PageSourceSearch

https://mana.ai/legal/privacy/

html mana.ai collected 2026-10-05 12:13:35 UTC 32,818 bytes, 373 lines download raw bytes

1<!doctype html>
2<html lang="en" class="h-dvh">
3  <head>
4    <meta charset="utf-8" />
5    <meta name="mana-deployment" content="27a70693-48ce-4eff-ba3d-7c367d82390c" />
6    <meta name="mana-client-build" content="2026-10-05T04:41:46-04:00" />
7    <title>Privacy Policy | Mana</title>
8    <base href="/" />
9
10    <meta name="viewport" content="width=device-width, initial-scale=1" />
11
12    <!-- Link-preview metadata for the app shell. This document backs every
13         client-side route, including the public share links produced by the
14         chat Share action (`/shared/:shareId`) and by pipeline sharing
15         (`/shared/pipeline/:shareId`). Preview crawlers — iMessage, Slack,
16         Twitter, WhatsApp — read the HTML as served and do not run
17         JavaScript, so the runtime updates in `@mana/seo` never reach them
18         and the tags have to be present statically.
19
20         The copy is deliberately route-agnostic: one static document is
21         served for many URLs, so it describes Mana rather than the specific
22         page behind the link.
23
24         `og:url` and `rel="canonical"` are intentionally absent for the same
25         reason. Pinning them to a single address here would tell crawlers
26         that every shared link canonicalizes to that one page. The
27         single-URL entrypoints (`access/`, `join/`, `auth/set-password/`)
28         do set both, since each of those files backs exactly one URL.
29
30         `robots` is likewise omitted so the shell keeps the host default and
31         the marketing routes it also serves stay indexable. The unlisted
32         routes set `noindex, nofollow` at runtime instead — see
33         `useUnlistedRobots` in `@mana/seo`.
34
35         Two deliberate quirks, so nobody "fixes" one of them: `og:title`
36         differs from the short `<title>Mana</title>` above (`og:title` wins
37         wherever it is present, and the tab reads better short), and
38         `og:image` points at the production origin on every deploy. Preview
39         branches therefore advertise the prod asset — an image resolving on a
40         preview URL says nothing about that branch's own pipeline. -->
41    <meta name="description" content="Privacy Policy for Mana" />
42
43    <meta property="og:type" content="website" />
44    <meta property="og:locale" content="en_US" />
45    <meta property="og:site_name" content="Mana" />
46    <meta property="og:title" content="Privacy Policy | Mana" />
47    <meta property="og:description" content="Privacy Policy for Mana" />
48    <meta property="og:image" content="https://mana.ai/mana-og.jpg" />
49    <meta property="og:image:url" content="https://mana.ai/mana-og.jpg" />
50    <meta property="og:image:secure_url" content="https://mana.ai/mana-og.jpg" />
51    <meta property="og:image:type" content="image/jpeg" />
52    <meta property="og:image:width" content="1200" />
53    <meta property="og:image:height" content="630" />
54    <meta property="og:image:alt" content="Mana — AI for finance" />
55
56    <meta name="twitter:card" content="summary_large_image" />
57    <meta name="twitter:site" content="@ManaResearch" />
58    <meta name="twitter:title" content="Privacy Policy | Mana" />
59    <meta name="twitter:description" content="Privacy Policy for Mana" />
60    <meta name="twitter:image" content="https://mana.ai/mana-og.jpg" />
61    <meta name="twitter:image:alt" content="Mana — AI for finance" />
62
63    <!-- App-shell fonts are vendored under /fonts (see src/globals.css).
