Privacy policy

Information we collect

We collect information in the following categories:

• Account and sign-in data: name, email address, profile image, authentication records, session information, IP address, device or browser information, and details returned by a sign-in provider you choose.
• Business and workspace data: business profile, clients, contacts, projects, tasks, calendars, documents, transactions, budgets, files, chat messages, and other content you add.
• Billing and payment-destination data: plan, subscription status, Stripe customer and subscription identifiers, and invoice references. Stripe handles the card used to pay for MANA, so MANA does not receive its full number. MANA separately stores bank, PromptPay, or card details that you choose to add to wallets or client documents.
• Support and feedback data: messages, page context, and contact details you provide when asking for help or sending product feedback.
• Technical and usage data: service requests, security and error logs, feature usage, plan-limit usage, and public-site or blog activity described below.

An email address and authentication information are required to create and secure an account; without them, MANA cannot provide an account. Most workspace fields and integrations are optional, but a feature may not work if you do not provide the information or permission it needs.

How and why we use information

We use information to provide and secure MANA, authenticate accounts, generate documents, store files, sync services you connect, process subscriptions, send service messages, answer support requests, enforce plan limits, diagnose failures, prevent abuse, and improve the product. Depending on the activity and applicable law, this processing is necessary to perform our agreement with you, comply with legal obligations, pursue legitimate interests in operating and protecting the service, or act with your consent where consent is required.

We do not sell personal data. We do not use workspace content or Google user data for targeted advertising.

Legal bases, transfers, and our commitments

Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA), MANA processes personal data on these bases: performance of a contract, for the account, workspace, documents, billing, and support you ask us to provide; legitimate interest, for securing the service, preventing fraud and abuse, and keeping error and reliability logs;legal obligation, for accounting, tax, and records we are required to keep; andconsent, for optional analytics and any feature that asks for it. You can withdraw consent at any time, and doing so does not change how the rest of MANA works.

Some providers listed below operate outside Thailand, mainly in the United States and the European Union. Where a destination is not covered by a PDPC adequacy determination, we rely on the safeguards permitted by sections 28 and 29 of the PDPA — the provider's standard contractual clauses and data-processing terms — or, for optional analytics, on the consent you give.

Commitments that hold regardless of legal basis: we do not sell personal data, we do not share it with data brokers, and we run no advertising or ad-targeting tags on the site or in the app. MANA does not train AI models on your workspace content. We do not read your documents, contacts, or finances except as needed to run a feature you used, to provide support you asked for, or where the law requires it. AI providers receive only what the feature you used sends them, and process it under their own terms; those providers are listed below.

If you believe we have handled your personal data unlawfully, emailsupport@heymana.app first — we would rather fix it directly. You also have the right to complain to Thailand's Personal Data Protection Committee (PDPC). If a breach is likely to affect your rights, we will notify the PDPC within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high.

AI and automated processing

When you use an AI feature, MANA sends the prompt, uploaded material, and workspace context needed for the request to the provider configured for that feature. Depending on configuration, this can include Kimi models hosted by Moonshot AI for chat or document assistance, Groq for audio transcription and translation, Typhoon by SCB 10X for image text extraction, and a configured compatible model for receipt-image analysis.

Product feedback can also be grouped and prioritized automatically through OpenRouter using an OpenAI model; that process can receive the feedback message and related product context without a separate AI action from you. Do not submit information unless you have the right to process it. MANA does not automatically use Google user data as AI context; if you manually include Google-derived content in a prompt, it is processed as part of that prompt. Providers and models may change as MANA evolves, and AI outputs may be inaccurate and should be reviewed before use.

Google Calendar data

Connecting Google is optional. Calendar sync requests permission to manage calendar events and read your calendar list. MANA requests no other Google scopes.

• Calendar: MANA stores connected-calendar details and imported event fields such as title, description, time, recurrence, and location. It can create or update Google events when you request a sync action.
• Tokens: access and refresh tokens are stored in restricted account records so background sync can run while you are signed out.
• Sharing: Google user data is not sold, used for advertising, or shared with AI providers. It is used only to provide or improve the Google-connected features you request.
• Disconnecting: remove a connection in Settings → Integrations, or revoke MANA at Google Account permissions. Disconnecting Calendar revokes and removes its saved tokens and deletes imported calendar copies.

