Mantia Privacy Policy

This policy explains how Mantia Ltd handles personal data when you use our website or our services:

• Mantia Essentials, which businesses buy online at app.mantia.co.uk;
• managed assessments, which our team designs and runs for each customer under an order form the customer signs; and
• our website, mantia.co.uk, and the messages you send us through it or by email.

Each has a schedule at the end of this policy with the details that are specific to it. When we add a service, we add a schedule for it.

Our services are for businesses. You're probably reading this because you order or manage a Mantia service for your organisation, a colleague has named you as a contact for one, you're one of our business contacts, or you've contacted us or applied to work with us. Every email our team sends, including emails about our services, links to this policy in its signature.

A signed agreement with your organisation, including a managed assessment's order form, can change how we handle the data your organisation gives us to test, for example how long we keep it or how it reaches us. It never changes your rights under this policy.

Who we are

Mantia Ltd is the controller of the personal data this policy describes. We're registered in England and Wales, company number 17172108. Our registered office is 124-128 City Road, London, England, EC1V 2NX. Our ICO registration number is ZC218676. We handle your personal data under the UK GDPR and, where it applies, the EU GDPR.

To ask about this policy, make a request about your data or complain, email hello@mantia.co.uk, use the contact form on mantia.co.uk and select 'Privacy request or complaint', or write to us at our registered office. Our contact for anything in this policy is Jesse Lucas, our founder.

What we collect, and why

This section covers our services and our website. Each schedule lists what we collect for it.

Your contact details. Your name, work email address and job title where you give them, and the details of any colleague you name as a contact for the work. These, and your order details, are ours to handle under this policy. If you name a colleague, please tell them, and point them to this policy.

Why: to run the work for your organisation and to talk to you about it.

Your order or engagement. What your organisation has ordered, its scope, price and dates, its status, and the authorisation it gives us to test its agent: a tick when you order Mantia Essentials, or the signature on a managed assessment's order form. We record when it was given, by whom, and which version of our terms (https://mantia.co.uk/legal/terms) applied.

Why: to run the work, and to keep a record of what your organisation authorised and agreed to.

What you give us to test. A description of your agent and what it should and should never do, your documentation, how we reach your agent, example messages, test accounts, and the key or token you create for us. Most of this is about your organisation and your agent, not about you, but it may include the names or contact details of people at your organisation. Please don't include real customers' personal data: we test only staging environments with no real customer data. If personal data does appear in it, see 'Personal data inside what you give us to test'.

Why: to connect to your agent, test it and report what we find.

The testing and your results. We hold test conversations with your agent and record every message and reply. AI models carry out the testing: one model plays your customers and people trying to misuse your agent, and a model made by a different company judges each conversation. Our team reads the conversations as part of the review. If the judge declines to rule on a conversation, one of us reviews it and rules on it, and your results mark it "Reviewed by the Mantia team". We also use an AI assistant from Anthropic to help us review and prepare your results (see 'The AI models we use'). We then build your results site.

Why: to give your organisation the results it paid for.

Payment. How your organisation pays depends on the service (see the schedules). We keep invoices and payment records in our accounting records.

Why: to take payment, give refunds and keep the records the law requires.

Emails. The emails we exchange with you about the work. We keep copies.

Why: to run the work and to answer you.

Calls. We never record or transcribe a call unless you agree at the start of it. If we ask, we tell you which tool we would use; at present it is Google Meet's own recording. After 30 days, we keep only our notes of the call, with our business contacts.

Why: to keep an accurate record of what we discussed.

Business contacts. Names, work email addresses and notes about the people we deal with at our customers and at organisations that may become customers. We get them from you, from someone who introduced you, or from public business sources such as your organisation's website or professional networking profiles. We add Mantia Essentials buyers only if they become managed assessment customers or contact us directly.

Why: to manage our relationships with customers and prospective customers, and to email you about our services. Every such email has an unsubscribe link, and you can object at any time.

Requests about your personal data. What you tell us, and anything we need to confirm your identity.