64         Sandboxed dashboard iframes retain their separate font path until a
65         sandbox-safe local delivery mechanism is available. -->
66    <!-- Preload InterVariable (covers all weights 100–900, normal + italic) -->
67    <link rel="preload" as="font" type="font/woff2" crossorigin href="/fonts/InterVariable.woff2" />
68    <link rel="preload" as="font" type="font/woff2" crossorigin href="/fonts/InterVariable-Italic.woff2" />
69    <!-- Plex Mono renders numbers and code UI; without a preload it loaded
70         ~4s into boot and late-swapped those surfaces. -->
71    <link rel="preload" as="font" type="font/woff2" crossorigin href="/fonts/IBMPlexMono-Regular.woff2" />
72    <link rel="icon" type="image/x-icon" href="/favicon.ico" />
73    <link rel="apple-touch-icon" href="/favicons/apple-touch-icon.png" />
74    
74<script>
75      (function () {
76        var search = window.location.search;
77        var path = window.location.pathname;
78        if (search.indexOf('embed=1') === -1) {
79          return;
80        }
81        if (path.indexOf('/settings') === 0) {
82          document.documentElement.setAttribute('data-settings-embed', 'true');
83        }
84        if (path.indexOf('/system') === 0) {
85          document.documentElement.setAttribute('data-system-embed', 'true');
86        }
87      })();
88    </script>
88
89    <!-- Dark theme before first paint. Mirrors `applyTheme` in
90         @mana/ui (lib/theme/theme.ts): same storage key, same "system"
91         rule. The landing and sign-in routes always render light (they call
92         `useForceLightTheme`); they are skipped here too so a dark user who
93         signs out does not see them flash dark before React mounts. The
94         path list mirrors `isLightOnlyPath` in the same module. -->
95    
95<script>
96      (function () {
97        try {
98          var path = window.location.pathname;
99          if (
100            path === '/' ||
101            path === '/login' ||
102            path === '/signup' ||
103            path === '/mission' ||
104            path === '/onboarding' ||
105            path.indexOf('/onboarding/') === 0
106          ) {
107            return;
108          }
109          var preference = window.localStorage.getItem('mana.theme');
110          var dark =
111            preference === 'dark' ||
112            (preference === 'system' &&
113              window.matchMedia('(prefers-color-scheme: dark)').matches);
114          if (dark) {
115            document.documentElement.classList.add('dark');
116          }
117        } catch (_e) {
118          /* storage blocked: light theme */
119        }
120      })();
121    </script>
121
122    
122<script type="module" crossorigin src="/assets/main-qS_flfmB.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c"></script>
122
123    <link rel="modulepreload" crossorigin href="/assets/main-qTUrSfJn.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
124    <link rel="stylesheet" crossorigin href="/assets/main-DFFPJiZe.css?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c#.css">
125    <template data-boot-preload data-paths="/,/home">      <link rel="modulepreload" crossorigin href="/assets/HomeLaunchRoute-D2IHT-rY.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
126      <link rel="modulepreload" crossorigin href="/assets/main-qTUrSfJn.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
127</template>
128    <template data-boot-preload data-paths="/chat/new,/chat/new/">      <link rel="modulepreload" crossorigin href="/assets/blank-chat-CuF1hWJj.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
129      <link rel="modulepreload" crossorigin href="/assets/main-qTUrSfJn.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
130      <link rel="modulepreload" crossorigin href="/assets/AskHeroLayout-Crkt97FA.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
131      <link rel="modulepreload" crossorigin href="/assets/Ask-69j28sx4.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
132      <link rel="modulepreload" crossorigin href="/assets/warmEmptyTask-DN3wxXUU.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
133      <link rel="modulepreload" crossorigin href="/assets/ConversationContextAsideFrame-C6bCBLq3.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
134      <link rel="modulepreload" crossorigin href="/assets/useDraftNewAgent-DZ76l9e4.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
135      <link rel="modulepreload" crossorigin href="/assets/usePlanStateLifecycle-B9_2lWwd.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
136      <link rel="modulepreload" crossorigin href="/assets/navigateToNewAgent-C_TFN_wK.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
137</template>
138    <template data-boot-preload data-patterns="^/(?:pipelines/[^/]+|projects/[^/]+/pipelines/[^/]+)/chat/new/?$">      <link rel="modulepreload" crossorigin href="/assets/page-BmlRfoQU.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
