MANTI, INC. PRIVACY POLICY

Last Updated: Monday, October 26, 2026

This Privacy Policy describes how Manti, Inc. ("Manti," "we," "us," or "our"), a Delaware corporation, collects, uses, discloses, and protects your information when you use our robotics engineering design platform, website, desktop application, and the Manti MCP (collectively, the "Platform").

The Platform consists of (a) Manti Web, our website and account site at app.mantiai.com, where you sign in, manage your plan, and view your Manti MCP projects; (b) Manti Desktop, a downloadable desktop application in which a bundled AI agent works with you inside a local project workspace; (c) the Manti MCP, a remote service that an AI assistant you choose, such as Claude Code, Claude, or Codex, connects to on your behalf, which runs Manti's engineering engines and keeps your Manti MCP projects in Manti's cloud; and (d) cloud-based services that support them. Different features within the Platform process data in different ways, as described in this Privacy Policy.

In this Privacy Policy, the "Free trial" and the "Plus," "Max," and "Enterprise" tiers mean the free trial and the subscription plans described in our Terms of Service.

By using the Platform, you consent to the collection, use, and disclosure of your information as described here. If you do not agree, do not use the Platform.

1. INFORMATION WE COLLECT

1.1 Information You Provide

We collect information you provide directly, including:

Account Information: name, email address, and password. Passwords are handled by our sign-in provider, Google Firebase Authentication. If you sign in with Google, we receive your name and email address from Google. When you create an account, we record which versions of our Terms of Service and this Privacy Policy you accepted, when you accepted them, and the IP address you accepted them from.

Payment Information: our payment processor (Stripe) collects your payment card information, billing address, and related financial information. We do not directly store your full payment card number.

Chat Content: if you used the chat formerly offered in Manti Web or in earlier versions of Manti Desktop, the messages, prompts, and content you submitted were transmitted to and stored on Manti's servers. Manti Desktop no longer has a separate chat tab; your conversation with the agent inside a project is described in Section 1.2.

Voice Input: if you use dictation (voice input) in the message box in Manti Desktop, then unless you choose to transcribe on your computer (Section 1.8), your audio is transmitted to Manti's cloud services and transcribed using speech-to-text processing on our cloud infrastructure (Google Cloud Platform). The transcript text is then tidied by an AI model on the same infrastructure before it appears in the message box. The resulting transcript becomes part of your message to the agent and is handled as described in Section 1.2. Manti's servers use the audio only to produce the words and do not retain it beyond what is needed to complete transcription. We do not use audio to train AI models. We do not create voiceprints, and we do not use your voice to identify you or anyone else.

Content You Send to the Manti MCP: the requests, files, and projects you or your AI assistant send to the Manti MCP, as described in Section 1.5.

Communications: when you contact us for support, the content of your messages and any information you provide.

Feedback: any suggestions, comments, or feedback you provide about the Platform.

1.2 Information from Manti Desktop's Project Workspace

When you use the project tab in Manti Desktop, the bundled AI agent runs on your device. Your project files are created and stored on your own disk, where you retain direct access to them.

On the Plus and Max tiers, Manti collects certain project workspace data from your device, including: agent session records (conversations sent to the model, the model's responses, tool calls and their results, terminal commands and output, images shown to the model, recordings and sketches you send to the agent (Section 1.8), and error and crash information); files in the project folder that the agent or you create or change while the project is open in Manti Desktop, including the notes the agent keeps in the project about your preferences, which quote what you told it, and their version history; engineering artifacts such as simulation results, CAD parts, and firmware outputs; and the contents of the project's .manti folder, which holds the agent's working state: its conversation and task databases, its local memory database, logs, the local audit log, files you attached, and a project settings file that includes the project's name and your computer's name.

Manti Desktop keeps a record on your device of each object it has uploaded, which you can see in Settings → Privacy for the projects you have open. That record does not include the copies of AI model calls that Manti's relay keeps as they pass through it. To ask for a copy of the project workspace data and model-call records Manti holds about you, write to privacy@mantiai.com.

Before transmission, Manti removes credentials and secrets that match known credential formats (such as API keys and tokens) from the project workspace data it collects, including project files and agent session records, and does not transmit files with names commonly used for secrets (such as .env files, private-key files, and credential files). Manti cannot remove a credential shown inside an image, or one in a format it does not recognize. Do not keep credentials in project files.

On the Enterprise tier, no project workspace content is collected (see Section 1.7). The Free trial does not include Manti Desktop. For all accounts, each AI model call that Manti Desktop relays through Manti's services carries an internal project identifier, a conversation identifier, and the role of the agent making the call. Manti keeps these with its usage and billing records. They do not include your project's name or its contents. On the Plus and Max tiers, the project's name and your computer's name are part of the project workspace data collected as described above; where your computer's name identifies you (for example, "Jane's MacBook"), we treat it as personal information.

AI model calls made by the agent are relayed through Manti's services for routing and billing and then sent to the upstream AI model providers Manti has configured.

When inference calls leave your device, the prompts and content you provide are received by the upstream AI provider and are then governed by that provider's own terms of service and privacy policy, which may differ from this Privacy Policy. The upstream AI model providers Manti uses or may use are listed in Section 3.1 and in our Sub-processor List.

