Template — review by counsel before relying on it.
Privacy Notice
What personal data Manatu processes, why, for how long, who receives it, and how to use your rights.
Version 2026-10-12Last updated Oct 12, 2026
1. Who we are
Manatu (https://manatu.contact) is a feedback service: people report bugs, share ideas, vote and follow replies, and the teams behind apps ("app owners") answer them, together with AI agents the app owners connect.
Manatu is operated by Telluric Solutions Ltd., company number 517365748, Gizu 38, Gizu, Israel ("we", "us").
Privacy questions and requests: privacy@telluric.solutions. Everything else: support@telluric.solutions.
2. Our two roles
We are the controller for Manatu accounts and for running the service itself: your sign-in details, your language, security records, and the aggregate usage statistics described below.
We act as a processor (service provider) for app owners when you give feedback to an app through Manatu. The app owner decides which boards exist, who can see your tickets, which agents read them and how they respond. The app owner is the controller of that feedback and of the people who send it. For example, when an app signs you in to its widget with its own single sign-on, the app gives us your name and email and we create a Manatu account for you on its behalf.
If you have a question about how a particular app uses your feedback, contact that app. We will pass on requests we receive that belong to an app owner, and help app owners answer them.
3. Personal data we process
Account data. Your email address; your name (optional); an avatar image address (optional); a password hash (never the password itself); whether and when your email was verified; your interface language; if you turn on two-factor authentication, an encrypted authenticator secret and hashed recovery codes; if you sign in with Google, your Google account identifier; the version and date of the Terms and Privacy Notice you accepted; your memberships and roles in apps.
Content you submit. Tickets, comments, votes, reactions, watches, and attachments you add: files, screenshots (including your annotations) and screen recordings. Whatever you write or attach may contain personal data, so please share only what the team needs.
Debug data, only with your explicit consent. When you choose to attach debug data to a ticket, or to answer a team's request for it, we receive recent console errors and warnings, failed network requests, the page address, and browser and device information. Before it leaves your browser, token-like values in addresses and messages (keys, session tokens, JWTs, "Bearer" tokens) are replaced with "[redacted]". Request and response bodies, cookies, headers and form values are never collected. You see a preview before sending.
Payment data, if you buy a paid plan. Your billing name and contact details, the plan, amounts, dates and invoices. Card details are entered with and processed by our payment provider, Tranzila; we never receive or store your full card number.
Security and service records. Session cookies, one-time verification and password-reset codes (stored only as hashes), API keys you create (stored only as hashes), notifications, and activity records such as status changes.
Aggregate usage statistics. For each day we count page views by path, language, referring website (host name only) and device class (desktop, mobile or tablet; automated traffic is not counted). These counts contain no identifier, no IP address, no cookie and no fingerprint, so they cannot be linked to you.
4. What we do not do
- We do not store IP addresses in our database. Rate limiting keeps them in memory for a few minutes only. Our web server's access logs, which contain IP addresses, are kept for 30 days for security and troubleshooting.
- We do not use advertising or analytics cookies, tracking pixels or third-party analytics.
- We do not sell or "share" personal information (as those terms are defined in the California Consumer Privacy Act) and we do not use it for targeted advertising.
- We do not use your content to train AI models.
5. Why we use it (purposes and legal bases)
Where the EU or UK GDPR applies, we rely on the legal bases in Article 6 shown below.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, sign you in, keep it secure (verification, 2FA, password reset) | Account data, security records | Contract (Art. 6(1)(b)) |
| Deliver your feedback to the app you send it to, show replies, send the notifications you choose | Content, notifications | Contract; for app owners' end users, the app owner's instructions |
| Include debug data with a ticket | Debug data | Consent (Art. 6(1)(a)); you can withdraw it by deleting the ticket or asking us to remove the data |
| Prevent abuse, fraud and attacks; investigate incidents | Security records, transient IP addresses, access logs | Legitimate interests (Art. 6(1)(f)) in keeping the service safe |
| Take payment for paid plans and keep the accounting records | Payment data | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax and accounting records |
| Understand which pages are used, in aggregate | Aggregate statistics (no personal data) | Not personal data; legitimate interests |
| Comply with the law and answer lawful requests | As required | Legal obligation (Art. 6(1)(c)) |
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account exists |
| Deleted accounts | Anonymized 30 days after you ask us to delete the account (your content stays, credited to "Deleted user") |
| Debug data on tickets | 90 days, then removed |
| Verification and password-reset codes | Expire within minutes; purged daily |
| Activity records | 1 year |
| Notifications | 180 days |
| Tickets, comments and attachments | Until you or the app owner delete them, or the app is deleted |
| Aggregate page-view statistics | 25 months |
| Payment and invoice records | As long as tax and accounting law requires (in Israel, generally 7 years) |
| Backups | Up to 30 days, then overwritten (data you deleted can remain in a backup until it is overwritten) |
| Web server access logs | 30 days |
7. Who receives it
- The app you give feedback to. Its team (owners, admins, team members) and the AI agents it connects can read the tickets, comments, attachments and debug data you send to it. On public boards, other members of the app see your tickets and comments with your name.
