Manyfy Privacy Policy
This draft explains the complete Manyfy data flow across accounts, desktop apps, AI workflows, subscriptions, and publishing, and the controls available to you. The substantive draft reflects Manyfy's current product scope but has not yet been reviewed by legal counsel. Bracketed items must be completed after the operating entity, service regions, payment policy, and production data flows are confirmed, and the text should not take effect before legal approval.
1. Scope and our role
This Privacy Policy explains how Manyfy collects, uses, shares, retains, and protects personal information when you visit our website, use the desktop apps, register an account, subscribe, run AI workflows, generate or publish content, contact support, or use another feature that links to this Policy. The Manyfy data controller is [Operating Entity Name and Registered Address].
This Policy does not govern independent third-party websites, models, payment providers, or publishing platforms. Their own privacy notices apply when you connect them. If Manyfy processes data on behalf of a business customer, a separate data processing agreement may control for that processing.
2. Information we collect
The information collected depends on the features, device, and settings you use and comes from information you provide, automatic collection, and authorized third-party sources.
Account and identity information: name or nickname, avatar, email, protected credentials, language, region, sign-in method, verification status, and organization or role information when applicable.
User Content and project data: prompts, text, images, audio, video, brand assets, workflows, project names, outputs, publishing settings, comments, version history, and task metadata.
Transaction and subscription information: plan, orders, credit changes, invoicing details, currency, transaction status, and refunds. Payment providers generally collect full card or payment credentials directly; we receive necessary confirmation records.
Communications and research: support messages, attachments, questions, feedback, complaints, and information voluntarily provided in interviews, surveys, tests, or events.
Device and network information: IP address, browser, operating system, device model, app version, language, time zone, screen size, network type, crash diagnostics, and de-identified device identifiers generated through cookies, local storage, or device fingerprinting.
Usage data: we collect technical logs and interaction information about how you use the Services, such as access dates and times, page paths, page views and click events, feature use, referral pages, attribution parameters (such as chanId or utm_source), terminal type (PC or mobile), browser language, device identifiers, error logs, and approximate region inferred from IP address. "Usage data" means technical logs, data, and insights about your use of and interaction with the Services, but does not include User Content or Output.
Sessions and local storage: to operate and manage the Services, maintain sign-in sessions, remember language preferences, complete payment redirects, preserve checkout context, identify devices, and improve your experience, we and analytics providers may use cookies, localStorage, sessionStorage, pixels, scripts, and similar technologies. Examples include: language-preference cookies (i18n_redirected); access tokens and account summaries (localStorage or sessionStorage depending on whether you stay signed in); pending order numbers and return locale during checkout (sessionStorage); and a de-identified device identifier for analytics and abuse prevention (localStorage, such as manyfy_device_id). If you choose to stay signed in, credentials are usually stored in localStorage; otherwise they may be kept only in sessionStorage for the current browser session and cleared when the tab closes.
Logs and operational data: in addition to the usage data above, we may collect model choice, task status, credit consumption, and system operation logs. We do not collect precise location unless a feature requires it and you authorize access.
Third-party sources: if you use Google sign-in or connect a publishing platform, we may receive the authorized account ID, email, avatar, public profile, token scope, and connection status.
3. AI content and model processing
To perform a task, prompts, uploaded assets, selected settings, and necessary context may be sent to Manyfy systems or connected model providers. We limit transfers to data needed for generation, editing, analysis, or publishing and apply access controls, transport safeguards, and provider contracts appropriate to the service.
Providers may process data in different countries and have different temporary retention, abuse-monitoring, and model-improvement practices. Manyfy will identify material differences in product notices, model selection, or a provider list. Before launch we will confirm whether each provider trains on customer content, its default retention, and available zero-retention controls.
Do not submit unnecessary identity documents, health data, financial accounts, confidential trade secrets, children's data, or other highly sensitive information. Where such processing is necessary, confirm lawful authority and use available enterprise controls, redaction, or private-processing options.
4. How we use information
We use personal information only for purposes consistent with the Services, user expectations, and legal requirements, including to:
Create, verify, link, and maintain accounts, including allowing a verified email to reach the same Manyfy account through password and Google sign-in.
Run workflows, process content, generate outputs, save projects, synchronize status, calculate credits, and connect or publish to third-party platforms at your direction.
Process orders, subscriptions, invoices, cancellations, refunds, and support, and send necessary transactional or service notices.
Detect unusual sign-in, fraud, spam, abuse, security vulnerabilities, and Terms violations and protect users, third parties, and the platform.
Troubleshoot, measure performance, analyze feature use, evaluate quality, and improve the product using aggregated or de-identified data where appropriate. We may collect, analyze, and process usage data internally for security monitoring, product analytics, service improvement, development, and debugging; when disclosed to third parties, usage data is shared only in aggregated and/or de-identified form that does not identify you.