139      <link rel="modulepreload" crossorigin href="/assets/main-qTUrSfJn.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
140      <link rel="modulepreload" crossorigin href="/assets/useDraftNewAgent-DZ76l9e4.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
141      <link rel="modulepreload" crossorigin href="/assets/usePlanStateLifecycle-B9_2lWwd.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
142      <link rel="modulepreload" crossorigin href="/assets/AskHeroLayout-Crkt97FA.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
143      <link rel="modulepreload" crossorigin href="/assets/navigateToNewAgent-C_TFN_wK.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
144      <link rel="modulepreload" crossorigin href="/assets/Ask-69j28sx4.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
145      <link rel="modulepreload" crossorigin href="/assets/usePipelineChatModeOptions-BlKIQaww.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
146</template>
147    <template data-boot-preload data-prefixes="/chat/" data-patterns="^/projects/[^/]+/chat/(?!new(?:/|$))[^/]+/?$" data-exclude-paths="/chat/new,/chat/new/">      <link rel="modulepreload" crossorigin href="/assets/chat-details-B8O1vde-.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
148      <link rel="modulepreload" crossorigin href="/assets/main-qTUrSfJn.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
149      <link rel="modulepreload" crossorigin href="/assets/ConversationContextAsideSlot-D8eJHvzp.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
150      <link rel="modulepreload" crossorigin href="/assets/usePublishOpenContext-DQFjBk90.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
151      <link rel="modulepreload" crossorigin href="/assets/useFloatingChat-CIB5YvtI.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
152</template>
153    <template data-boot-preload data-patterns="^/(?:pipelines/[^/]+|projects/[^/]+/pipelines/[^/]+)/chat/(?!new(?:/|$))[^/]+/?$">      <link rel="modulepreload" crossorigin href="/assets/page-D1LkbfjV.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
154      <link rel="modulepreload" crossorigin href="/assets/main-qTUrSfJn.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
155      <link rel="modulepreload" crossorigin href="/assets/chat-details-B8O1vde-.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
156      <link rel="modulepreload" crossorigin href="/assets/usePipelineChatModeOptions-BlKIQaww.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
157      <link rel="modulepreload" crossorigin href="/assets/ConversationContextAsideSlot-D8eJHvzp.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
158      <link rel="modulepreload" crossorigin href="/assets/usePublishOpe
158nContext-DQFjBk90.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
159      <link rel="modulepreload" crossorigin href="/assets/useFloatingChat-CIB5YvtI.js?dpl=27a70693-48ce-4eff-ba3d-7c367d82390c">
160</template>
161    
161<script>var pathname = location.pathname;
162var templates = document.querySelectorAll("template[data-boot-preload]");
163for (var i = 0; i < templates.length; i++) {
164  var template = templates[i];
165  var paths = (template.getAttribute("data-paths") || "").split(",");
166  var prefixes = (template.getAttribute("data-prefixes") || "").split(",");
167  var patterns = (template.getAttribute("data-patterns") || "").split(",");
168  var excluded = (template.getAttribute("data-exclude-paths") || "").split(",");
169  var matched = false;
170  for (var j = 0; j < paths.length; j++) {
171    if (paths[j] && pathname === paths[j]) matched = true;
172  }
173  for (var k = 0; k < prefixes.length; k++) {
174    if (prefixes[k] && pathname.indexOf(prefixes[k]) === 0) matched = true;
175  }
176  for (var l = 0; l < patterns.length; l++) {
177    if (patterns[l] && new RegExp(patterns[l]).test(pathname)) matched = true;
178  }
179  for (var m = 0; m < excluded.length; m++) {
180    if (excluded[m] && pathname === excluded[m]) matched = false;
181  }
182  if (matched) document.head.appendChild(template.content.cloneNode(true));
183}</script>
183
184      <meta name="robots" content="index, follow" />
185    <link rel="canonical" href="https://mana.ai/legal/privacy" />
186    <meta property="og:url" content="https://mana.ai/legal/privacy" />
187    <meta name="twitter:url" content="https://mana.ai/legal/privacy" />
188  </head>
189  <body class="h-dvh bg-base">
190    <!-- Crawler- and no-JavaScript-readable description of the application.
191
192         Google's OAuth verification checks the homepage for a description of
193         what the app does and a link to the privacy policy, and fetches the
194         page without executing JavaScript. The landing route renders both, but
195         only after React boots, so a scripted fetch of `/` would otherwise see
196         nothing but the empty `#root` below.
