Site functionality.

We retain information collected through the Site for as long as necessary to respond to inquiries, operate the Site, and comply with applicable legal obligations.

Certain data may be retained longer where required by law or for legitimate business purposes such as fraud prevention, financial record-keeping, or resolving disputes. Aggregated, anonymized data derived from your usage may be retained indefinitely.

Activity logs and audit records are retained for 90 days. Deleted records are retained for 90 days in a recoverable state before permanent removal from our systems.

We implement technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data at rest (AES-256) and in transit (TLS 1.3);
• Row-level security at the database layer ensuring organizational data isolation;
• Role-based access controls within the Service;
• Rate limiting and monitoring on all API endpoints;
• Regular security monitoring and dependency vulnerability scanning.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of a potential security vulnerability, please contact us at support@pm-manifest.com.

Depending on your jurisdiction, you may have certain rights regarding your personal information. You can exercise these rights directly through our privacy request page or by contacting us at support@pm-manifest.com.

8.1 Access and Portability

You may request a copy of your personal information at any time. Submit a request through our privacy request page or contact us at support@pm-manifest.com.

8.2 Correction

If you identify inaccuracies in data we hold about you, submit a correction request through our privacy request page and we will work with you to resolve it.

8.3 Deletion

You may request deletion of your personal information at any time through our privacy request page. We will honor deletion requests subject to any legal obligations to retain certain records.

8.4 GDPR Rights (EEA/UK Users)

If you are located in the European Economic Area or United Kingdom, you have additional rights under the GDPR, including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with a supervisory authority. To exercise these rights, use our privacy request page or contact us at support@pm-manifest.com.

8.5 CCPA Rights (California Residents)

California residents have the right to know what personal information we collect, disclose, and sell (we do not sell personal information), the right to delete personal information, and the right not to be discriminated against for exercising these rights. To submit a CCPA request, use our privacy request page or contact us at support@pm-manifest.com.

The Site is intended for use by business organizations and professional teams. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided us with personal information, we will take steps to delete such information. If you believe a minor has provided us personal information, please contact us at support@pm-manifest.com.

The Site is operated in the United States. If you are accessing the Site from outside the United States, your information will be transferred to and processed in the United States. By using the Site, you consent to this transfer.

Our primary data infrastructure is hosted in the US West (Oregon) region via Supabase. We take steps to ensure that data transferred internationally is handled in accordance with applicable data protection laws.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. Your continued use of the Site after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree to the revised policy, you must stop using the Site.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all privacy-related inquiries within 30 days.