1.3 Information We Collect Automatically

Usage Information: information about how you use the Platform, including the features you use, actions you take, time spent on the Platform, and your interactions with the Platform's AI systems on the cloud-served surfaces. For the Manti MCP, this includes events such as connecting an AI assistant to your account and completing your first engine job.

Device Information: device type, operating system, browser type, unique device identifiers, IP address, and (for the desktop application) version information.

Log Information: server logs that record information about your use of the Platform, including access times, pages viewed, and referring URLs.

Note on Manti Desktop telemetry: in addition to the project workspace collection described in Section 1.2, Manti Desktop sends Manti a limited set of product usage events tied to your account, such as signing in, the local agent becoming ready, and a task starting or finishing, together with the application version and your operating system. These events do not include your prompts, project content, or file names. Crash and error reports, including your operating system's crash reports for Manti Desktop, are sent only if you turn them on in Manti Desktop's privacy settings. Manti Desktop does not transmit third-party usage analytics or advertising identifiers.

Website analytics: on our public marketing pages we measure traffic ourselves, in aggregate, without third-party analytics services. Each page view records the page visited, the referring site, your operating system family, and an approximate location. For this traffic measurement your IP address is read once, in memory, and is not stored: we use it to count same-day unique visitors through a one-way hash that changes every day, to look up an approximate location in a geolocation database we host on our own servers, and to recognize visits from our own staff network so we can exclude them from our traffic figures. From that lookup we store your country and city, and a coordinate that the geolocation database gives for the network your connection belongs to, rounded to roughly one kilometer. That coordinate is a property of a network, not of you: it is shared by everyone connecting through the same network, it is not your address, and it is typically accurate only to the neighborhood or city. We also record how long a page was visible, so we can tell which pages people read. These traffic counts cannot be linked across days or to any person. The website usage analytics described in the next paragraph can be linked to your account.

Website usage analytics and session recordings: to find errors, improve signup and onboarding, and understand demand, we also measure how people use our public website, the signup journey, and selected signed-in pages (such as the account, billing, download, and onboarding pages). We record page and section views, clicks and taps, scroll depth, video progress, errors, and signup and free trial steps and their outcomes, together with your approximate country, device type, the site version, and the site that referred you. We measure how long a page was open and visible and estimate active time from recent interaction; these measurements do not show what anyone read, understood, or intended. We set a first-party cookie containing a random identifier so that we can connect visits from the same browser; it lasts up to 395 days. When you sign in, we link that browser's activity, including activity from before you signed in, to your account. We may also record a masked reconstruction of your visit to these pages, including sampled pointer movement: page text and everything you type are masked in your browser before anything is sent, payment forms are not recorded, and a recording can have gaps and is not a video of your screen. We keep structured analytics for up to 395 days and delete recordings and pointer data after 90 days. Recordings are stored in a private Google Cloud Storage bucket and the analytics in our database, both controlled by Manti; access is limited to authorized Manti staff and is logged. We do not share these recordings or this usage analytics with third-party analytics or advertising services. For Enterprise tier accounts, we do not link this analytics or these recordings to the account, and collection stops once the account signs in. Deleting your account deletes the analytics and recordings linked to it. We do not run this website usage analytics or these recordings on Manti MCP pages, such as your project pages, shared project pages, and the page for connecting an AI assistant. If your browser sends a Global Privacy Control signal, we do not collect this website usage analytics or these recordings from that browser.

Advertising cookies and pixels: on our public marketing pages we use the Meta Pixel, provided by Meta Platforms, Inc. (Facebook and Instagram), to measure our advertising and to show Manti ads to people who have visited our website. When it runs, the pixel sends Meta the page you visited, the site that referred you, your device and browser information, your IP address, and a Meta cookie or advertising identifier. We may also send Meta the same kinds of events from our servers rather than from your browser, subject to the same opt-out. We do not share your email address, hashed or otherwise, with advertising partners. The pixel is not used on the signed-in pages of Manti Web, on Manti MCP pages, or in Manti Desktop. You can turn it off for your browser at any time through the "Do Not Sell or Share My Personal Information" link in the footer of our website, which opens mantiai.com/privacy-choices, and we also turn it off when your browser sends a Global Privacy Control signal (Sections 7.7 and 8).

Approximate location when Manti Desktop talks to our servers: when Manti Desktop relays an AI model call through Manti's services (from the project workspace, as described in Section 1.2), we see the network address the call connects from. We read that address once, in memory, to look up an approximate location in the same geolocation database we host on our own servers, and we do not store the address itself; no third party receives it. From that lookup we keep your country, your approximate city, and a coordinate that the geolocation database gives for the network your connection belongs to, rounded to roughly one kilometer, together with a one-way hash of the address that changes every day and from which the address cannot be recovered. We keep this information tied to your account for up to thirteen (13) months and then delete it. We use it to understand how the Platform is used and to detect account sharing, which our Terms of Service prohibit. That coordinate is a property of a network, not of you: it is shared by everyone connecting through the same network, it is not your address, and it is typically accurate only to the neighborhood or city. The country and city we infer can be wrong, and if you connect through a VPN or a corporate network the location will be that network's, not yours.

Country for the Free trial: the Free trial is available only in the United States. To apply that rule, we determine your country from your billing details and, if we have none, from the country you gave at sign-up and the network address you signed up from. We do not use the address your AI assistant connects from.

1.4 Information from Third Parties

We may receive information about you from third parties, such as our payment processor (Stripe), to facilitate billing and prevent fraud, and Google, if you sign in with Google.