- Our subprocessors, who host the service, send email and process card payments for us. They are listed on the Subprocessors page.
- Authorities, only when the law requires it.
- A buyer or successor, if our business is reorganized or sold, under the same protections.
8. AI agents
App owners can connect AI agents (through our API or MCP server) that read and answer tickets, ask you for a screenshot, recording or debug data, and update the roadmap. Agents only see what the app gives them access to. The app owner chooses and controls its agents, and is responsible for the AI provider it uses and for that provider's handling of the data. Agents never see your password, keys or two-factor secrets. A request from an agent for a screenshot or debug data is sent to you, and nothing is shared unless you approve it.
9. The Manatu browser extension
The optional Manatu extension for Chrome lets you report from any tab. It acts only when you use it: when you take a screenshot or record the current tab, attach page details to a report, or answer a request from the app's team. It does not collect your browsing history, does not read pages in the background and does not track you across sites.
- What it sends, only with your action: the screenshot or tab recording you choose, the page address, and, if you turn it on for that report, the debug data shown to you before sending (console errors and failed requests, with tokens removed).
- What it stores on your device: its settings (server address, language, notification preferences) and a sign-in key for your Manatu account, which you can revoke at any time from your account.
- Permissions: tab access only for the tab you report from (`activeTab`, `tabCapture`, `scripting`); notifications for replies; site access to manatu.contact. Access to other sites is optional and asked for only when you report from them.
10. Where your data is stored
Our production systems are hosted by Amazon Web Services in eu-central-1 (Frankfurt, Germany). Email is sent through Amazon SES in eu-central-1 (Frankfurt, Germany). When personal data moves outside the European Economic Area, the UK or Israel, we rely on the European Commission's adequacy decisions (including for Israel, and the EU-U.S. Data Privacy Framework for certified US providers) or the European Commission's Standard Contractual Clauses.
11. How we protect it
- Encryption in transit (HTTPS with HSTS) and a strict Content Security Policy.
- Passwords, one-time codes and API keys are stored only as hashes; authenticator secrets are encrypted.
- Optional two-factor authentication, and a fresh 2FA check before sensitive actions.
- Session cookies are HttpOnly and can be revoked by changing your password or signing out everywhere.
- Access to production is limited to the people who run the service.
- Daily backups kept for up to 30 days.
If a breach affects your personal data, we will notify you and the competent authority where the law requires it.
12. Your rights
Depending on where you live (for example under the GDPR, the Israeli Privacy Protection Law as amended by Amendment 13, or California law), you can:
- access your personal data and get a copy (export);
- correct inaccurate data;
- delete your data (subject to legal exceptions);
- object to processing based on legitimate interests, or restrict it;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time (for example for debug data), without affecting earlier processing;
- not be discriminated against for using these rights;
- complain to a supervisory authority, such as the Israeli Privacy Protection Authority or the data protection authority in your EU country.
13. How to use your rights
Signed in, go to your account privacy page to export your data or delete your account, and to your account page to edit your name and email. You can also email privacy@telluric.solutions. We answer within 30 days and may ask you to confirm your identity first. For feedback you sent to an app, we may refer you to that app owner, who decides about that data.
14. Notice under the Israeli Privacy Protection Law
You are not legally required to give us personal data. Without an email address we cannot create an account, and without the content of a ticket we cannot deliver it. The data is collected for the purposes in section 5, is shared with the recipients in section 7, may be transferred abroad as described in section 9, and is kept for the periods in section 6. Telluric Solutions Ltd. is the database owner. You may ask to see and correct your data as set out in sections 11 and 12.
15. Children
Manatu is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact privacy@telluric.solutions and we will delete it.
17. Changes to this notice
This is version 2026-10-12. When we change it materially, we update the version and the date at the top, and ask you to review and accept the new version the next time you sign in.