197
198         This lives in `<noscript>` rather than as static markup inside `#root`
199         because this one document also backs every other client-side route as
200         the SPA fallback. Prerendered content in `#root` would paint on
201         `/chat/...` and on every share link until React replaced it, whereas
202         `<noscript>` renders nothing at all for scripted clients while staying
203         present in the served HTML for crawlers.
204
205         The copy is route-agnostic for the same reason as the metadata above:
206         one document is served for many URLs, so it describes Mana rather than
207         the page behind the link. Generated legal pages strip this block --
208         they already serve their own complete no-JavaScript content. -->
209    <div class="h-full w-full overflow-y-auto bg-base" id="root"><div class="mx-auto min-h-full max-w-3xl px-6 py-12"><a class="mb-8 inline-flex items-center gap-2 text-muted-foreground text-sm" href="/">Back to Mana</a><header class="mb-12"><h1 class="text-3xl tracking-tight">Privacy Policy</h1></header><main><div class="prose w-full max-w-full prose-ol:list-outside prose-ul:list-outside break-words prose-a:text-prose-base prose-a:underline prose-a:decoration-1 prose-a:underline-offset-2 first-of-type:mt-0 prose-li:last-of-type:mb-0 mt-0"><p>Mana Finance Corporation</p>
210<p>Last updated: August 21, 2026</p>
211<h2>Introduction</h2>
212<p>Mana Finance Corporation (“Mana,” “we,” “our,” or “us”) provides an AI-powered investment research platform through our websites (mana.ai and manafinance.com), applications, and API (collectively, our “Services”).</p>
213<p>This Privacy Policy explains what information we collect, how we use it, who we share it with, and what choices you have. It applies to all users of our Services, whether you access them through our website, API, or any other means.</p>
214<p>By using our Services, you agree to the collection and use of information as described in this policy.</p>
215<h2>Information We Collect</h2>
216<h3>Information You Provide</h3>
217<p>When you create an account, subscribe to our Services, or interact with our platform, you may provide us with:</p>
218<ul>
219<li>
220<p>Account information: your name, email address, phone number, and other contact details.</p>
221</li>
222<li>
223<p>Payment information: credit card, debit card, or other payment method details used for subscriptions and usage-based billing. We use third-party payment processors and do not store full payment card numbers on our servers.</p>
224</li>
225<li>
226<p>Customer Materials: documents you upload or direct Mana to retrieve from connected sources, data Mana derives from those documents such as extracted text, summaries, and key terms, research queries you submit, conversation history, and other content you provide through our platform or API. You retain ownership of your Customer Materials.</p>
227</li>
228<li>
229<p>Professional information: investment experience, professional background, or other details you choose to share.</p>
230</li>
231<li>
232<p>Communications: messages you send to our support team or feedback you provide about our Services.</p>
233</li>
234</ul>
235<h3>Information We Collect Automatically</h3>
236<p>When you use our Services, we automatically collect:</p>
237<ul>
238<li>
239<p>Usage data: pages visited, features used, queries submitted, API calls made, timestamps, and interaction patterns.</p>
240</li>
241<li>
242<p>Device information: IP address, browser type and version, operating system, device identifiers, and general location (country, state, or city) derived from your IP address.</p>
243</li>
244<li>
245<p>System Data: performance logs, error reports, latency measurements, model output quality metrics, service logs, and other telemetry about how our Services perform. System Data may include elements of your conversations or uploaded content where that content appears in trace logs generated during normal operation. Mana takes reasonable steps to limit the amount of Customer Materials content captured in System Data to what is necessary for operational purposes. Mana may use System Data to maintain, improve, and secure our Services. Your ownership of the underlying Customer Materials is not affected. You may request deleti
245on of System Data associated with your account by contacting us at [email protected].</p>
246</li>
247<li>
248<p>Cookies and similar technologies: we use cookies, web beacons, and server logs to collect information about how you interact with our Services. You can control cookies through your browser settings, though some features may not work properly if you disable them.</p>
249</li>
250</ul>
251<h3>Information from Third Parties</h3>
252<p>We may receive information about you from service providers that help us operate our business, such as payment processors, analytics providers, and security and anti-fraud services.</p>
253<h2>How We Use Your Information</h2>
254<p>We use the information we collect to:</p>
255<ul>
256<li>