Why: to deal with your request.

Questions, complaints and claims. What you tell us, and the records of the work we need to deal with it.

Why: to answer you, and to deal with any complaint or claim.

Server logs. Our host, Netlify, logs each visit to mantia.co.uk, app.mantia.co.uk and your results site, including your IP address, your browser details and the pages you visit. We use these logs to keep the sites running and secure.

How we improve the service. For Mantia Essentials, we count how many orders are started, finished and paid, and how long each step takes, to see where people stop and improve the service.

You don't have to give us any of this, but without your contact details and what we need to test, we can't do the work.

Our lawful bases

What we do	Lawful basis
Run our services: your sign-in, your order or engagement, taking payment and giving refunds, delivering your results and our emails	Contract, if you're the customer yourself. If you act for your organisation, or you're one of its contacts: our legitimate interest in providing the service to your organisation
Record what your organisation authorised and agreed to	Our legitimate interest in testing only systems the customer is entitled to have tested
Keep bots and misuse out of Mantia Essentials	Our legitimate interest in keeping our services secure
Count Mantia Essentials orders started, finished and paid, and time each step	Our legitimate interest in improving the service
Keep payment and accounting records	Legal obligation: company and tax law require us to keep them
Record or transcribe a call	Your consent, which you can withdraw at any time
Keep business contact details and notes, and email business contacts about our services	Our legitimate interest in managing our relationships with customers and prospective customers, and in telling people at companies about our services. We email sole traders and partnerships about our services only with their consent
Deal with requests about your personal data	Legal obligation: data protection law
Deal with questions, complaints and claims	Our legitimate interest in dealing with them and in protecting our legal rights
Mention privately to investors and prospective customers that your organisation is a customer	Our legitimate interest in growing our business
Keep server logs	Our legitimate interest in keeping the sites running and secure

Schedule 3 gives the lawful bases for what you send us through our website. The basis affects which rights you have (see 'Your rights'). To find out how we've weighed our legitimate interests against your rights, contact us.

Who can see your information

Within Mantia, only the members of our team who work on your organisation's work can see your key and what you give us to test, and they read the conversations as part of the review. They connect to and test your agent, review the results and write to you. We give at least 10 business days' notice before anyone new works on customer data.

We don't sell your information. We may tell investors and prospective customers, in private, that your organisation is a customer, unless you tell us not to. We never say so publicly without your written agreement.

Where your data is kept, and where our team works

The members of our team who work on it use their own computers and may access your data from outside the UK and the EU. The testing runs on the computer of whichever of us prepares the work: your key goes into a private file there, and your documents are kept there. The code we write to connect to your agent stays in that work's folder on that computer and is never put in our code repository. Your results are kept in our Google Drive as an encrypted disk image, and on the computer of whichever of us reviews them. Your results site is hosted on Netlify and protected by Netlify's password protection. Each schedule says where else that service keeps data.

Our team's access from outside the UK and the EU is protected by:

• working only on our instructions, and only for your organisation's work;
• written confidentiality undertakings, including never to share or reuse your data;
• the ICO's International Data Transfer Agreement, where it applies;
• disk-encrypted computers;
• deletion on the dates in the schedules.

Wherever our team works, we remain responsible for your data under UK data protection law.

The AI models we use

Our testing uses AI models from Anthropic and OpenAI and, for a managed assessment, from any other provider its order form names. Our sub-processors page shows which of Anthropic and OpenAI does which part of the testing. We may change that, and which of their models we use, for example when a newer model gives better results, but the model that judges a conversation is always made by a different company from the model that played it.

• The models that judge each conversation see the conversations, a short brief we write from what you've told us, your documentation and anything you mark as your agent's instructions.
• The models that carry out the rest of the testing see the brief, your documentation and your agent's replies. Of these, only the models that prepare the tests see anything you mark as your agent's instructions. We never give your instructions to the models that play your customers and the people trying to misuse your agent.

For a managed assessment, the order form names the models we will use, and we change them only with your organisation's written agreement. If your organisation asks for or agrees to models from another provider, the order form also says where that provider processes data and how long it keeps it.