Send product, policy, and security updates; send marketing only with the required permission or other lawful basis and provide an opt-out.
Meet tax, accounting, consumer, privacy, and other legal obligations, respond to lawful requests, and establish, exercise, or defend legal rights.
5. Lawful bases for processing
Where GDPR, UK data-protection law, or similar law applies, processing relies on one or more of the following bases depending on the activity.
Contract: account creation, core features, generation, synchronization, subscriptions, and support.
Consent: optional marketing, research or beta participation, non-essential cookies, or device permissions. Consent can be withdrawn without affecting earlier lawful processing.
Legal obligation: transaction retention, regulatory or court requests, required identity checks, and privacy-right requests.
Legitimate interests: service security, fraud and abuse prevention, business operations, limited analytics, and product improvement, balanced against individual rights.
Vital interests and legal claims: rare urgent safety situations and processing needed to establish, exercise, or defend legal rights.
7. International transfers
Manyfy, affiliates, and providers may process information outside your country. Privacy standards may differ, but we use measures such as transfer assessments, contract restrictions, access controls, encryption, and other safeguards required by applicable law.
For EEA, UK, or Swiss data transferred to a location without an adequacy decision, we will use Standard Contractual Clauses, the UK Addendum, an adequacy decision, or another recognized mechanism where appropriate. Before release we will identify [Primary Storage Regions], [Transfer Mechanisms], and how to request relevant documentation.
9. Data retention
We retain information only as long as needed for its purpose, considering account status, project settings, contract performance, backup cycles, security, limitation periods, and legal retention duties. Account information is generally kept while the account is active; transaction and invoice records may be kept longer for tax and accounting; security logs are retained for a limited risk-based period.
Session identifiers, cookies, local-storage items, and analytics events on your device or browser may have different retention periods depending on their purpose. For example, sign-in or checkout data in sessionStorage is usually cleared when you close the browser tab; language-preference cookies and de-identified device identifiers may persist longer until you clear browser data or we rotate them under our policy. Some temporary interactions with the Services may not appear in your project history and may be retained only for a limited period for security and system monitoring; when no longer needed, we delete, de-identify, or anonymize the information as required by law.
After content or account deletion, data is deleted or de-identified from active systems but may remain in restricted backups until normal rotation or be retained for fraud prevention, legal obligations, and disputes. De-identified information that cannot reasonably identify a person may be used for statistics, research, and improvement. Detailed schedules will be confirmed against production systems before launch.
10. Data security
We use risk-appropriate technical and organizational measures such as transport encryption, credential hashing, access controls, environment separation, audit logs, backups, vulnerability remediation, provider review, and incident response to reduce unauthorized access, disclosure, alteration, loss, or destruction.
No internet service can guarantee absolute security. Use a strong, unique password, protect devices, do not share verification codes, and report suspicious activity promptly. If a personal-data incident requires notice, we will notify affected users and regulators as required by law.
11. Your rights and choices
Depending on location and law, you may have rights to confirm processing; access, correct, delete, restrict, or object; receive portable data; withdraw consent; opt out of sale, sharing, targeted advertising, or direct marketing; and complain to a data-protection authority.
Manage available profile, connection, and communication settings in your account or contact manyfy@newportai.com. We may verify your email, account activity, or other necessary information to prevent unauthorized disclosure or deletion. We respond within legal deadlines and will explain any lawful extension, limitation, or fee.
You will not receive discriminatory treatment for exercising privacy rights. Where allowed, an authorized agent may submit a request after we verify authority. You may request review of a decision or complain to the competent regulator.
12. Children's information
The Services are not directed to children under 13 or any higher minimum age required locally, and we do not knowingly collect their personal information. Users above that minimum but below the age of majority should use the Services with parental or guardian consent and supervision.
If you believe a child provided information without valid consent, contact manyfy@newportai.com. After verification, we will take reasonable steps to delete the information, close the account, and stop the relevant processing.
13. Policy updates
We may update this Policy for product, provider, technology, legal, or processing changes and will show the updated date. Material changes affecting rights or information use will be announced in advance through the website, in-product notice, account email, or another legally required method.
Review this Policy periodically. If a new purpose requires consent, we will request it before processing rather than relying only on continued use.
14. Contact us
For questions about this Policy, data practices, or privacy-right requests, email manyfy@newportai.com. Before release, we will add the controller's [Operating Entity Name], [Registered Address], [Privacy Lead or DPO Contact], and applicable regulatory complaint channels.
To help us respond, include the account email, location, request type, and relevant context, but do not send passwords, full card details, or unnecessary sensitive information in ordinary email.
If you have any questions, suggestions, or complaints about this document, please contact us at manyfy@newportai.com. We will respond as soon as possible after verifying your identity.