Privacy Policy
This Privacy Policy is issued by Manta AI Limited, a company registered in England and Wales under company number 17054231, whose registered office is at Sallets Barn, High Easter Road, Barnston, Dunmow, England, CM6 1ND. The Platform is operated at https://mantaai.co.
Manta AI Limited ("Manta AI", "we", "us", or "our") is committed to protecting the privacy and personal data of everyone who uses our platform and services. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it.
We are the data controller for the personal data described in this Policy. Our registered office is at Sallets Barn, High Easter Road, Barnston, Dunmow, England, CM6 1ND. If you have any questions or wish to exercise your rights, please contact us at privacy@mantaai.co.
This Policy applies to all users of the Manta AI platform accessible at https://mantaai.co, whether you are an individual user or acting on behalf of an organisation. It should be read alongside our Terms and Conditions.
Data Controller: Manta AI Limited
Company Number: 17054231
Registered Office: Sallets Barn, High Easter Road, Barnston, Dunmow, England, CM6 1ND
Place of Registration: England and Wales
Website: https://mantaai.co
Privacy Contact: privacy@mantaai.co
We are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We treat all users as individuals (natural persons) for the purposes of data protection, regardless of whether they are registering as an individual or on behalf of an organisation, and afford all users full rights under UK GDPR accordingly.
We collect and process the following categories of personal data:
3.1 Account and Identity Data
- Full name
- Email address
- Password (stored in encrypted, hashed form — we never store your password in plain text)
- User role within your organisation (e.g. admin, member)
3.2 Organisation Data
When you register, you are asked to provide organisation information. We do not verify whether this represents a formal legal entity. This data is treated as personal data where it relates to or can identify an individual.
- Organisation name
- Billing email address
- Company size (self-reported)
3.3 Billing and Payment Data
All payment processing is handled by Stripe, Inc. Manta AI does not collect, store, or process payment card details. When you complete a payment, you are redirected to Stripe's secure environment.
We do receive and store limited, non-sensitive payment data returned by Stripe for display purposes, including:
- Last four digits of your payment card
- Card type and expiry date
- Billing status and Subscription tier
3.4 Technical and Usage Data
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and features used within the Platform
- Session timestamps and duration
- Authentication tokens (JWT), stored in your browser's local storage
3.5 Project and Target Environment Data
When you use the Platform to run automated tests, we collect and store data associated with that activity, which may include:
- Target environment URL(s) and descriptions
- Instructions provided to the Runner
- Screenshots captured during testing
- Page metadata (titles, structure, content summaries)
- Summaries and outputs generated by the Runner
- Browser logs and cookies observed during the test session
- Login, registration, and payment instructions or credentials you provide to enable testing of a Target Environment, including for OAuth-based authentication described in our Terms and Conditions
This applies whether a test was run using the Cloud Runner or a Local Runner deployed in your own environment: in both cases, the data described in this section is transmitted to our backend and processed as described here. Only the execution of the automated browsing itself takes place within your environment when using the Local Runner.
To generate navigation maps, flows, and bug reports, this data (including screenshots and page content) is processed using OpenAI's API, a third-party AI model provider based in the United States. See Sections 6.1 and 6.4 for further detail on this processing and the associated international data transfer.
This data is collected solely to provide you with test results and reports. It is retained for a period determined by your active Subscription plan, as set out in Section 7. Once the retention period expires, this data is permanently and automatically deleted from our systems.
You are responsible for ensuring that any personal data present within your Target Environment is handled in accordance with applicable data protection law. Where third-party personal data is incidentally captured during testing, you act as the data controller for that data and Manta AI acts as a data processor on your behalf. Please contact us at privacy@mantaai.co if you require a Data Processing Agreement.
Credentials and instructions described above — including login, registration, and payment details you provide to enable testing — are stored in plain text, associated with the relevant Target Environment, and are not encrypted at rest. They may also be included in the content sent to OpenAI as described above. This is different from your own Manta AI account password, which is always stored hashed and salted, as described in Section 9. Because of this, you must only provide credentials and instructions relating to test or staging environments, using test or dummy data, and must not provide real production credentials or payment details — see our Terms and Conditions, Section 7.1, for further detail.
We do not knowingly process special category personal data (as defined under Article 9 UK GDPR — such as health, biometric, or genetic data) through the Platform. Where a Target Environment may incidentally expose special category or other sensitive personal data, we recommend using test or synthetic data in that Target Environment wherever practicable, particularly given that Target Environment content is processed by our AI sub-processor as described in Section 6.1.