257<p>Provide the Services: deliver AI-powered investment research, process your queries, and make our platform and API available to you.</p>
258</li>
259<li>
260<p>Process payments: manage subscriptions, usage-based billing, and related transactions.</p>
261</li>
262<li>
263<p>Improve our Services: analyze System Data and usage patterns to develop, maintain, optimize, and improve our platform. Our analysis may include the use of technology like machine learning and large language models to enhance our AI-powered investment research capabilities. Unless you opt out, we may also use your Customer Materials as training data for AI models. Enterprise customers who have entered into a separate agreement with Mana may have different default settings for AI model training. Connected-source materials and their derivatives, including Google Workspace API data, are excluded from AI model training; Google data is also governed by the section below.</p>
264</li>
265<li>
266<p>Debug and ensure quality: review conversation traces, error logs, and system performance data to identify and fix issues. This may include review by Mana personnel of the content of conversations and queries to diagnose problems or improve the quality of our Services.</p>
267</li>
268<li>
269<p>Communicate with you: send account notifications, subscription and renewal notices, security alerts, and respond to your support requests.</p>
270</li>
271<li>
272<p>Ensure security: detect, prevent, and address fraud, abuse, and technical issues.</p>
273</li>
274<li>
275<p>Comply with legal obligations: meet our legal and regulatory requirements.</p>
276</li>
277</ul>
278<h2>AI and Data Practices</h2>
279<p>Because Mana is an AI-powered platform, we want to be especially clear about how your data interacts with AI systems:</p>
280<h3>Customer Materials and AI Improvement</h3>
281<p>Mana may use your Customer Materials, including uploaded documents, research queries, and conversation history, to improve our AI-powered investment research capabilities. This may include using Customer Materials to evaluate, fine-tune, or enhance the AI models that power our Services. We use third-party AI models provided by companies like Anthropic and OpenAI, and we build software around those models to deliver our Services. These practices do not apply to connected-source materials or their derivatives, including Google Workspace API data.</p>
282<p>You can opt out of having your Customer Materials used for AI model training at any time by contacting us at [email protected]. If you opt out, your Customer Materials will still be processed as needed to deliver the Services to you, but will not be used as training data for AI models. Enterprise customers who have entered into a separate agreement with Mana may have AI model training disabled by default and may opt in at their discretion.</p>
283<p>Separately, Mana may make general product improvements based on patterns observed in how our Services are used. For example, if we observe that a certain type of query produces poor results, we may update our software code, refine the instructions and prompts our AI systems follow, or improve the capabilities available to our AI to address the issue. These improvements are authored by Mana and do not incorporate your Customer Materials into any training dataset, prompt, or system instruction.</p>
284<h3>Third-Party AI Service Providers</h3>
285<p>To deliver our Services, your queries and uploaded content may be sent to third-party AI model providers for processing. We access these providers through their business API tiers under terms that prohibit them from using your data to train their models. However, these providers may temporarily retain data for a limited period for safety monitoring and abuse prevention purposes, consistent with their own data handling policies.</p>
286<h3>System Data and Telemetry</h3>
287<p>We collect System Data, which includes performance metrics, error logs, usage patterns, output quality measurements, and service logs, to monitor, debug, and improve our Services for all users. System Data is derived from your use of the platform and may include elements of your conversations, queries, or uploaded content where that content appears in trace logs or system records generated during the normal operation of our Services. Mana takes reasonable steps to limit the amount of Customer Materials content captured in System Data to what is necessary for operational purposes. Mana may use System Data to maintain, debug, secure, and improve our Services. Your ownership of the underlying Customer Materials is not affected. You may request deleti
287on of System Data associated with your account by contacting us at [email protected].</p>
288<h3>Human Review of Conversations</h3>
289<p>Mana personnel and automated tools may review the content of conversations, queries, and system outputs for the purposes of debugging issues, ensuring quality, and improving how our Services work. Access is restricted to a small number of designated personnel, all access is logged, and we use anonymization or pseudonymization where feasible to protect the confidentiality of your information during this process.</p>