When you use the Manti MCP, we receive what your AI assistant sends to Manti's tools on your behalf. The assistant is operated by its provider, such as Anthropic or OpenAI. See Section 1.5.

1.5 Information from the Manti MCP

When you connect an AI assistant to the Manti MCP, Manti receives only what your assistant sends to Manti's tools. We do not receive the rest of your conversation with your assistant. Manti's servers do not call AI models to process your Manti MCP requests.

What we receive and keep:

Tool requests: the instructions and data your assistant sends to Manti's tools. These can include engineering commands, part numbers, file contents, project names and descriptions, and any text your assistant writes into a request, such as a short note describing a change (we keep the first 200 characters of that note on your project's History page).

Files you upload: for example, KiCad, Eagle, or Altium boards, STEP models, and component files your assistant obtained from a component vendor, within the upload size limits shown in your account.

Your MCP projects: the files, revisions and versions, engine job results, exports, viewer data, and preview images that Manti's engines produce from your requests.

Sign-in and connection information: your account identifier and email address, the name and web address of the AI assistant app you connected (for example, Claude Code), and a record of each connection you approve. The access tokens that let that app act for your account are stored only as one-way digests, not in readable form.

Usage records: for each request, download, and engine job, which tool ran, when, for how long, its outcome, the data size, the project, the name of the Manti skill or file involved, and the engine time used; and, for each day, your account's total engine time and number of tool requests. We use these to measure usage and storage, enforce your plan, and fix problems. We keep diagnostic records of failed engine jobs so that we can fix them.

Skill and session records: which of Manti's skills your assistant read; requests we declined because a required skill had not been read; and a signal your assistant's app sends, through the Manti plugin's hooks, when a session starts or its context is compacted or cleared. These records let Manti re-supply its working instructions to your assistant and enforce our Terms of Service.

Technical information: the IP address and user agent of each request, which our cloud provider's load-balancer logs record. Our own service keeps a log line for every failed request and for one in a hundred successful requests. Each line records the kind of request, its result and duration, and a one-way code derived from your account identifier, but not the request content.

Where it is kept: we store Manti MCP data in Manti's cloud on Google Cloud Platform in the United States (the us-central1 region), on the persistent disks of Manti's worker servers, where each account's files are kept in a directory no other account can enter, with daily disk snapshots kept as backups in the same region.

1.6 Files the Manti MCP Setup Places on Your Computer

If you install the Manti plugin for Claude Code, which is served from app.mantiai.com, it adds a short pointer skill and session-start hooks to Claude Code on your computer. If you set up Codex, your assistant writes a pointer skill to ~/.agents/skills/manti/SKILL.md, adds a group to ~/.codex/hooks.json, and adds a block to ~/.codex/AGENTS.md. When you connect a folder to a Manti project, your assistant writes a .manti/projects.yaml file in that folder. These files contain no Manti skill text and none of your project data. The hooks tell your assistant app to call Manti's tools when a session starts or its context is compacted or cleared, which sends the session signal described in Section 1.5. You can remove these files at any time.

1.7 Enterprise Accounts

Enterprise tier accounts can use both Manti Desktop and the Manti MCP. We recommend Manti Desktop for your most sensitive work, because its project files stay on your own computers. The Manti MCP stores your projects on Manti's cloud servers. You may use either.

Manti Desktop: Manti does not collect or keep project content created or stored on your device through Manti Desktop's project workspace, and does not use it for training. That content leaves your device only as needed to provide a feature you use: AI model calls made by the agent pass through Manti's relay to the model provider and are not retained by Manti (Manti keeps only the identifiers described in Section 1.2 with its usage and billing records); dictation and recordings are transcribed in Manti's cloud unless you choose to transcribe on your computer, and the audio is not kept (Sections 1.1, 1.8); and the agent's requests to the third-party services described in Section 3.11 go directly to those services. Part numbers the agent looks up are sent to Manti only to retrieve supplier information, and nothing from those lookups is added to the shared parts catalog (Section 3.9).

Your Content on Manti's cloud servers, including your Manti MCP projects: for Enterprise tier accounts, this content is never used to train our AI models and is never added to the shared parts catalog. It is treated as confidential. It is stored on Manti's cloud servers in the United States, separated from other accounts, and encrypted in transit and at rest. Manti personnel do not access it except as needed to provide the service or as required by law. We delete it from our active systems within ninety (90) days after your Enterprise subscription ends, subject to standard backup retention with deletion in the ordinary course.

1.8 Recordings and Sketches in Manti Desktop

In Manti Desktop you can draw sketches on the screen and make recordings to show the agent what you mean. A sketch is added to your message as an image. A recording captures a video of the Manti window only (not your camera or the rest of your screen), the position of your pointer over time, and what you say into your microphone.

Your speech is turned into a text transcript with timestamps, either in Manti's cloud using Google Cloud Speech-to-Text or on your computer, depending on your settings. Transcribing on your computer uses a speech model that you download once from Hugging Face. The audio is deleted as soon as it is transcribed and is never stored by Manti. The video, pointer data, and transcript are kept on your computer.

Nothing from a recording or sketch is sent to Manti until you send it to the agent. When you send it, it goes to the agent like any other message, passing through Manti to the AI model provider. On the Plus and Max tiers, recordings and sketches you send, including the screen video, pointer data, and transcript, are collected as project workspace data (Section 1.2) and may be used to train and improve our AI models (Section 2.2). On the Enterprise tier, they are not collected.