3.6 Communications Data
- Any correspondence you send to us, including support requests and feedback
We only use your personal data where we have a lawful basis for doing so. The table below sets out our main processing activities and the lawful basis we rely on under UK GDPR.
| Data Category | Purpose / Lawful Basis |
|---|---|
| Account registration and authentication | Performance of contract — to create and manage your account |
| Providing and operating the Platform | Performance of contract — to deliver the testing service you have subscribed to |
| Processing payments via Stripe | Performance of contract — to manage your Subscription billing |
| Displaying non-sensitive card details | Performance of contract — to show billing information in your account |
| Storing test outputs (screenshots, metadata, logs) | Performance of contract — to deliver test results and reports |
| Processing Target Environment content (screenshots, page metadata, Runner instructions) via OpenAI's API to generate navigation maps, flows, and bug reports | Performance of contract — this AI-powered analysis is the core function of the Service |
| Storing and using login, registration, and payment instructions or credentials you provide to authenticate into and test a Target Environment | Performance of contract — to perform the testing you have instructed |
| Sending transactional emails (account, billing) | Performance of contract / Legitimate interests |
| Analysing usage to improve the Platform | Legitimate interests — to understand how the Platform is used and improve it |
| IP address and device logging | Legitimate interests — security, fraud prevention, and abuse detection |
| Responding to support or legal enquiries | Legitimate interests / Legal obligation |
| Complying with legal and regulatory requirements | Legal obligation |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
We do not permit OpenAI to use data submitted through the Platform to train or improve its models.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention approach is as follows:
- Account data: Retained for the duration of your account and for up to 3 years following account closure, to comply with legal and contractual obligations.
- Billing and payment records: Retained for 7 years in accordance with UK financial and tax record-keeping requirements.
- Test and project data (screenshots, metadata, logs): Retained for a period determined by your Subscription plan, as described below. Once the retention period expires, this data is permanently and automatically deleted. Following account closure, any remaining test data is deleted within 90 days. Independently of this retention period, OpenAI may retain data submitted via its API for up to 30 days for abuse-monitoring purposes, as described in Section 6.1. Login, registration, and payment instructions or credentials associated with a Target Environment follow the same retention period as other test and project data for that Target Environment, and are deleted on the same schedule.
- Analytics data: Retained in accordance with Google Analytics default retention settings (typically 26 months).
- Support and communications: Retained for up to 3 years following the closure of the enquiry.
The retention period for test and target environment data varies by Subscription plan as follows:
| Subscription Plan | Test Data Retention Period |
|---|---|
| Trial Period (legacy) | 7 days |
| Free Tier | 7 days |
| Starter | 30 days |
| Pro | 90 days |
| Enterprise | Custom —– subject to individual agreement |
The retention period applicable to your plan is displayed in your account settings and on the Pricing Page at https://mantaai.co. If your Subscription is downgraded, the shorter retention period of your new plan will apply from the date the downgrade takes effect, and data outside that window will be scheduled for deletion. The same approach applies when a Trial Period (legacy) account transitions to the Free Tier: the Free Tier retention period will apply from the date of transition.
When data is no longer required, it is securely and permanently deleted. You may also request early deletion of your data at any time (see Section 8).
As a data subject, you have the following rights under the UK GDPR and Data Protection Act 2018. We will respond to all valid requests within one calendar month.
- Right of access: You may request a copy of the personal data we hold about you (a Subject Access Request).
- Right to rectification: You may request that we correct any inaccurate or incomplete personal data.
- Right to erasure: You may request that we delete your personal data, subject to certain legal exceptions (e.g. where we are required to retain it by law).
- Right to restriction: You may ask us to restrict the processing of your data in certain circumstances, for example while a dispute is being resolved.
- Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
- Right to object: You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Right to withdraw consent: Where processing is based on consent (e.g. analytics cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk or by calling 0303 123 1113.
To exercise any of these rights, please contact us at privacy@mantaai.co. We may ask you to verify your identity before processing your request.
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These measures include:
- Encryption of data in transit using TLS (HTTPS)
- Hashed and salted storage of passwords — plaintext passwords are never stored (this applies to your own Manta AI account password; it does not apply to Target Environment credentials and instructions you provide for testing, which are stored in plain text, as described in Section 3.5)
- JWT-based authentication with secure token handling
- Access controls limiting data access to authorised personnel only
- Regular review of security practices and infrastructure
No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO as required by law.
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data without appropriate consent, please contact us at privacy@mantaai.co and we will take steps to delete that information promptly.
The Platform may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party sites or services you visit or use. Manta AI is not responsible for the privacy practices or content of third-party services.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. We will notify you of any material changes by updating the "Last updated" date at the top of this document and, where appropriate, by sending a notification to your registered email address.
Continued use of the Platform after any changes take effect constitutes your acknowledgement of the updated Policy. We encourage you to review this Policy periodically. Where a change to this Policy is made alongside a material change to our Terms and Conditions, the termination right described in the Terms, Section 14, applies equally here.
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us. Our full company details are set out in Section 2 above.
Email: privacy@mantaai.co
Website: https://mantaai.co
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) directly:
- Website: https://ico.org.uk
- Phone: 0303 123 1113
This Privacy Policy was last reviewed and updated in August 2026.