Our team also uses Anthropic's AI assistant, on a business plan under Anthropic's commercial terms, with feedback ratings switched off and its memory switched off for customer work, to help review the conversations and prepare your results. It sees the conversations, our findings and your documents, including any you mark as your agent's instructions, but never your key. We delete these conversations, and any files we add to it, with the rest of the testing data.

Our model providers do not train on your data. They keep what we send for a limited time under their own terms, and longer if a conversation is flagged as breaking their usage policies or the law requires it; our tests are built to look like attacks, so some conversations may be flagged. Our sub-processors page gives the periods for Anthropic and OpenAI, and a managed assessment's order form gives them for any other provider it names.

How we keep it secure

• Within Mantia, only the members of our team who work on it can open your organisation's data.
• Every account we use that holds customer data needs two-factor sign-in.
• On our computers, your key is kept only in a private settings file, never in our code or our results, and never in our conversations with our AI assistant.
• The computers our team uses are disk-encrypted.
• We encrypt your results ourselves, as an AES-256 encrypted disk image, before they go on our Google Drive.
• Order folders and the private file that holds your key are never included in backups of our computers.
• Your results site is protected by Netlify's password protection, and we send the password in a separate email.
• Each schedule adds what is specific to that service.

Personal data inside what you give us to test

If personal data appears in what you give us to test (your documentation, example messages, test accounts or any other setup details), or in your agent's replies, we handle it only for your organisation, under our Data Processing Terms (https://mantia.co.uk/legal/data-processing). For that data, your organisation is the controller, and its own privacy notice applies. This doesn't include your contact details and order details, or those of the people at your organisation who order, pay and correspond with us: we handle those under this policy. The customers in our test conversations are made up by our AI models.

On your organisation's instruction under those terms, we may anonymise what you give us in order to draw lessons that improve our tests, for example which of our techniques worked. We write the lessons in our own words, use them only to improve Mantia and never share them outside it. They never include your data, your documents, your agent's replies, your name, or anything else that could identify your organisation or any person, so they are not personal data. A managed assessment customer can opt out in its order form (see Schedule 2). We never use your materials or the conversations to train an AI model.

How long we keep it

Each schedule sets how long we keep what you give us to test, the test conversations, your results and your results site. For every service, we keep the following for these periods:

What	How long
For an order you pay for, and every signed order form: your order or engagement record (who ordered, what, when and for how much, and its status), including the record of your authorisation and of your acceptance of our terms, and payment records	Deleted 6 years after the end of the financial year of the order
Emails that carry personal data from your materials or your results, such as documents, conversations or findings	Deleted 30 days after we send your results, unless the schedule or your order form sets another date for the rest of the testing data (for example, 7 days after an order ends without results)
Other emails: ordinary correspondence, such as names, work email addresses and messages about the order	Kept as business records, and deleted 2 years after the last message
Business contact details and notes, including our notes of calls	Deleted 2 years after our last contact with you
Records of a request about your personal data	Deleted 2 years after we close it
Records of a complaint or claim	Deleted 6 years after it is closed
Call recordings and transcripts, if you agreed to them	Deleted 30 days after the call
Server logs	Kept by Netlify, as our processor, under its own retention policy, which sets no fixed period. We keep no copies.

On the dates set, we delete from the computers our team uses, our mailbox, our Google Drive (including its bin), our AI assistant workspace, our Notion workspace (including its trash), any call tool, and wherever else the schedule says we keep data. Our AI model providers keep data as described under 'The AI models we use'. Stripe, Resend and our other providers keep their own copies under their own terms.

Who else handles your data

These providers handle your data for us under contract. Each may use other companies of its own to run its service. Our sub-processors page (https://mantia.co.uk/legal/sub-processors) is the up-to-date list of the providers that handle what you give us to test, apart from any other AI model provider a managed assessment's order form names (see below). At least 10 business days before a new provider on that page starts, we update the page and email the customers it affects, as our Data Processing Terms set out.