If you believe a recording made with Manti captured you without your consent, contact privacy@mantiai.com and we will delete our copy.

2. HOW WE USE YOUR INFORMATION

2.1 To Provide and Operate the Platform

To create and manage your account, process transactions, provide customer support, and deliver the services you request.

For the Manti MCP, this includes running Manti's engines on your projects; storing, rendering, and versioning your projects; producing exports, files, and links; showing your projects on your project pages; returning results to your AI assistant; measuring and enforcing usage, storage, and plan limits; and checking trial eligibility, including that the Free trial is used once per person, with a verified email address, in the United States.

2.2 To Train and Improve Our AI Models

IMPORTANT:

If you are using the Free trial or are subscribed to the Plus or Max tier, we may use the prompts and other content you submit to the AI agent in Manti Desktop, chat content you submitted through the chat formerly offered in Manti Web or Manti Desktop, and any other content you explicitly submit to Manti's cloud services (excluding personal information such as your name and email address, and except Manti MCP content, which is covered below), to train, fine-tune, test, evaluate, and improve our AI models, and to develop and improve our services.

On the Plus and Max tiers, we may also use project workspace data collected as described in Section 1.2, including project files, agent session records, recordings and sketches you send to the agent (Section 1.8), and related artifacts, to diagnose and fix defects, improve the Platform, and train our AI models. Project workspace content is not collected from Enterprise tier accounts.

The AI models described in this Section include large language models. We exclude account information such as your name and email address, but personal information that appears inside the content you submit may be included.

Manti MCP: if you are on the Free trial or the Plus or Max tier, we may use the requests your AI assistant sends to the Manti MCP, the files you upload, and your Manti MCP projects (excluding your name and email address) to train, fine-tune, test, evaluate, and improve our AI models, including large language models. This applies to content you send to the Manti MCP after you accept our updated Terms of Service and this Privacy Policy; content sent before then is not used for training. Manti MCP content from Enterprise tier accounts is never used for training.

Enterprise Tier: if you are subscribed to the Enterprise tier, we will not use Your Content or outputs to train our AI models, whether you use Manti Desktop or the Manti MCP. Your Content is used solely to provide the Platform services to you, as described in Section 1.7.

2.3 To Improve and Develop the Platform

We use information to understand how users interact with the Platform, identify areas for improvement, develop new features, and enhance the overall user experience.

2.4 To Communicate With You

We use your contact information to send service-related communications, respond to inquiries, and provide customer support. Service-related communications include emails about your plan, your trial, and payments, and reminders before your Manti MCP projects are deleted (Section 4.6). We may also send promotional communications, from which you can opt out at any time.

2.5 To Protect and Secure

To protect the security and integrity of the Platform, detect and prevent fraud, enforce our Terms of Service, and comply with legal obligations.

For the Manti MCP, this includes marking each copy of a Manti skill we send to your assistant with your email address and an invisible code tied to your account, so that we can identify the account if Manti's skill text is copied or redistributed; recording skill reads and session signals; and enforcing the one-trial-per-person rule.

2.6 To Market Manti

We use information about how people find and use our website, and contact information for people who have signed up, to send offers and updates about Manti, from which you can opt out as described in Section 6.3, and to measure and target our advertising as described in Sections 1.3 and 3.5, from which you can opt out as described in Section 7.7.

3. HOW WE SHARE YOUR INFORMATION

3.1 Service Providers (Sub-processors)

We engage third-party service providers ("sub-processors") to support the Platform. Different sub-processors are engaged for different surfaces of the Platform:

Common to all features: Google (Firebase Authentication for sign-in, and Google Workspace for the email we send you), Stripe (payment processing), Resend (transactional email).

Chat formerly offered in Manti Web and in earlier versions of Manti Desktop: Google Cloud Platform (infrastructure hosting and database services) and the upstream AI model providers in use at the time.

Manti Desktop project workspace: AI model calls are relayed through Manti's infrastructure on Google Cloud Platform and sent to an upstream AI model provider. The upstream AI model providers that Manti uses or may use are Anthropic, Google (Gemini), OpenAI, xAI (Grok), Fireworks AI, Novita AI, and OpenRouter. Manti may add or change providers; every provider is named in the Sub-processor List before it is used. Google Cloud Platform also hosts project workspace data collected from Free trial, Plus, and Max accounts, and provides speech-to-text processing for dictation (Section 1.1).

Manti MCP: Google Cloud Platform (hosting, Manti MCP project storage, backups, and logs). The Manti MCP does not send your requests or projects to any AI model provider. Your AI assistant's provider is not our sub-processor; see Section 3.7.

Manti is solely responsible for selecting and routing among upstream model providers. Users do not select specific upstream providers. The list of upstream providers may change from time to time without notice; the current list is available in our Sub-processor List at mantiai.com/subprocessors.

A current list of sub-processors is available at mantiai.com/subprocessors. We will update this list as sub-processors change.

3.2 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.

3.3 Business Transfers

If Manti is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction.

3.4 With Your Consent

We may share your information with third parties when you have given us consent to do so.