290<h2>Google Workspace API Data</h2>
291<p>In this section, “Google Workspace API data” means data Mana receives from or derives from Google Workspace APIs. The Drive details below describe the generally available integration; these restrictions apply to all such data.</p>
292<p>If you connect Google Drive, Mana requests read-only access. Within Mana, you designate folders for search and indexing or, separately, for monitoring. Mana may access file and folder metadata to display and enforce those choices, and contents from designated folders when you ask Mana to search, summarize, cite, monitor, or otherwise use a file. Mana uses this information only to provide and improve the Google Drive features you choose. If you connect Gmail when available, Mana requests read-only access and retrieves messages only at your request.</p>
293<p>Mana uses a third-party authorization provider, currently Nango, to manage Google authorization and access tokens. Mana and its cloud hosting and AI service providers may process Google Workspace API data only as needed to operate the Google Workspace features you request, protect the Services, comply with applicable law, or as otherwise permitted with your consent. We do not sell this data or use it for advertising, lending, or credit-worthiness decisions.</p>
294<p>Google Workspace content, including Drive files and Gmail messages, may be sent to third-party AI model providers to generate results for you. This is processing to provide the requested feature, not model training. Mana may use operational signals and user feedback to improve its user-facing software, retrieval, prompts, and workflows, but does not use Google Workspace API data, including data derived from it, to create, train, or improve generalized or non-personalized AI or machine learning models.</p>
295<p>Mana stores connection and folder-selection metadata, document metadata such as titles, paths, types, and modification times, and derived indexing data such as summaries and key terms. For folders you designate for search and indexing, Mana also stores the text extracted from those documents, which is what allows you to search and cite them within Mana. Mana stores this connection metadata, document metadata, extracted text, and derived indexing data only as needed to provide the Google Workspace features you have chosen. If you disconnect the source, Mana stops using that data immediately and deletes it within 30 days, unless you reconnect during that period. If you delete your account, it is deleted as described in the Data Retention section. When you ask Mana to monitor a Google Drive folder, Mana stores a copy of each triggered file and the results derived from it as part of the relevant pipeline-run records. Google Workspace API data may also appear in your conversations or limited operational logs. These records are retained as described in the Data Retention section. You may disconnect Google Drive through Mana, revoke Mana’s access through your Google Account, or request deletion by contacting [email protected].</p>
296<p>Mana personnel do not access Google Workspace API data unless you expressly consent to review of specific data, the data has been aggregated and anonymized for permitted internal operations, access is necessary for security purposes, including investigating abuse or security incidents, or access is required to comply with applicable law. Where this section conflicts with another section of this policy, this section controls for Google Workspace API data.</p>
297<p>
297Mana’s use of information received from Google Workspace APIs will adhere to the <a href="https://developers.google.com/terms/api-services-user-data-policy">Google API Services User Data Policy</a>, including the Limited Use requirements.</p>
298<h2>Who We Share Your Information With</h2>
299<p>We do not sell your personal data. We may share your information with:</p>
300<ul>
301<li>
302<p>AI service providers: third-party AI model providers who process your queries and content to deliver our Services, under contractual terms that restrict their use of your data.</p>
303</li>
304<li>
305<p>Service providers: companies that help us operate our business, including payment processors, cloud hosting providers, analytics services, email platforms, and security and anti-fraud services. These providers are contractually bound to use your data only for the purposes we specify.</p>
306</li>
307<li>
308<p>Affiliates and subsidiaries: entities within our corporate family, subject to this Privacy Policy.</p>
309</li>
310<li>
311<p>Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.</p>
312</li>
313<li>
314<p>Legal requirements: when required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.</p>
315</li>
316<li>
317<p>With your consent: for any other purpose with your explicit consent.</p>
318</li>
319</ul>
320<h2>Data Retention</h2>
