Privacy Policy

This Privacy Policy details how Crescent Park Computing Company and its affiliates (“Mana,” “us,” “our,” or “we”) process personal information (as defined below) collected, among other things, through our website or our AI-powered workspace platform (the “Website” and “Platform,” respectively).

Mana, available at mana.space, is a product operated by Crescent Park Computing Company.

Our details are as follows:

Crescent Park Computing Company
compliance@mana.space

We may update this Privacy Policy from time to time by posting the new privacy policy on this page and updating the “Last updated” date. Where changes are material, we will provide additional notice — for example, by email or through the Services. We encourage you to visit this page regularly to check for any changes.

This Policy does not apply to personal information we process as a processor or service provider on behalf of our customers when providing the Services to them. In those cases, the customer acts as the controller and its privacy policy governs the processing of such personal information.

In this Policy:

“Prompt(s)” means text commands or other instructions, queries, or cues you provide to the Platform, including data you provide for the purpose of personalising, prompting, or customising the Services to a specific need or use case.

“AI Assistant” means Mana’s AI-driven assistant that uses artificial intelligence to perform tasks, based on Prompts, for and on behalf of you.

“Output(s)” means any content, recommendations, interactions, actions, and results generated or executed by the AI Assistant in response to a Prompt.

We may collect personal information about you, being a customer or user of our Platform or Website (“you”), which means any information relating to an identified or identifiable natural person, or “personal data,” “personal information,” or “personally identifiable information” as otherwise defined under applicable privacy laws (“Personal Information”):

For Website and Platform Users:

We collect Personal Information that you provide to us voluntarily, such as your name and email address — for instance when you create an account, communicate with us, or register for updates or our mailing list. In those cases, we use such Personal Information to provide you with the Platform and to contact you. If you sign in with Apple, we receive only your name and the email address you choose to share, which may be a private relay address from Apple that forwards to your inbox.

Prompts and workspace content. When you use our Services, we collect the Prompts and inputs you provide, your customisation preferences and configurations, the Outputs generated through the Services, and your feedback and support requests. This may include workspace content such as files, documents, notes, and other content you upload or create within your Mana workspace. Where you choose to connect third-party services, we may also access and process information made available through those connected services to provide and support the functionality of the Services.

Mobile and SMS information. If you choose to participate in the Mana SMS program, we collect the mobile phone number you provide, phone-verification status, SMS consent and opt-out records, and operational information about messages sent or received, such as delivery status and HELP, STOP, or START requests.

Automatic data collection:

We and our service providers may automatically log information about you, your device, and your interactions with us, including through cookies and similar technologies. This includes device information (such as browser type and version, operating system, IP address, and unique device identifiers, and a rough estimate of your geolocation derived from your IP address) and usage information (such as the timing, frequency, and patterns of your usage, features accessed, session duration and navigation paths, the content you view or actions you take, and performance and error data).

Legal basis of our processing:

Depending on the type of use detailed below, we process Personal Information based on the following legal bases:

• Processing is necessary for the performance of a contract to which the data subject (as such term is defined under applicable law) is a party;
• Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract;
• Processing is necessary for our legitimate interests and those of third parties for the purposes identified below;
• Processing is necessary to comply with our legal obligations; and
• Consent (with regard to marketing communications).

You should not include personal information in Prompts, inputs, or uploaded data unless it is strictly necessary and you are authorised to do so under applicable law.

We use the information in the manners described in this Privacy Policy. In addition to the purposes listed herein, the information we collect, which may include your Personal Information, may be used by us for the following purposes:

• To respond to inquiries and requests from our customers and users, to provide you with further information about our Platform, products, and services, and to provide you with support;
• To generate anonymized and aggregated metadata;
• To provide our customers and users with Platform access and use, including support in connection therewith;
• To investigate and resolve disputes in connection with use of our Platform and Website;
• To detect and prevent fraudulent and illegal activity or any other type of activity that may jeopardize or negatively affect the Platform, including detecting, preventing, and resolving security issues;
• To investigate violations and enforce our policies, and as required by law, regulation, or other governmental authority, or to comply with a subpoena or similar legal process or respond to a government request, or otherwise collaborate with law enforcement agencies;
• To detect and prevent harm to the rights, property, or safety of Mana, our affiliates, our users, yourself, or any third party;
• To establish or exercise our rights to respond to legal claims, and to enforce and establish our intellectual property or other legal rights;
• To improve the performance of the Website and Platform;
• To verify ownership of a mobile number; deliver transactional verification codes, reminders, alerts, and digests that you request through Mana; manage SMS consent and opt-out requests; prevent messaging abuse; and comply with carrier and legal requirements;
• To identify, contact, and analyze prospective customers or leads for marketing, business outreach, or internal analytics. Where required by law, we will seek consent or offer individuals an opportunity to opt out of or object to such processing; and
• To develop new products and services by conducting analytics or research.

