Privacy Policy

Manyger LLC ("Manyger," "we," "us," or "our") operates the Manyger platform at getmanyger.com and its associated mobile applications (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect information when you use the Service.

By using Manyger, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Authentication credentials (managed by Firebase Authentication)
• Profile photo (if provided via Google or Apple sign-in)
• Language preference

2.2 Business Information

To provide our services, we collect information about your business:

• Business name, type, and vertical category
• Business address, phone number, and website
• Operating hours and schedule
• Team size and staff member information (name, role, schedule)
• Service catalog (names, prices, durations)
• Revenue and expense data you enter or sync from connected tools
• Customer records (names, phone numbers, visit history, appointment data)

2.3 Customer Data You Manage

You may store your customers' information in Manyger, including names, phone numbers, email addresses, appointment history, and notes. You are responsible for obtaining any necessary consent from your customers before entering their data into Manyger, and for complying with applicable privacy laws regarding that data.

Some of that information reaches us directly from your customer rather than from you. When someone books through your public booking page, they enter their own name, phone number, and, depending on your trade, a service address, photos they choose to attach, and details such as a pet's name and vaccination status or a vehicle's make and model. If you require a card to hold a booking, they enter it into your connected Stripe account, and we keep only a reference to it, its brand and its last four digits. Before an appointment is confirmed we send a one-time code by SMS to check the number is theirs; we store only a hashed form of that code, and it expires ten minutes after it is sent. This information goes into your customer records and is yours, held under the same terms as everything else in Section 6. When we measure the drive to a service address we keep that address's coordinates, so the same journey is not looked up twice; those coordinates are deleted with your account, and sooner if no other business has measured the same address.

2.4 Communications Data

If you use our AI receptionist or messaging features, we process:

• Where you forward your own business number to a Manyger number, we store that forwarding configuration (the method and mode you selected, and a callback number you provide) so the AI can transfer callers to you and so we can tell you how to disable forwarding if you cancel. We never take ownership of your phone number.
• Phone call audio and transcripts (via Twilio, LiveKit, and Soniox). Call audio is processed in real time to power the AI (speech recognition and responses); we store call transcripts and summaries, not audio recordings. Call transcription and monitoring are subject to two-party (all-party) consent laws in the following states: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Vermont, and Washington. You are responsible for ensuring callers are informed that calls may be monitored, transcribed, and handled by AI, as required by applicable law.
• SMS and MMS messages sent and received, including photo attachments (via Twilio). Inbound calls may also be screened for spam using Nomorobo (a Twilio add-on that scores the caller's phone number).
• Social media direct messages, including photos, videos, and voice notes customers send (Instagram, Facebook — via Meta APIs). Inbound images may be automatically screened, and potentially inappropriate images blurred until you choose to view them.
• Lead messages from connected lead platforms (e.g., Thumbtack)
• Email communications (via Brevo)

The AI assistant identifies itself as an automated (AI) assistant at the start of each interaction. A customer-facing AI Assistant Terms & Disclosures notice is available for you to present to your customers.

2.5 Biometric Data

Manyger does not collect, extract, or store biometric identifiers or biometric information as defined by the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), Washington Biometric Identifier law (RCW 19.375), or similar state laws. While our Service processes call audio for transcription and AI responses, we do not create, store, or analyze voiceprints, faceprints, or any other biometric template from this audio. We do not store call audio at all — only text transcripts and summaries.

2.6 Financial Data

If you connect a point-of-sale system or enter financial data, we process:

• Transaction records from point-of-sale, payment, accounting and field-service tools (Square, Stripe, QuickBooks, Workiz)
• Expense, invoice, bill, and quote records from accounting tools (QuickBooks, FreshBooks)
• Receipt images and extracted data
• Revenue figures you enter manually

We do not connect directly to your bank accounts. Manyger does not use Plaid, MX, or any bank-data aggregator.

2.7 Usage Data

We automatically collect:

• Device information (browser type, OS, screen size), and a hashed device identifier derived from it, used only to detect self-referrals in our referral program
• Log data (IP address, access times, pages viewed)
• Feature usage and interaction patterns (via PostHog analytics)
• Error reports (via PostHog error tracking)
• Push notification token identifiers (via Firebase Cloud Messaging)