321<p>We retain your account information, Customer Materials (including conversation history and uploaded documents), and System Data for as long as your account is active and for a reasonable period thereafter as needed to comply with our legal obligations, resolve disputes, and enforce our agreements.</p>
322<p>If you request deletion of your account or specific data, we will delete or de-identify your Customer Materials within 30 days of your request. System Data and information retained in backups or logs will be deleted or de-identified within 90 days, except where we have a legal obligation to retain it longer.</p>
323<h2>Data Security</h2>
324<p>We implement commercially reasonable administrative, physical, and technical safeguards designed to protect your information from unauthorized access, use, alteration, and disclosure. These include encryption in transit and at rest, access controls, and regular security assessments.</p>
325<p>No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee its absolute security.</p>
326<h2>Your Rights and Choices</h2>
327<p>Depending on where you live, you may have certain rights regarding your personal data:</p>
328<ul>
329<li>
330<p>Access: you may request a copy of the personal data we hold about you.</p>
331</li>
332<li>
333<p>Correction: you may request that we correct inaccurate personal data.</p>
334</li>
335<li>
336<p>Deletion: you may request that we delete your personal data, subject to certain legal exceptions.</p>
337</li>
338<li>
339<p>Opt out of AI model training: you can opt out of having your Customer Materials used as training data for AI models by contacting us at [email protected].</p>
340</li>
341<li>
342<p>Opt out of marketing: you can opt out of promotional communications by adjusting your account settings or emailing us at [email protected].</p>
343</li>
344<li>
345<p>Cookie controls: you can manage cookies through your browser settings.</p>
346</li>
347</ul>
348<p>To exercise any of these rights, contact us at [email protected]. We will respond to your request in accordance with applicable law.</p>
349<h3>State Privacy Rights</h3>
350<p>If you are a resident of California, Colorado, Virginia, Connecticut, or another state with consumer privacy legislation, you may have additional rights including the right to know what personal data we collect, the right to opt out of certain data processing, and the right to appeal a decision regarding your privacy request. To exercise these rights or to appeal a decision, contact us at [email protected].</p>
351<p>We do not sell personal data and do not use personal data for targeted advertising.</p>
352<p>We support the Global Privacy Control (GPC) signal. When we detect a GPC signal from your browser, we will respect your opt-out preferences as required by applicable law.</p>
353<h2>Children’s Privacy</h2>
354<p>Our Services are not intended for anyone under the age of 18. We do not knowingly collect personal data from children under 18. If we learn that we have collected personal data from a child under 18, we will take steps to delete that information.</p>
355<h2>International Data Transfers</h2>
356<p>Your information may be transferred to and processed in the United States or other countries where our service providers operate. These 
356countries may have data protection laws that differ from those in your jurisdiction. Where required by applicable law, we will implement appropriate safeguards for international data transfers, such as Standard Contractual Clauses or other mechanisms recognized under applicable data protection legislation.</p>
357<h2>Changes to This Privacy Policy</h2>
358<p>We may update this policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this policy and, where required by law, by providing additional notice (such as email notification). Your continued use of our Services after any changes constitutes your acceptance of the updated policy.</p>
359<h2>Contact Us</h2>
360<p>Questions about this Privacy Policy or our data practices? Contact Mana Finance Corporation at [email protected] or 2261 Market Street STE 85323, San Francisco, California 94114.</p></div></main><footer class="mt-16 border-subtle border-t pt-8"><div class="flex flex-wrap gap-4 text-muted-foreground text-sm"><a href="/legal/terms">Terms of Service</a><span>|</span><a href="/legal/privacy">Privacy Policy</a><span>|</span><a href="/legal/google-data">Your Google data</a></div></footer></div></div>
361    <!-- First boot phase: records that HTML parsing reached the app mount
362         point, before any JS bundle work. The boot timeline module
363         (@mana/ui bootTimeline) picks this mark up when the entry evaluates;
364         see mana/docs/design/frontend_boot_system__CLAUDE.md. -->
365    
365<script>
366      try {
367        performance.mark('mana:boot:html');
368      } catch (_e) {
369        /* timeline starts at the entry phase instead */
370      }
371    </script>
371
372  </body>
373</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.