The use of raw and derived information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See the “Google user data” section below.

The Mana SMS program is transactional and available only to users who expressly opt in through the authenticated Mana application. We use mobile phone numbers, text messaging originator opt-in data, and consent records only to verify numbers, provide requested SMS functionality, process HELP and opt-out requests, secure the program, and comply with applicable law and carrier requirements.

We do not sell or rent mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of data sharing described elsewhere in this Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We use messaging service providers acting on our behalf to transmit requested SMS messages. They receive only the mobile information necessary to operate and deliver the SMS program and may not use that information for their own marketing, promotional, or other independent purposes.

You may withdraw SMS consent at any time by replying STOP to a Mana message. You may reply HELP for assistance or contact compliance@mana.space.

If you connect a Google service (such as Gmail or Google Calendar), our access to, use of, and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only request the OAuth scopes necessary for the features you choose to use.
• We use Google user data only to provide and improve the user-facing features you have requested.
• We do not transfer or sell Google user data for advertising or marketing purposes, and we do not use it to train generalized artificial intelligence or machine-learning models. Google user data is never transferred to any third party that uses it to train or improve AI/ML models — see “AI processing and automated decision-making” below for the model providers we use and the API tiers involved.
• Humans do not read your Google user data except where you give explicit consent, where it is necessary for security or to comply with applicable law, or in aggregated/anonymised form for internal operations.
• You can revoke our access at any time from your account settings or via your Google Account permissions.

Our Platform uses artificial intelligence systems, which may include third-party models and internally developed systems, to generate Outputs based on your Prompts, inputs, and configurations. Where personal information is processed through these systems, such processing is carried out in accordance with this Policy and applicable data protection laws.

Unless expressly agreed in writing, we do not use the personal information contained in your Prompts or Outputs to train or fine-tune our artificial intelligence systems. We may, however, use aggregated, de-identified, or anonymised data, and limited operational data (such as logs or usage data), to develop, maintain, and improve the Services. We maintain human oversight over our artificial intelligence systems, and you remain responsible for evaluating Outputs before relying on them.

To generate Outputs, the Platform sends the content needed to fulfil your request — which may include personal information and, where you have connected a Google service, Google user data — to third-party model providers. We use the following providers, in each case exclusively through paid, commercial API tiers whose terms prohibit the provider from using customer API inputs or outputs to train or improve their models: Anthropic (Claude models), OpenAI (GPT models), Google (Gemini models, paid API tier), Fireworks AI, Cerebras, and OpenRouter (an API routing layer for a subset of image-generation requests). These providers process the data transiently to return the requested response; they do not use it to create, train, or improve foundational or generalized artificial intelligence or machine-learning models, and neither do we.

Where we offer open-weight models (such as GLM-, Kimi-, or DeepSeek-family models), they are operated for us by the hosted-inference providers listed above under the same no-training API terms; your data is never transmitted to the original model developers. We do not operate self-hosted or offline AI models on our own infrastructure.

We ask for your permission before the Platform first sends your messages, voice, or other content to these providers, and we record your answer with your account. If you do not agree, the rest of your workspace keeps working, but Mana will not send messages or start voice sessions. You can review or withdraw your permission at any time in Profile › AI & privacy; withdrawing stops new requests but cannot recall content that was already sent.