Provider	What it does for us	Where
Netlify, Inc.	Hosts mantia.co.uk, app.mantia.co.uk and your password-protected results site; stores Mantia Essentials orders and our website's form submissions, and emails each submission to us; and keeps server logs	Mantia Essentials order storage and server code in Frankfurt, Germany (EU). Website form submissions in the United States. Sites are served from Netlify's global network, and its logging providers are in the United States
Akismet	Checks every website form submission for spam, on Netlify's behalf, under Netlify's contract with us	United States
Anthropic	Its AI models carry out part of the testing (see 'The AI models we use'), and our team uses its AI assistant to help review conversations and prepare your results	Stores data in the United States; may process requests in the United States, Europe, Asia and Australia
OpenAI	Its AI models carry out part of the testing (see 'The AI models we use')	The United States and other countries where its cloud providers operate
Google	Carries and stores our email, including hello@mantia.co.uk, essentials@mantia.co.uk and the copy of each website form submission Netlify sends us, and stores your encrypted results and managed assessment order forms in Google Drive	Any country where Google or its subprocessors have facilities, including the United States
Notion Labs, Inc.	Holds our order tracker (company names, status and times, and our own cost and hours; never a person's name or email address, your key, documents, conversations or findings); our business contacts (names, work email addresses and notes; Mantia Essentials buyers only if they become managed assessment customers or contact us directly); our accounting records (invoices and payments, with company names and amounts, and the payer's name where an invoice carries one); and, for managed assessments, the goal sets we write from your documents, which contain no personal data	United States
Stripe	Takes card payments for Mantia Essentials and, where an order form agrees it, for managed assessments	Stripe's European company is in Ireland; Stripe also transfers data to the United States and other countries, including India
Resend (Plus Five Five, Inc.)	Sends Mantia Essentials' automatic emails: sign-in codes, order confirmations, and alerts to our team about new orders	Sends from Ireland (EU); its processing and storage, including account data, email metadata and logs, are in the United States
Cloudflare, Inc.	Runs the bot check when you ask for a Mantia Essentials sign-in code	Mainly the United States and the European Economic Area, with access from other countries

We may also use:

• other AI model providers, for a managed assessment only, where your organisation asks for or agrees to one: the order form names the provider and says what it does, and that provider handles data only for the assessments whose order forms name it;
• e-signature services, when an order form is signed electronically: the service receives the names, email addresses and signatures of the people who sign;
• accounting services, which hold our invoices and payment records; and
• call recording or transcription tools, only if you agree to a call being recorded or transcribed: we name the tool when we ask.

For these, we use only services that keep data in the UK or the European Economic Area, or that protect data sent elsewhere with one of the safeguards under 'Data sent outside the UK'.

Banks and card processors handle payments as controllers in their own right, under their own privacy policies. Stripe also uses payment details as a controller in its own right, for example to prevent fraud and meet its legal duties; Stripe's privacy policy covers that. Cloudflare also uses the bot check's signals as a controller in its own right, to improve its bot detection; Cloudflare's privacy policy for its bot check covers that.

We share your information with anyone else only if the law requires it, or if we need professional advice or to protect our legal rights.

Data sent outside the UK

Mantia Essentials orders are stored in the EU (see Schedule 1). UK law treats the European Economic Area as giving adequate protection. Netlify is a US company, so its safeguard below applies too.

Other data goes further, as the table above shows. It goes to the United States for Netlify's logging and our website's form submissions, and Akismet's spam checks; for Resend's storage of account data, email metadata and logs, although Resend sends our emails from Ireland; for the copies of the brief, your documentation and the test conversations that OpenAI and Anthropic process; and for Stripe, Cloudflare, Google and Notion. It goes to other countries through Netlify's global network, Cloudflare, Stripe, Google, OpenAI and Anthropic. These safeguards cover those transfers:

Provider	Safeguard
Netlify	The UK Extension to the EU-US Data Privacy Framework, with the UK transfer terms in Netlify's data processing terms where that doesn't apply
Cloudflare	The UK Extension to the EU-US Data Privacy Framework, with the EU standard contractual clauses and the UK Addendum in Cloudflare's data processing terms where that doesn't apply
Stripe	The UK Extension to the EU-US Data Privacy Framework, with Stripe's UK data transfer addendum where that doesn't apply
Google	The UK Extension to the EU-US Data Privacy Framework, with the standard contractual clauses in Google's data processing terms where that doesn't apply
Akismet	Netlify passes your data to Akismet within the United States. Under Netlify's safeguards above, Netlify stays responsible to us for how Akismet handles it
Notion	The standard contractual clauses for UK data in Notion's data processing terms
OpenAI, Anthropic, Resend	The EU standard contractual clauses with the UK Addendum, in each provider's data processing terms

The Data Privacy Framework covers only the United States. For other countries, Netlify relies on the UK transfer terms in its data processing terms; Cloudflare, Google, OpenAI and Anthropic rely on the standard contractual clauses in theirs; and Stripe's own terms govern its onward transfers from the United States.

Where the EU GDPR applies, the same providers rely on the EU-US Data Privacy Framework or the EU standard contractual clauses.

If a managed assessment's order form names another AI model provider, the order form says where it processes data and what protects data sent outside the UK.

Our team may also access your data from outside the UK and the EU. That access is protected as described under 'Where your data is kept, and where our team works', including by the ICO's International Data Transfer Agreement where it applies.

For a copy of the safeguards, contact us.

Your rights

You have the right to:

• Access: ask us for a copy of your personal data, and for other information, such as where we got it and who we share it with.
• Rectification: ask us to correct personal data you think is wrong, or to complete it.
• Erasure: ask us to delete your personal data.
• Restriction: ask us to limit how we use your personal data.
• Object: object at any time to any use of your personal data that rests on our legitimate interests. If you do, we'll stop, unless we have compelling reasons to carry on or need it for a legal claim. If you object to our emails about our services, or unsubscribe, we always stop.
• Portability: ask us to send the personal data you gave us to you, or to another organisation, where we use it under a contract with you or with your consent.
• Withdraw consent: where we rely on your consent, withdraw it at any time. This doesn't affect what we did before you withdrew it.

Which rights apply depends on the lawful basis. Where we rely on a contract, you can't object. Where we rely on legitimate interests, there's no right to portability. Where the law requires us to keep something, you can't ask us to delete it, object to it or move it. There are also exemptions, so you may not get everything you ask for. The ICO's website explains each right.

To make a request, use any of the contact details under 'Who we are'. We may ask you to confirm who you are. We'll reply without undue delay and within one month. If a request is complex, we may need up to two more months, and we'll tell you why.

No automated decisions about you

We make no decisions about you by automated means alone that have a legal or similarly significant effect on you. Our AI judge rules on your agent's conversations, not on you, and if it declines to rule on one, a person does.

Some things happen automatically to protect Mantia Essentials: the bot check, our limits on codes and wrong tries, and turning away common free email addresses, because our services are for businesses. If any of these stops you, email us at hello@mantia.co.uk.

Akismet sorts likely spam among our website's form submissions automatically, and we check flagged messages so real ones aren't lost.

Cookies

Our website, mantia.co.uk. It sets no cookies and runs no analytics, tracking pixels or adverts. Every page loads only from mantia.co.uk, fonts and images included, so your browser contacts no other site unless you follow a link. We keep nothing in your browser's storage either.

Our order site, app.mantia.co.uk (Mantia Essentials). The only cookie it sets is the one that keeps you signed in, for up to 2 hours. It's strictly necessary, so it needs no consent. When you ask for a sign-in code, Cloudflare's bot check reads your IP address and browser details to tell people from bots. Cloudflare says this is strictly necessary for detecting and blocking bots. The check runs in a frame from Cloudflare, which may store its own strictly necessary token there; Cloudflare's privacy policy for its bot check covers it. Stripe's payment page belongs to Stripe and uses Stripe's own cookies.