3.5 Advertising Partners

We share limited website activity from our public marketing pages with Meta Platforms, Inc. (Facebook and Instagram) through the Meta Pixel, and may send Meta the same kinds of events from our servers, so that we can measure our advertising and show Manti ads to people who have visited our website. Section 1.3 describes what Meta receives. Meta uses this information under its own data policy, including to improve its own advertising services. We do not share your email address, hashed or otherwise, with Meta or any other advertising partner, and we do not share anything from the signed-in Platform, Manti Desktop, or the Manti MCP. You can opt out at any time as described in Sections 7.7 and 8.

3.6 We Do Not Sell Your Personal Information for Money

We do not sell your personal information in exchange for money. We do share limited website activity with Meta for cross-context behavioral advertising, as described in Sections 1.3 and 3.5. Under the CCPA this counts as "sharing," and you can opt out at any time as described in Sections 7.7 and 8.

3.7 Your AI Assistant's Provider

When you use the Manti MCP, results from Manti's tools are returned to the AI assistant you connected and are received by its provider (for example, Anthropic or OpenAI). These results include your project data and the text of Manti's skills, which carries your email address (Section 2.5). You direct this disclosure by connecting your assistant to Manti and asking it to use Manti's tools. Your provider's terms and privacy policy govern what it does with that content, including how long it keeps it and whether it uses it to train its own models, which may depend on your settings with that provider. Manti does not control your AI assistant or its provider.

3.8 People You Share With

You can create a share link to a part, a board, or a whole Manti MCP project. Anyone who has a share link can open a page showing that content, including its viewers and preview images, without an account, until the link expires (after the 1, 7, or 30 days you chose when you made it; 30 by default), until you revoke it, or until your own access to the project ends. A share page's view address carries your internal Manti account identifier (not your name or email address). Links can be forwarded, so share them only with people you trust.

Links that Manti gives you or your assistant to view or download a file are signed and expire: view links after 60 minutes and download links after 15 minutes. Until a link expires, anyone who has it can use it.

3.9 Other Manti Users: The Shared Parts Catalog

When one of your Manti MCP jobs converts a component file you uploaded into a footprint land (the copper pattern a component is soldered to), Manti adds that land to a shared parts catalog that other Manti MCP users' jobs can use. We record your contribution only under a one-way keyed code, not under your name, your account, or your project. Other users see a catalog entry marked "supplied by N account(s), unverified." Lands are contributed from accounts on the Free trial and the Plus and Max tiers, and never from Enterprise tier accounts.

Manti Desktop. On the Plus and Max tiers, when the agent in Manti Desktop looks up a component by its LCSC part number through its JLC parts tool, the application asks Manti's parts catalog for that part, sending the part number with your sign-in token. If the catalog does not hold a current copy, the application retrieves the supplier's listing, datasheet, footprint, and 3D model directly from the supplier (Section 3.10), and then adds that listing and those files to the shared parts catalog so that other users' lookups can use them; the catalog entry does not name you or your project. We keep a daily count of contributions per account, and our ordinary request logs. On the Enterprise tier, the part numbers the agent looks up are sent to Manti only to retrieve supplier information, and nothing from those lookups is added to the shared parts catalog. Manti Desktop does not add footprint lands made from your own uploaded component files to the catalog.

To ask us to remove an entry from the shared parts catalog, contact support@mantiai.com.

3.10 Component Vendors and Manufacturers

To read component listings (part, package, stock, and price), datasheets, footprints, and 3D models, Manti retrieves them from an approved list of component manufacturers' and distributors' websites. For the Manti MCP, Manti's servers make those requests, and Manti's proxy records which site was reached and how many bytes, to meter your plan. In Manti Desktop, the application on your computer makes them, so those websites receive your network address, as they would if you visited them in a browser. In both cases the requests name the component, not your account or your project.

Manti does not place manufacturing orders and does not send your files to manufacturers. If you send an export from Manti, such as manufacturing files, to a manufacturer (for example, JLCPCB), that manufacturer's own terms and privacy policy govern what you send it.

3.11 Services Manti Desktop Contacts from Your Device

Manti Desktop and its bundled agent also connect directly from your device to third-party services, which receive your network address and the request itself, and which are governed by their own terms and privacy policies: (a) component suppliers' and manufacturers' websites, when the agent looks up a part or a datasheet (Section 3.10); (b) web search services and the web pages the agent reads, when the agent searches the web for you; (c) GitHub and a standard-parts library (step.parts), when the agent downloads a component library or a standard part model; and (d) the source hosts of a few engineering tools that are built on your computer when you install them (today, one: MIT's XFOIL archive); the other tools in the catalog are downloaded from Manti. Manti does not send your account information to these services. These connections are made from your computer, not through Manti's servers. Manti Desktop also connects to Hugging Face when you choose to download the speech model that transcribes on your computer (Section 1.8).

4. DATA RETENTION

The table below summarizes how long we keep each category of information. The sections that follow give the detail. Where no fixed period is given, we keep information only as long as needed for the purposes described in Section 2, including providing the Platform, keeping it secure, preventing fraud, and enforcing our agreements, and then delete or de-identify it.

4.1 Chat Content (the chat formerly offered in Manti Web and Manti Desktop)

Chat content from those surfaces that is still stored on Manti's servers is retained per tier-specific rules:

Free trial, Plus, and Max tiers: chat content may be retained for as long as necessary to fulfill the purposes described in this Privacy Policy, including AI model training and improvement, even after you delete the conversation or close your account. Personal information (such as name and email) is not retained for training purposes.