2.8 Health and Medical Data

Manyger is not a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act (HIPAA). The Service is not built to HIPAA's standards for Protected Health Information (PHI), although for some trades, such as massage and med spas, the AI receptionist asks callers health screening questions (for example about pregnancy, recent surgery or medications) and saves the answers with the booking and the customer's record. If your business is subject to HIPAA (e.g., medical spas, wellness clinics), you must not use Manyger to store, process, or transmit PHI. You are solely responsible for determining whether your use of the Service complies with HIPAA and other healthcare regulations.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Generate AI-powered insights, briefings, and recommendations for your business
• Operate AI features including chat assistant, phone receptionist, and automated messaging
• Process and fulfill appointments, scheduling, and calendar management
• Send SMS reminders, review requests, and rebooking nudges to your customers on your behalf
• Generate marketing content and social media posts
• Process payments and manage your subscription
• Send you service-related notifications (briefings, alerts, system updates)
• Analyze aggregate usage patterns and feature interactions to improve the Service
• Monitor and improve AI quality (each day, up to 15 AI phone-call transcripts per business, including every call on a day with three or fewer, are automatically scored for accuracy; scores are internal-only)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

4.1 AI Provider — No Model Training on Your Data

Manyger uses Google Gemini as its AI model, accessed through Google Cloud (Vertex AI) and Google's Gemini API. The Gemini models we use are served from Google's global endpoint, so an AI request may be processed in a Google Cloud location outside the United States. Google's API Terms of Service state that API data is not used to train their models.

We do not use your business data, your customers' data, or your conversations to train or fine-tune AI models — neither our own nor any third party's. Your data is processed by AI solely to generate outputs for your account. Automated quality scoring of AI phone-call transcripts (Section 3) evaluates the AI's performance; it does not feed model training.

4.2 What AI Processes

Our AI processes your business data to provide:

• Chat responses and business recommendations
• Morning and closing briefings
• Phone call handling and appointment booking
• Instagram and Facebook message classification and replies
• Marketing content
• Financial analysis and scenario modeling
• Customer segmentation and lifecycle management
• Image generation for social media posts (via Ideogram API)
• Competitor insights compiled from publicly available business information (via the Google Places API)

4.3 Human Oversight

Manyger operates on a Draft → Approve → Execute principle. When the AI assistant proposes to message your customers, change a booking, a price or a setting, or publish a post, it waits for your approval, unless you have turned on automatic approval for that kind of action. Simple record-keeping, such as creating a task or adding a note you ask for, noting a preference you mention, or searching the web, happens without a separate approval. The exceptions are the AI receptionist, which operates autonomously on live phone calls and, when you enable them, on Instagram and Facebook direct messages, booking directly into your calendar; and workflow automations, which execute rules you created.

4.4 AI Content Labeling

All AI-generated content is clearly identified in the interface. If you encounter inaccurate AI-generated content, you may report it to support@getmanyger.com.

We do not sell your personal information. We share data with third parties only as necessary to operate the Service:

5.1 Service Providers

To enable phone features, we share your business's city and state with Twilio to find a local voice number. Business texting is sent from Manyger's own carrier-verified texting number; your business's registration details are not filed with carriers or The Campaign Registry.

We will notify you at least 30 days before adding any new sub-processor to this list, giving you the opportunity to object. If you object to a new sub-processor and we cannot reasonably accommodate your objection, you may terminate your account.

5.2 Integrations You Connect

When you connect third-party services (Square, Stripe, QuickBooks, FreshBooks, Workiz, Acuity, Thumbtack, Google Calendar, Google Sheets, Google Business Profile, Meta/Facebook/Instagram), we exchange data with those services using OAuth tokens (or, for Workiz, an API key you enter) that you explicitly authorize. We encrypt all stored tokens using AES-256-GCM. You can disconnect any integration at any time from Settings.

5.3 Aggregated Insights

We may generate anonymized, aggregated industry benchmarks across businesses in the same vertical category and metro area. These insights are never generated from fewer than 20 businesses, never include individually identifiable data, and geography is rounded to the metro level. You can opt out of aggregated insights in Settings. Where we use de-identified or aggregated data, we maintain it in de-identified form and do not attempt to re-identify it, and we require the same of any recipient.

5.4 Legal and Law Enforcement Requests

We may disclose information in response to valid legal process, including:

• Subpoenas: We may produce non-content account information (name, email, IP addresses, account dates) in response to valid civil or criminal subpoenas.
• Court orders: We may produce account information and limited content data as specified by a court order issued under applicable law.
• Search warrants: We will produce account content (messages, call transcripts, business data) only in response to a valid search warrant issued by a court of competent jurisdiction based on probable cause.
• Emergency requests: We may disclose information without legal process if we have a good-faith belief that an emergency involving imminent danger of death or serious physical injury requires immediate disclosure.

Unless prohibited by law or court order, we will notify you of any legal request that seeks your data so that you may challenge it. We will narrowly construe all requests and resist overbroad or vague demands.

5.5 Business Transfers

If Manyger is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice in the Service before your information is subject to a different privacy policy.