MANA's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

Documents, guest links, and information you share

Documents you send or publish through a guest link can contain your business identity, client details, tax information, line items, and bank, PromptPay, or card payment destinations. Anyone with an active link can view that information. Client approval records can include an IP address, and guests can upload payment-slip images when that feature is enabled. You control the recipients, document contents, and links you create and must have authority to share the personal data they contain.

Service providers and disclosures

Providers used where a feature is enabled include Stripe for subscriptions and payments; Cloudflare R2 for MANA file storage; Resend for email; Sentry for error and reliability monitoring; Google, Discord, and Facebook for optional sign-in; Google for Calendar; LINE for connected notifications; Thunder Solution for payment-slip verification; browser push services for notifications; PostHog for the consent-based measurement described below; and Moonshot AI, Groq, Typhoon/SCB 10X, OpenRouter, and OpenAI-compatible services for the processing described above. Hosting, database, and network providers also process data needed to run MANA.

We may also disclose information when required by law, to protect users or the service, to investigate fraud or security incidents, or as part of a business reorganization where the recipient must continue to protect it. Some providers may process data outside Thailand, where privacy laws may differ; their contractual and technical safeguards apply to that processing.

Cookies, local storage, and website measurement

The app uses first-party session and sign-in cookies to authenticate you and protect login flows. The current session-cookie lifetime is up to one day, although related security cookies may be shorter. MANA also uses browser local storage for language, theme, onboarding drafts, and other interface preferences. Clearing these items can sign you out or reset preferences, but does not delete workspace records stored in your account.

MANA's blog records article views and reading time without a cookie. The server derives a daily rotating identifier from the request IP address and user agent, then stores the derived value rather than the raw IP address for this reporting.

Analytics is off until you allow it. MANA uses one measurement tool, PostHog, on both the public website and the app: on the website to count visits and sign-up conversion, and in the app to record which screens you open, associated with your account identifier and email address, so we can see which parts of the product are actually used. It creates an anonymous visitor profile when you allow analytics, then links it to your account if you sign up. It sets a cookie on heymana.app and its subdomains so a visit and the account it becomes are counted as one person rather than two. It does not load unless you accept in the consent banner, and declining changes nothing about how MANA works. Session recording is disabled, so PostHog does not receive the contents of your workspace — client names, document contents, and amounts are not sent to it. To change your answer later, clear this site's browsing data and choose again when asked. MANA runs no advertising tags on either site.

Browser settings can block or clear cookies and local storage. Blocking necessary sign-in cookies prevents account login.

Security and retention

We use access controls, secure transport, monitoring, and other reasonable administrative and technical measures designed to protect information. No online service can guarantee absolute security, so keep your account and connected providers secure and contact us if you suspect unauthorized access.

Workspace data is generally kept while your account is active. Deleted projects and MANA storage items normally remain recoverable in trash for 14 days before scheduled purge. Blog activity is retained for historical reporting until it is no longer needed or deletion is required. When you delete the account, MANA deletes associated database records and attempts to remove associated MANA-stored objects from active storage. Limited information can remain for the duration of normal backup cycles, in security or support logs, and in records that MANA or a provider must keep for fraud prevention, accounting, tax, dispute resolution, or other legal obligations. Necessity and applicable legal requirements determine those periods.

Your choices and privacy rights

You can correct account and business details in MANA, disconnect integrations, and export your MANA records from Privacy settings. The JSON export includes core records and stored file metadata, but not uploaded file contents.

You can delete your account from Privacy settings. Account deletion is permanent and separate from subscription cancellation: cancel an active paid subscription in Settings → Billing before deleting the account. Deletion does not erase records held independently by Stripe, Google, or another provider under its own legal obligations.

Subject to applicable law, including Thailand's Personal Data Protection Act, you may request access, correction, deletion, restriction, objection, or portability; withdraw consent where processing relies on consent; and complain to the competent data-protection authority. Emailsupport@heymana.app. We may verify your identity and may retain information where the law permits or requires it.

Changes to this policy

We may update this policy as MANA, its providers, or legal requirements change. The effective date above will change, and material updates will be presented as applicable law requires.