Enterprise tier: chat content is retained while your subscription is active. On termination, we will delete chat content from our active systems within ninety (90) days, subject to standard backup retention with deletion in the ordinary course.

4.2 Project Content (Manti Desktop Project Workspace)

Project files, agent transcripts, local audit logs, and other content created within Manti Desktop's project workspace are stored on your device and remain under your control there. Copies of project workspace data collected as described in Section 1.2 are retained on Manti's systems for as long as necessary for the purposes described in this Privacy Policy. If you delete your account, access stops at once and your account can be restored for thirty (30) days. After that period we delete from our active systems the project files, images, your own messages, and tool results that we collected from your project workspace, subject to standard backup retention with deletion in the ordinary course. We keep a copy of the parts of agent session records that the AI model wrote (its reasoning, its replies, and the names and arguments of the tool calls it made), with your account removed and with passages of your own text of twenty-four (24) characters or more replaced by a placeholder. Shorter passages of your text may remain in that copy. We also keep a record that your account was eligible for collection, with the dates and the policy version in force, for seven (7) years after deletion, as evidence that the collection was lawful. Content already incorporated into a trained model cannot be removed from that model. To delete the local copies on your device, delete the project folder or uninstall the desktop application. On the Enterprise tier, Manti retains only the identifiers described in Section 1.2.

4.3 Local Audit Log

The desktop application maintains a tamper-evident audit log of agent actions on your device. The audit log is kept on your device until you delete the project. On the Plus and Max tiers, the audit log is among the project workspace data Manti collects (Section 1.2), so Manti holds a copy and keeps it as described in Section 4.2. On the Enterprise tier, Manti does not have a copy.

4.4 Account Information

We retain your account information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements.

4.5 Free Trial Eligibility Records

To limit the Free trial to one per person and prevent abuse, when you create an account we compute a one-way keyed hash of your email address, from which the address cannot be read back. With that hash we keep whether and when the address claimed a Free trial (and the internal account identifier that claimed it) or had paid access, and the trial's usage records. We keep this record after you delete your account, for as long as needed to enforce the one-trial-per-person rule.

4.6 Manti MCP Projects

Your Manti MCP projects, including their files, versions, results, exports, share links, and downloads, are kept while your Free trial or paid plan is active.

When the Free trial ends or a paid plan ends or lapses, Manti's skills and new engine jobs stop at once. Your projects, results, share links, and downloads stay available to you for 31 days, so that you can download them or renew. We email you reminders before then, and on day 31 we delete your Manti MCP projects. For Enterprise tier accounts, Section 1.7 also applies.

If you delete a project, we remove its files from our active systems at once, and its live share links stop working. Our backups are daily snapshots kept for no more than 7 days, so a deleted project's files leave our backups within 7 days. We keep a record of the deleted project's name, description, and dates so that its identifier is never reused.

If you delete your account, your Manti MCP projects are deleted as described in Section 6.2.

Content already used to train a Manti AI model cannot be removed from that model; deleting your project deletes the underlying copies as described above.

4.7 Manti MCP Usage, Skill, and Log Records

Usage and billing records, including the per-request usage records in Section 1.5, are kept for seven (7) years for tax and audit purposes. Daily totals of engine time and tool requests, skill and session records, diagnostic records of failed engine jobs, and request logs, IP addresses, and user agents are kept only as long as needed for the purposes described in Section 2. The access an AI assistant app has to your account lasts until its tokens expire or you use Sign out everywhere (Section 6.5); the record of each connection and the token digests are kept only as long as needed for those purposes.

4.8 Shared Parts Catalog Contributions

A footprint land or supplier file contributed to the shared parts catalog (Section 3.9) is kept for as long as the catalog exists. A footprint land is recorded only under a one-way keyed code, and no catalog entry names you, your account, or your project, so entries are not removed when you delete a project or your account. To ask us to remove an entry, contact support@mantiai.com.

5. DATA SECURITY

5.1 Cloud Services

We implement encryption in transit (TLS 1.2 or higher), encryption at rest (AES-256), separation between accounts, audit logging, vulnerability scanning, and incident response procedures.

For the Manti MCP, Manti's worker servers run under a sandboxed kernel (gVisor) on Google Kubernetes Engine. Several accounts share a worker server; on it, each account's jobs run under an operating-system user that no other account has, and each account's files are kept in a directory that no other account can enter. Share, view, and download links are signed capability links (Section 3.8). The access tokens that AI assistant apps use for your account are stored only as one-way digests. Authorized Manti staff and systems can access Manti MCP projects to run engines, render projects, provide support, diagnose defects, enforce our Terms of Service, and train our AI models as described in Section 2.2. For Enterprise tier accounts, Section 1.7 applies instead.

5.2 Desktop Application

Manti Desktop installers and updates are cryptographically signed and verified before installation. On macOS, Manti Desktop stores your sign-in tokens in the macOS Keychain, not in plain files. To let you recover your conversation history if you lose your Keychain, Manti keeps a protected copy of the key that encrypts that history on your device, together with the means to restore it; this is a recovery feature, not end-to-end encryption. Manti Desktop maintains a tamper-evident local audit log using a SHA-256 hash chain. Local project files and databases are stored using standard operating-system file storage. We rely on your operating system's disk encryption (FileVault, BitLocker, LUKS) to protect local data at rest. Content created in the project workspace is stored on your device (and, on the Plus and Max tiers, a copy is collected as described in Section 1.2), so its security also depends on measures within your control, including your device passcode, enabling full-disk encryption, and your operating system account protections.

