Privacy Policy

Last updated: March 2, 2026

1. Introduction

Mantyl Inc. ("we", "us", "our") operates Alma, an AI-native go-to-market platform available at mantyl.ai. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our platform and related services.

By accessing or using Alma, you acknowledge that you have read and understood this Privacy Policy. If you are using Alma on behalf of an organization, you represent that you have authority to bind that organization to these terms.

2. Information We Collect

We collect the following categories of information when you use Alma:

  • Account Information: Your email address, name, and organization details provided during registration.
  • Project Data: Content you create within the platform, including project configurations, workflows, and tool definitions.
  • Chat Messages: Messages and prompts you submit through the AI chat interface.
  • Usage Metrics: Information about how you interact with the platform, including feature usage, request volumes, and session data.
  • Integration Credentials: API keys and authentication tokens for third-party services (Apollo, Clay, HubSpot), which are stored in encrypted form.
  • Cookies: Essential cookies used for session management and authentication. See Section 8 for details.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide, maintain, and improve the Alma platform and its features.
  • To process AI requests via our AI processing partners (Anthropic, OpenAI, Mistral AI, Google, and Groq) on your behalf.
  • To connect to third-party integrations (Apollo, Clay, HubSpot) as authorized by you.
  • To send transactional emails related to your account, billing, and service updates.
  • To monitor usage for billing, capacity planning, and enforcement of usage limits.
  • To detect, prevent, and address security incidents, fraud, and technical issues.

Legal Basis for Processing (GDPR Article 6): We process your data based on: (a) Contractual necessity — to provide the Alma platform services you signed up for; (b) Legitimate interest — to improve our services, prevent fraud, and ensure security; (c) Consent — for optional features like marketing communications and AI data processing.

4. Data Processing

We use the following third-party services to process your data, each of which processes data in accordance with their respective privacy policies:

  • AI Processing Partners: Your chat messages and project context may be processed by one or more of the following AI providers based on automatic model routing: Anthropic (Claude), OpenAI (GPT), Mistral AI, Google (Gemini), and Groq. The platform automatically selects the most appropriate AI model based on task complexity, cost, and performance. You can configure a preferred model in your project settings.
  • Supabase: Provides database hosting, authentication, and storage services for account data and project content.
  • Vercel: Provides application hosting and content delivery for the Alma web application.

Enterprise customers may request a Data Processing Agreement (DPA) by contacting privacy@mantyl.ai. DPAs include Standard Contractual Clauses for international data transfers where applicable.

5. Data Storage & Security

Your data is stored in Supabase infrastructure located in the United States (US region). All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher.

Integration credentials (API keys and tokens for third-party services) are encrypted using Supabase Vault, providing an additional layer of encryption beyond standard at-rest encryption.

We implement the following security measures to protect your data:

  • Role-based access controls limiting data access to authorized personnel.
  • Audit logging of administrative actions and data access events.
  • Regular security reviews and vulnerability assessments.
  • Incident response procedures for prompt detection and remediation of security events.

6. Your Rights (GDPR/CCPA)

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Right to Access: You may request a copy of the personal data we hold about you.
  • Right to Export: You may request your data in a portable, machine-readable format.
  • Right to Correction: You may request that we correct inaccurate or incomplete personal data.
  • Right to Deletion: You may request that we delete your personal data, subject to legal retention obligations.
  • Right to Object: You may object to the processing of your personal data for certain purposes.
  • Right to Data Portability: You may request the transfer of your data to another service provider.

Do Not Sell or Share: Mantyl does not sell or share your personal information as defined under the California Consumer Privacy Act (CCPA). We do not engage in cross-context behavioral advertising.

To exercise any of these rights, please contact us at privacy@mantyl.ai. We will respond to verified requests within 30 days. For GDPR requests, we will respond within the timeframe required by applicable law.

7. Data Retention

We retain your data according to the following schedule:

  • Account Data: Retained for as long as your account remains active and for a reasonable period thereafter to fulfill legal obligations.
  • Usage Logs: Retained for 12 months from the date of collection.
  • Chat Messages: Retained for as long as the associated project exists within your account.
  • Deleted Data: Purged from all production systems within 30 days of deletion. Backup copies may persist for up to 90 days before being overwritten.

8. Cookies

We use essential cookies strictly for session management and authentication. These cookies are necessary for the platform to function and cannot be disabled.

We do not use third-party tracking cookies. We do not use advertising cookies. We do not share cookie data with any third parties.

9. Children's Privacy

Alma is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to promptly delete that information.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. If we make significant changes, we will notify you via the email address associated with your account at least 30 days before the changes take effect.

Your continued use of Alma after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: privacy@mantyl.ai

Mantyl Inc.