Your results site. It is a separate site, protected by Netlify's password protection. Netlify may set a cookie there to remember that you've entered the password; if it does, that cookie is strictly necessary for the page to work.

None of our sites runs analytics tools, tracking or adverts, so there's no cookie banner.

Complaints

Complaining to us

If you're unhappy with how we've handled your personal data, please tell us, using any of the contact details under 'Who we are'. We'll acknowledge your complaint within 30 days and look into it without undue delay. We'll keep you updated and tell you the outcome.

Complaining to the regulator

You can also complain to the Information Commission (the ICO), the UK's data protection regulator, at any time, at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to the address on that page.

If you're in the European Economic Area, you can also complain to the data protection authority where you live or work.

Changes to this policy

If anything here changes, we'll update this policy and the date at the top. A new service gets its own schedule.

---

Schedule 1: Mantia Essentials

Mantia Essentials is our online service: a business orders and pays at app.mantia.co.uk, and we test its agent and send the results.

What we collect

When you sign in: your work email address and the 6-digit code we email you; how many codes you've asked for and how many wrong codes you've entered; and a bot check run by Cloudflare when you ask for your code, which looks at your browser and your connection, including your IP address. Why: to check the email address is yours, keep you signed in for up to 2 hours, save your progress, and keep bots and misuse out.

When you set up an order: your company's name and website (we fill these in from your email address); your agent's name; who talks to your agent, what it should do and what it should never do; your documentation, how you've marked each item and what you say it is; how we reach your agent (your example request, how it checks access, any API documentation, how replies arrive, and anything else you tell us); your technical contact's email address (when we first email them, we link to this policy); and the key or token you create for us.

When you confirm your order: before you pay, you tick two boxes. One confirms that it is a staging version of an agent your organisation controls, with no real customer data, and that you're authorised to have it tested; the other accepts our terms. We record each tick with the time, your email address and the version of our terms.

When you pay: Stripe takes your payment on its own page. We fill in your email address, and Stripe asks for your card details, your name and your billing address. Stripe tells us whether the payment went through and passes us the details you gave it, such as your name, email address and billing address, and your card's brand and last four digits. We never see your full card number. If you use a promotion code, we record it with your order.

Our emails to you: your sign-in codes and order confirmation; then when testing starts, when your results are ready (with the password in a separate email), if we need something from you, if we refund you, and if your results will be late. These emails come from essentials@mantia.co.uk.

Where it is kept

Your order, your documents and your key are stored on Netlify in Frankfurt, Germany, and cached on Netlify's global network when read. Our order site's server code runs in Frankfurt too. Whichever of us prepares your order downloads your key and documents from there onto their computer.

How we keep it secure

Your order is kept in Netlify's standard encrypted storage, private to our order site. Each of our team downloads orders with their own access token.

How long we keep it

What	How long
Your key	Deleted 7 days after we send your results
Everything else from the testing: your setup answers, your documents, the test conversations, the code we write to connect to your agent, your results in our Google Drive and on our computers, and our team's AI assistant conversations and files about your order	Deleted 30 days after we send your results
Your results site	Deleted 90 days after we send your results, unless you ask us to delete it sooner or to keep it for up to 12 months after we send them
An order you start but don't pay for	Deleted 7 days after you last saved it
An order that ends without results, for example because we refund it or you cancel before testing starts	Your key and everything else from the testing deleted 7 days after the order ends
Your sign-in details	Deleted 2 years after you last sign in

We delete Mantia Essentials data from our order site's storage on the same dates.

Schedule 2: Managed assessments

A managed assessment is testing our team designs and runs for one customer. Each customer's order form sets the practical and commercial details of the work, within the limits set at the start of this policy. Where the order form says nothing on a point, this schedule sets what applies.

What we collect

The order form: your organisation's name; the names, job titles and work email addresses of the person who signs and of your contacts; the agent under test; what we've agreed, such as the scope, price and dates; and your organisation's authorisation for us to test the agent, including its confirmation that we test only a staging version with no real customer data. The order form is signed in writing or electronically, including through an e-signature service.