We do not rent or sell any Personal Information. We may share Personal Information with the following recipients:

• Our third-party vendors and service providers engaged in providing services in connection with the Platform and Website — including providers of artificial intelligence systems, hosting and cloud infrastructure, analytics, payment processing, and other information technology services — or in sending marketing communications (the latter, with your consent). These parties access, process, or store personal information only pursuant to our instructions and in the course of performing their duties for us;
• Our subsidiaries and affiliated companies;
• Our professional advisors, such as auditors, lawyers, and accountants; and
• Any potential purchasers of, lenders to, or investors in our business, including in connection with a merger, acquisition, financing, reorganisation, or sale of assets.

We implement commercially reasonable technical, administrative, and organizational measures designed to protect your Personal Information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, role-based access controls and least-privilege permissions, secure user management systems, and access logging. However, we should note that no method of transmission over the Internet or electronic storage is 100% secure or error-free. Therefore, you should take special care in deciding what information you provide to the Platform.

We use cookies and other technologies in our services, including when you visit our Website or access our Platform. A “cookie” is a small piece of information that a website assigns to your device while you are viewing it. Cookies allow you to navigate between pages efficiently, enable certain features, remember your preferences, and make the interaction between you and our Platform quicker and easier. Cookies are also used to compile statistical data on your use of the Platform.

Our Website uses cookies to provide you with services, enable your use of the Platform, identify you for repeat visits (for example, storing your preferences for the next sign-in), and monitor and analyze your web access. We may also use analytics tools to collect information about your use of the Platform and Website, such as how often users access it and which pages they visit, and we use this information only to improve our Website and Platform.

You may remove cookies by following the instructions in your device or browser preferences; you can find more information about cookies at www.allaboutcookies.org. However, if you choose to disable cookies, some features of our service may not operate properly and your online experience may be limited.

Because we operate globally, it may be necessary for us to transfer information, including Personal Information, to countries other than the country in which the information was collected. In these instances, we will transfer your data in accordance with the provisions of applicable privacy legislation meant to safeguard the processing of your Personal Information.

We retain the information that we collect from you for as long as it is necessary based on the purpose it was collected for, taking into account compliance with our legal obligations, resolving disputes, and enforcing our rights. Retention periods are determined taking into account the type of information collected and the purpose for which it is collected, bearing in mind applicable requirements and the need to destroy outdated, unused information at the earliest reasonable time. We may keep records containing your Personal Information, communications, and anything else as required by applicable laws and regulations. We may rectify, replenish, or remove incomplete or inaccurate information at any time and at our discretion.

You can delete content directly in the Platform, and you can delete your account at any time from your profile menu (Delete account), on the web and in our mobile app. Your account is deleted immediately and you are signed out. We delete or de-identify the associated Personal Information, including your workspace, files and connected services, within 30 days, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Residual copies may persist in backups and logs for a limited time before they are overwritten.

Certain jurisdictions provide data subjects with statutory rights to their Personal Information. Subject to exemptions provided by law, and with proper identification, you may have the right to take certain actions with respect to your Personal Information, such as:

• Right to verify your Personal Information (to access, delete, change, or update any Personal Information relating to you — for example, if you believe that your Personal Information is incorrect, you may ask to have it corrected or deleted);
• Right to request that we erase Personal Information about you (subject to any other legal obligation that may require us to keep that information);
• Right to object to the processing of your Personal Information where our lawful basis is legitimate interest or direct marketing;
• Right to restrict us from processing Personal Information pertaining to you;
• Right to export Personal Information in a portable format; and
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You may opt out of marketing-related communications at any time by following the unsubscribe instructions contained in any marketing communication we send you.

If you wish to exercise any of these rights, please contact us at compliance@mana.space. When handling your request, we will ask for additional information to confirm your identity (which may include Personal Information). Please note that if you choose not to allow us to process your Personal Information, we may be prevented from providing you with the right to access and use the Platform or Website. These rights are not absolute and may be subject to our own legitimate interests and regulatory requirements.

If you wish to raise a complaint about how we have handled your Personal Information, please contact us directly at compliance@mana.space. If you are not satisfied with our response or believe we are collecting or processing your Personal Information not in accordance with the law, you may elect to file a complaint with the applicable data protection authority.

Our Services may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

Our Services are not directed to children under the age of 13 (or 16 in the European Economic Area and the United Kingdom), and we do not knowingly collect personal information from them. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us. If we discover that a child below the applicable age has provided us with personal information, we will delete it within a reasonable period of time.