This Privacy Policy explains how [Company Legal Name] (“we”, “us”) collects, uses, and protects your personal data when you use manna (the “Service”). We are the data controller for the personal data described below. Questions: [privacy@yourdomain.com].
1. Data we collect
- Account data: first name, last name, email address, and your hashed password.
- Content you create: organizations, companies, budgets, and the financial figures you enter.
- Authentication & security data: session cookies, two-factor (TOTP) enrollment status, and limited technical data (e.g. IP address) used for bot protection and abuse prevention.
We do not collect special-category data, and we do not use your data for advertising.
2. How and why we use your data
- To provide and operate the Service (performance of our contract with you).
- To authenticate you and keep your account secure, including optional two-factor authentication (legitimate interests / legal obligation).
- To prevent fraud, abuse, and automated attacks, including CAPTCHA checks (legitimate interests).
- To comply with legal obligations and respond to lawful requests.
3. Service providers (sub-processors)
We share data only with providers that process it on our behalf to run the Service:
- Supabase — database, authentication, and storage.
- Vercel — application hosting and delivery.
- Cloudflare — bot protection (CAPTCHA) and network security.
We do not sell your personal data.
4. International transfers
Your data may be processed in countries outside [your country]. Where it is, we rely on appropriate safeguards such as Standard Contractual Clauses.
5. Data retention
We keep your personal data for as long as your account is active. When you request account deletion, your account is locked and your data is permanently purged after a 14-day grace period (during which you can cancel the request by signing back in). Some records may be retained longer where required by law.
6. Your rights
Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing. You can delete your account at any time from your profile page. To exercise other rights, contact [privacy@yourdomain.com]. You also have the right to lodge a complaint with your local data protection authority.
7. Security
We protect your data with encryption in transit, row-level access controls so tenants can only reach their own data, a password-strength policy, and optional two-factor authentication. No system is perfectly secure, but we work to protect your information.
8. Cookies
We use only essential cookies required to sign you in and keep your session secure. We do not use advertising or third-party tracking cookies.
9. Children
The Service is not intended for anyone under [16/18], and we do not knowingly collect data from them.
10. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, notified to you.
11. Contact
[Company Legal Name]
[Registered address]
[privacy@yourdomain.com]