5.6 Google API Services — Limited Use

Manyger's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data we access through Google APIs (Google Calendar, Google Drive/Sheets, and Google Business Profile) is used only to provide and improve the user-facing features you explicitly connect them to — calendar and spreadsheet scheduling sync, importing customers from a spreadsheet you choose, and your public listing, so review requests reach the right place. To turn a connected calendar or spreadsheet entry into a usable appointment, we read the entry's title, description/notes, and guest list, and extract the customer's name and, where present, a phone number, so the appointment can be shown on your calendar and the customer can be notified if it is cancelled or moved. This extracted contact information is stored with the appointment in your account and used for no other purpose. We do not sell this data, do not use it for advertising, and do not use it to train generalized AI/ML models. Humans do not read this data except where you give consent, where necessary for security purposes (such as investigating abuse), or where required to comply with applicable law.

5.7 Referral Program

If you sign up through another business's referral link, we tell that business your business name when you sign up and again when you become a paying customer, because that is when their reward is earned, and if that first payment is later refunded or disputed we tell them that too, because the reward is then withdrawn. We do not share your plan, your payment details, or anything else about your account with them. Before you sign up, the referral landing page tells you they will be told when you subscribe.

When you use Manyger to store and manage your customers' personal information, you are the data controller (or "business" under the CCPA) and Manyger is your data processor (or "service provider" under the CCPA). This means:

• You determine the purposes and means of processing your customers' data
• You are responsible for obtaining necessary consents from your customers
• You are responsible for responding to your customers' privacy rights requests
• We process your customers' data only on your instructions and solely to provide the Service
• We do not sell, share, or use your customers' data for our own purposes
• We will assist you in responding to data subject requests upon written request

If you require a formal Data Processing Agreement (DPA), contact us at support@getmanyger.com.

We use the following cookies and similar technologies:

• Essential cookies: Firebase authentication session tokens, locale preferences. These are required for the Service to function and cannot be disabled.
• Analytics: PostHog uses first-party cookies to track product usage events. You can turn PostHog off by enabling Global Privacy Control (GPC) in your browser; a subscription start is still recorded from our servers. Vercel Web Analytics and Speed Insights count page views and measure page speed without cookies, whether or not GPC is on.
• Referral cookie: If you open a referral link (getmanyger.com/r/...), we set one first-party cookie holding the referring business's code. It lasts 30 days, is used only to connect a signup you complete in that time to the business that referred you, and is not used for advertising. If you do not sign up, it expires and nothing is recorded.

We do not use third-party advertising cookies. We do not participate in cross-site tracking or behavioral advertising networks.

We implement industry-standard security measures including:

• All data transmitted over HTTPS/TLS
• Integration tokens encrypted at rest using AES-256-GCM
• Firebase security rules enforcing deny-all default with member-scoped access
• Role-based access control (owner, manager, staff) with principle of least privilege
• Rate limiting on public booking, AI and other sensitive API endpoints
• HMAC-signed OAuth state parameters with CSRF nonce and 10-minute expiry
• Timing-safe secret comparison for webhook signature verification
• Twilio signature verification on all SMS and voice webhooks

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8.1 Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users via email and in-app notification within 72 hours of becoming aware of the breach, as required by applicable law. We will also notify relevant regulatory authorities where required.

• Account data: Retained while your account exists, including while it is frozen. Upon account deletion, your account, business and customer records and uploaded files are deleted from our live systems at once and from our database backups within 14 weeks. Billing and fraud-prevention records, such as the hashed device identifier in Section 2.7, are kept, and records our service providers hold, such as message logs, follow their own retention periods. We recommend exporting your data before requesting deletion.
• Business and customer data: Retained while your account exists, including while it is frozen. You may export your business profile, customers, appointments, services, staff, reviews, revenue and expenses at any time from Settings. Deletion is permanent, and deleted data leaves our database backups within 14 weeks. If your account remains closed or frozen for 12 continuous months, we may permanently delete your account data after emailing you at least 30 days' notice.
• Call transcripts and summaries: Retained while your account exists. We do not store call audio recordings. Temporary call-session data (such as the caller's number held during a live call) is deleted when the call ends.
• Chat conversation history: Retained while your account exists, unless you delete a conversation.
• Billing records: Retained as required by applicable tax and financial regulations.
• Undo log: Snapshots of actions the chat assistant took can be used to undo them for 24 hours; they are kept with your account data until you undo the action or delete your account.
• Analytics data: Usage events are retained in PostHog per their retention policy.