5.3 Limitations

No method of transmission over the Internet or electronic storage is completely secure. We do not hold SOC 2 certification or ISO 27001 certification. While we strive to protect your information, we cannot guarantee absolute security.

5.4 Breach Notification

In the event of a confirmed data breach affecting your personal information, we will notify you in accordance with applicable law and within 72 hours of confirmation where reasonably practicable.

5.5 Sensitive, Regulated, and Controlled Data

The Platform is built for engineering work. Do not upload, or ask your AI assistant to send to Manti's tools, any of the following: protected health information; health, biometric, or neural recordings of any person; government identification numbers; payment card data; passwords, API keys, or other credentials; or technical data controlled under the Export Administration Regulations (EAR) or the International Traffic in Arms Regulations (ITAR).

Manti is not designed to collect consumer health data, is not a HIPAA-compliant service, and does not sign business associate agreements on individual plans. Manti does not hold ITAR registration, and the Platform is not an export-controlled environment. Results from Manti's tools are returned to your AI assistant's provider (Section 3.7), which may process them outside the United States. If we learn that such data has been uploaded, we may delete it.

This does not stop you from using your own voice with dictation in the message box.

6. YOUR RIGHTS AND CHOICES

6.1 Access and Export

You can request a copy of your account data (profile, audit entries, and billing history) from Settings → Account on Manti Web. To ask for a copy of the project workspace data and model-call records Manti holds about you, write to privacy@mantiai.com. Project content created within Manti Desktop's project workspace is already stored as files on your device and can be accessed and copied directly through your operating system.

You can view and download your Manti MCP projects, files, versions, and results from your project pages on Manti Web or through your AI assistant at any time while you have access, including during the 31 days after the Free trial or a paid plan ends.

6.2 Account Deletion

You can delete your account from your account page on Manti Web, or by contacting us at privacy@mantiai.com. Your account can be restored for thirty (30) days; after that, deletion proceeds as described in Section 4. Account deletion will remove data that Manti holds on its servers, including collected project workspace data, your Manti MCP projects, their project records, and your share links, subject to the retention rules in Section 4 and tier-specific terms. Local copies of project content on your device remain under your control and must be deleted by you (by deleting the project folder or uninstalling the application). For Free trial, Plus, and Max tier users, content used for AI training may persist as described in Sections 4.1, 4.2, and 4.6. The Free trial eligibility record described in Section 4.5, usage and billing records (Section 4.7), and shared parts catalog contributions (Section 4.8) are kept after deletion.

6.3 Communication Preferences

You can opt out of receiving promotional communications, including Free trial invitations and opening notices, by following the unsubscribe link in those messages; we keep a record of your choice so that we can honor it. We may still send you non-promotional communications about your account.

6.4 Choosing a Tier Where Your Content Is Not Used for Training

If you do not want Your Content to be used to train our AI models, you may upgrade to the Enterprise tier, which does not use Your Content for training, including Manti MCP content, and is excluded from project workspace collection.

6.5 Disconnecting an AI Assistant

You can disconnect every connected AI assistant at once with Sign out everywhere under Settings → Security. You can also remove the files described in Section 1.6. Disconnecting stops new requests; it does not undo actions already taken or delete your projects.

6.6 Share Links and the Parts Catalog

You can revoke a share link at any time from the project's Settings page; each link also expires after the 1, 7, or 30 days you chose when you made it. To ask us to remove an entry from the shared parts catalog, contact support@mantiai.com.

7. CALIFORNIA PRIVACY RIGHTS (CCPA)

7.1 Right to Know

California residents have the right to request that we disclose the categories and specific pieces of personal information we have collected, the categories of sources, our business or commercial purpose for collecting it, and the categories of third parties with whom we share it.

7.2 Right to Delete

On a valid request, Manti will delete the personal information it holds about you from its active databases and will direct its service providers to do the same, subject to standard backup retention with deletion in the ordinary course. Manti excludes personal information (such as your name and email address) from AI training inputs. Local copies of project content stored on your device are under your control and are deleted by you (by deleting the project folder or uninstalling the application); copies collected by Manti are deleted as described in Section 4.2, and Manti MCP projects as described in Section 4.6. As a technical clarification, where personal information has already been incorporated into a trained model, the model itself may not be able to be "un-trained," but Manti will delete the underlying source data as described above.

7.3 Right to Correct

You have the right to request that we correct inaccurate personal information we maintain about you.

7.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.

7.5 Exercising Your Rights

To exercise your CCPA rights, please contact us at privacy@mantiai.com. We will verify your identity before responding to your request, by confirming that you control the email address on your account and, where needed, asking for details about your account. An authorized agent may make a request on your behalf with your signed permission; we may ask you to verify your identity directly. We respond within the time limits the CCPA sets.

7.6 Categories of Information Collected

In the past 12 months, we have collected the following categories of personal information. We do not sell personal information for money. Where the table says "Shared," we share that category with Meta for cross-context behavioral advertising from our public marketing pages only, and you can opt out as described in Section 7.7.