What you give us to test: what the order form asks for, such as your documentation, how we reach your agent and the key or token you create for us. It reaches us by the route agreed in your order form, using only the providers listed under 'They handle what you give us to test' on our sub-processors page. If a route needs any new tool, we add that tool to our sub-processors page, with the notice described under 'Who else handles your data', before we use it.

Payment: we invoice your organisation by email, and it pays by bank transfer, or by card through Stripe, as the order form sets out.

Lessons: if your organisation ticks the opt-out in its order form, we draw no lessons from its assessment.

Where it is kept

On our team's computers, in our Google Drive and on your results site, as for every service. We keep the signed order form in our Google Drive. We also write the goal sets for your assessment (the rules we test against, written from your own documents, without personal data) and keep them in our Notion workspace.

How long we keep it

Your key, the rest of the testing data and your results site: as your order form sets out. Where it sets no period, the Schedule 1 periods apply: your key is deleted 7 days after we send your results, everything else from the testing 30 days after, and your results site 90 days after, unless you ask us to delete it sooner or to keep it for up to 12 months after. If the assessment ends without results, your key and everything else from the testing are deleted 7 days after it ends.

Your goal sets: deleted from our Notion workspace, including its trash, on the end date in your order form or, if it sets none, 30 days after we send your final results.

Documents you send us before an order form is signed: if no order form is signed, deleted within 30 days of receipt, unless a non-disclosure agreement signed by both of us covers them, in which case it governs them.

The signed order form: kept with your engagement record, and deleted 6 years after the end of the financial year of the order.

Schedule 3: Our website

This schedule covers mantia.co.uk and the messages you send us through its forms or by email.

What we collect, and why

What you send	What we collect	Why, and our lawful basis
Contact form, or an email to us	Your name, email address and the reason you select, plus your organisation and message if you add them	To receive your message, check it isn't spam and reply to you. Lawful basis: our legitimate interest in answering people who contact us
Book a demo form	Your name, email address, organisation and message	To receive your request, check it isn't spam and reply to arrange a demo. Lawful basis: our legitimate interest in answering people who contact us
Partners form	Your name, email address, organisation, the kind of organisation, and your message	To receive your message, check it isn't spam and reply to you about working together. Lawful basis: our legitimate interest in answering organisations that contact us
Careers form, or the contact form when you select 'Careers'	Your name, email address, LinkedIn profile URL, and your answers to 'Why you' and 'Why Mantia'. We also read the public LinkedIn profile you link to	To consider you for work at Mantia and to reply to you. Lawful basis: our legitimate interest in recruiting
A request for an adjustment	Only what you tell us, which we use only to make the adjustment	Lawful basis: our legal duty under equality law to make reasonable adjustments

You don't have to give us anything, but we can't reply without an email address.

With each form submission, Netlify also records your IP address, your browser details and the page you sent it from. To check for spam, it shares your submission and your IP address with Akismet, and may share these other details too.

Please don't send us passwords, access keys or customer data through a form or by email.

If someone copies you into an email to us, we use your details only to reply.

We use job applications only to consider you for work. If you contact us about anything else, we may also keep you as a business contact and email you about our services, as 'Business contacts' in the main section describes.

Where it is kept

Netlify stores each form submission and emails a copy to us, which we keep in our mailbox.

How long we keep it

What	How long
Contact, demo and partner enquiries	Deleted 2 years after we last exchanged messages
Job applications	Deleted 6 months from the day you apply
Requests for an adjustment	Deleted 6 months from the day you ask
Server logs	Kept by Netlify under its own retention policy. We keep no copies

We delete website data from Netlify's form storage and our mailbox on these dates. If we start working together, the schedule for that service, and any agreement we sign, set what we keep and for how long.

---

Contains public sector information licensed under the Open Government Licence v3.0. Adapted from the Information Commissioner's Office privacy notice generator for customers or suppliers, general business (page updated 10 July 2026).