10.1 All Users

You have the right to:

• Access and export your data
• Correct inaccurate information
• Delete your account and associated data
• Disconnect any third-party integration
• Opt out of aggregated platform insights
• Opt out of non-essential communications

10.2 Universal Opt-Out Signals

We recognize and honor the Global Privacy Control (GPC) signal as a valid opt-out preference signal. If your browser or device sends a GPC signal, we will treat it as a request to opt out of the sale or sharing of personal information, as required by applicable state laws including the CCPA/CPRA, Colorado Privacy Act, Connecticut Data Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, Montana Consumer Data Privacy Act, Delaware Personal Data Privacy Act, Minnesota Consumer Data Privacy Act, New Jersey Data Privacy Act, and Nebraska Data Privacy Act.

10.3 California Residents (CCPA / CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You can request what personal information we collect, use, disclose, and sell.
• Right to Delete: You can request deletion of your personal information.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. There is nothing to opt out of.
• Right to Limit Use of Sensitive Information: We use sensitive personal information (financial data, precise geolocation) only as strictly necessary to provide the Service and for no secondary purpose.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, quality, or service levels.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

To exercise your rights, contact us at support@getmanyger.com. We will verify your identity before processing requests and respond within 45 days.

You may designate an authorized agent to submit requests on your behalf. Authorized agents must provide written proof of authorization.

10.4 Additional US State Privacy Rights

If you reside in any of the following states, you may have additional privacy rights under your state's consumer data privacy law:

• Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Iowa, Tennessee: Right to access, correct, delete, and obtain a copy of your personal data. Right to opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.
• Texas (TDPSA), Oregon (OCPA), Montana (MCDPA): Same rights as above, plus right to opt out of the processing of personal data for profiling. We honor universal opt-out signals (GPC) as a valid opt-out mechanism.
• Delaware (DPDPA), New Jersey (NJDPA), New Hampshire, Nebraska: Right to access, correct, delete, and data portability. Right to opt out of targeted advertising, sale of personal data, and profiling.
• Minnesota (MCDPA): All rights above, plus the right to question the result of an automated decision, including profiling, and to be informed of the reason for any AI-driven decision that produces legal or similarly significant effects on you.
• Maryland (MODPA): Right to access, correct, delete, and restrict processing. We process sensitive personal information only when strictly necessary to provide the Service as requested by you — not for advertising, profiling, or secondary purposes.

To exercise rights under any state law, contact us at support@getmanyger.com. We will respond within the timeframe required by your state's law (typically 45 days, extendable by an additional 45 days with notice). If we deny your request, you have the right to appeal — we will provide instructions with any denial.

10.5 SMS and Phone Communications

Manyger sends SMS messages to your customers on your behalf. These messages are sent only with proper consent, and consent is scoped to the kind of message:

• Service messages — such as an appointment confirmation, a reminder, a change to a booking, a no-show follow-up, an order update, and a single post-visit note asking how a visit went. These go to the customer who gave the business their number for that appointment, they name that specific visit, and they carry no offer. Every one carries STOP
• Call follow-ups: one text to a number that has just called the business: the business's booking link after a call that ended before anyone could help, or a note that the AI passed on the caller's message. These ask for nothing, carry no offer, and carry STOP
• Marketing messages — rebooking nudges, win-back messages and any bulk send. These require a separate, explicit opt-in that is never required to use Manyger, to purchase, or to receive any service, and is never bundled with acceptance of our Terms or any other agreement
• Email allows communication unless the customer has opted out, and carries an unsubscribe link
• Reminders, review requests, rebooking nudges and other scheduled messages respect quiet hours (timezone-aware); a message about something happening now, such as a booking confirmation, a verification code, a missed-call text or a change to an appointment, is sent immediately
• Customers can reply STOP to any SMS to opt out immediately

10.6 Meta Platform Data

If you connect your Facebook or Instagram account to Manyger, we process data from those platforms in accordance with Meta's Platform Terms. You may request deletion of your Meta-sourced data at any time by contacting us at support@getmanyger.com. Disconnecting the integration in Settings deletes our access tokens at once and stops new data arriving, but keeps the messages already received. A deletion request — by email, or by removing Manyger from your Facebook settings — also deletes those messages, our replies, any photos or voice notes sent with them, and the Instagram or Facebook account identifier we had stored on a customer record. Your own records stay: your customers, and any appointment booked through a message. We complete a deletion request within 30 days, except where retention is required by law.

Manyger is designed for business owners and operators. The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected information from a child under 16, we will delete it promptly.

Manyger is operated from the United States, and our primary database is stored in the United States (Google Cloud Firestore, US multi-region). AI requests may be processed outside the United States (see section 4.1), and some of our service providers may process data in other countries. By using the Service, you consent to the transfer and processing of your information in the United States and in the other countries where we and our service providers operate.

We may update this Privacy Policy from time to time. For material changes, we will notify you by sending an email to the address associated with your account and posting a notice in the Service at least 30 days before the changes take effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, contact us at:

• Email: support@getmanyger.com
• Website: getmanyger.com