7.7 Right to Opt Out of Sale or Sharing (Your Privacy Choices)

We do not sell personal information. We share limited website activity from our public marketing pages with Meta for cross-context behavioral advertising, which is "sharing" under the CCPA. You can opt out at any time through the "Do Not Sell or Share My Personal Information" link in the footer of our website, which opens mantiai.com/privacy-choices, or by sending an opt-out preference signal as described in Section 8. Your choice is saved in a cookie on your browser for 395 days, so it applies to that browser and device; if you clear your cookies or use a different browser or device, you will need to opt out again. Opting out does not require an account and does not affect your use of the Platform. We do not knowingly sell or share the personal information of consumers under 16 years of age.

7.8 Notice at Collection

This Privacy Policy is our notice at collection. For the Manti MCP, the categories we collect are listed in Section 1.5, the purposes in Section 2, whether each category is sold or shared and how long it is kept in Section 7.6, and retention in Section 4.6 and Section 4.7.

7.9 Sensitive Personal Information

We use sensitive personal information only to sign you in and provide the Platform, as permitted by 11 CCR §7027(m). We do not use or disclose it for other purposes, and we do not use it to infer characteristics about you. Section 5.5 asks you not to upload other kinds of sensitive information. We do not create voiceprints or other biometric templates, and we do not use voice data to identify anyone.

7.10 California "Shine the Light"

We do not disclose personal information to third parties for their own direct marketing purposes.

7A. PRIVACY RIGHTS IN OTHER US STATES

Depending on the state you live in (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia), you may have the right to: confirm whether we process your personal data and access it; correct it; delete it; obtain a portable copy; opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects; and, in some states, obtain a list of the third parties to which we have disclosed personal data. We do not sell personal data, and we do not use personal data for profiling that produces legal or similarly significant effects. We use limited website activity from our public marketing pages for targeted advertising through the Meta Pixel, as described in Sections 1.3 and 3.5. You can opt out through the "Do Not Sell or Share My Personal Information" link in the footer of our website, which opens mantiai.com/privacy-choices, or by sending a Global Privacy Control signal (Section 8), whichever state you live in.

To exercise these rights, email privacy@mantiai.com. We respond within 45 days, or longer where the law allows and we tell you why. If we decline your request, you may appeal by replying to our decision or emailing privacy@mantiai.com with "Appeal" in the subject line. We will decide your appeal within the time your state's law sets and tell you how to contact your state Attorney General if you disagree with the outcome.

Training large language models: as described in Section 2.2, on the Free trial and the Plus and Max tiers we may use personal data that appears inside content you submit, including content sent to the Manti MCP after you accept our updated Terms of Service and this Privacy Policy, to train our AI models, including large language models; we exclude account information such as your name and email address. We never use Enterprise tier content for this purpose.

8. OPT-OUT PREFERENCE SIGNALS (DNT AND GPC)

Some browsers and browser extensions enable users to send opt-out preference signals, including "Do Not Track" (DNT) signals and "Global Privacy Control" (GPC) signals.

Global Privacy Control: when we receive a Global Privacy Control signal from your browser, we treat it as a valid request to opt out of the sale or sharing of your personal information as defined by the CCPA. For that browser, we do not load the Meta Pixel or send the related server events described in Sections 1.3 and 3.5, and we turn off the website usage analytics and session recordings described in Section 1.3. You do not need to click anything for this to take effect, and the current status is shown at mantiai.com/privacy-choices.

Do Not Track: Manti does not currently respond to Do Not Track browser signals because no industry standard has been adopted for interpreting them. We continue to monitor developments in this area.

9. CHILDREN'S PRIVACY

The Platform, including the Manti MCP and the Free trial, is available to users who are 18 years of age or older. We do not knowingly collect personal information from children under 18.

Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. Consistent with the California Consumer Privacy Act (CCPA), we do not knowingly collect, sell, or share the personal information of consumers under 16 without affirmative consent.

If you are a parent or legal guardian and believe that a child under 13 has provided personal information to the Platform, please contact us at privacy@mantiai.com and we will take steps to delete the information and terminate the child's account. If we learn that an account belongs to anyone under 18, we will close it, and Manti staff will delete its Manti MCP projects.

10. INTERNATIONAL USERS

The Platform is currently available only to users in the United States. The desktop application may be technically downloadable outside the United States, but it is licensed only for use by users in the United States. The Manti MCP can technically be reached from outside the United States, but the Free trial is available only in the United States. If you access the Platform from outside the United States, your information may be transferred to, stored, and processed in the United States. We store Manti MCP data in the United States; results returned to your AI assistant are processed by its provider, which may process them outside the United States. We do not currently offer GDPR-specific protections; we will update this Privacy Policy if and when we expand internationally.

11. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. This includes the AI assistant you connect to the Manti MCP and its provider (Section 3.7), and any manufacturer you send files to (Section 3.10). It also includes the services Manti Desktop contacts from your device (Section 3.11).

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we do, we will post the updated Privacy Policy on the Platform and update the Last Updated date. If we make changes that materially affect how we use your personal information, we will provide additional notice, such as by email or an in-product notice, before the changes take effect. If a change would let us use content or personal information we already hold in a materially different way, such as using it to train AI models when this Privacy Policy did not describe that use at the time you provided it, we will apply the change to that content only with your consent. Your continued use of the Platform after an updated Privacy Policy takes effect means you accept it, except where this Section requires your consent.

13. CONTACT US

Manti, Inc.

2041 East St, PMB 1063, Concord, CA 94520

Email: privacy@mantiai.com

Support: support@mantiai.com

By using the Platform, you acknowledge that you have read and understood this Privacy Policy.