Privacy policy

1. Overview

Manifest Pty Ltd (“Manifest”, “we”, “us”, or “our”) provides an AI-powered business data platform for creative and digital agencies.
We are committed to protecting your privacy and handling your data responsibly in accordance with the General Data Protection Regulation (GDPR) and the Australian Privacy Act 1988 (Cth).

This Privacy Policy explains what data we collect, how we use it, and the rights available to you.

2. Data Controller and Contact

Manifest Pty Ltd is the data controller for all personal information collected through our software, website, and integrations.
Our contact details:
Shutterspeed Pty Ltd
Email: privacy@gomanifest.ai
Address: 13/333 George Street, Sydney 2000, Australia

If you are located in the EU or UK, we comply with the GDPR. If you are located in Australia, we comply with the Australian Privacy Principles (APPs).

3. What Data We Collect

We collect the following categories of information:

a. Work Activity Data
Metadata from applications, filenames, and project activity on your device, used to determine work context across clients, projects, and phases.

b. Business and Project Data
Client names, project titles, budgets, cost-to-serve data, utilisation rates, and other operational metrics.

c. Tool Usage Data
Information about which software tools are used, for how long, and within which workflow.

d. Device and Technical Data
IP address, operating system, device identifiers, browser version, and application telemetry.

e. Billing and Subscription Data
Payment details, billing address, transaction history, and plan information.

f. Calendar and Integration Data
Data from connected services such as calendars, project management systems, or ERPs to link work activity with known projects or events.

We do not collect or monitor personal communications, keystrokes, or non-work-related activity.

4. How We Collect Data

• Automated Tracking: With user consent, a lightweight desktop agent observes contextual work activity. Tracking only occurs during set work hours and in approved applications.

• Direct Input: Data you manually enter into the platform.

• Third-Party Integrations: Information received through authorised connections with other tools.

5. Legal Basis for Processing (GDPR)

We process personal data under the following lawful bases:

• Contract Performance: To provide services under your user agreement.

• Legitimate Interests: To improve service accuracy, functionality, and security.

• Consent: When enabling features such as automated activity tracking or data integrations.

• Legal Obligation: To meet financial or compliance requirements.

You can withdraw your consent at any time through your account settings or by contacting us.

6. Purpose of Data Processing

We use collected data to:

• Provide automatic time tracking and cost-to-serve insights

• Deliver real-time analytics on workflows and tool usage

• Help agencies understand efficiency, utilisation, and profitability

• Improve and personalise the platform experience

• Manage subscriptions, payments, and billing

• Ensure data security, audit integrity, and legal compliance

We never use your data for advertising or unrelated profiling.

7. Data Retention

We retain your data only as long as needed to deliver our services or comply with legal obligations.

Upon account deletion, you may choose to:

• Delete all data immediately and permanently, or

• Retain your data for up to one year for reference and reporting continuity.

After the retention period, all records are deleted from our systems and backups.

8. Your Rights

Under the GDPR and the Australian Privacy Act, you have the right to:

• Access: Request a copy of the data we hold about you.

• Correction: Request correction of inaccurate or incomplete data.

• Deletion: Request deletion of your data (“right to be forgotten”).

• Restriction: Request that processing be limited in certain circumstances.

• Portability: Receive your data in a structured, commonly used format.

• Objection: Object to data processing based on legitimate interest.

You can exercise these rights by emailing privacy@gomanifest.ai. We will respond within 30 days.

9. International Transfers

Data may be processed or stored in regions where Manifest operates, including Australia, the European Union, and the United States.
We use Standard Contractual Clauses (SCCs) and other approved safeguards to ensure compliance with GDPR for cross-border data transfers.

10. Data Security

We apply strict security measures to protect your information:

• AES-256 encryption of data in transit and at rest

• Multi-factor authentication for all administrative access

• Role-based access controls

• Routine security audits and penetration testing

• Continuous infrastructure monitoring

11. Third-Party Sharing

We share data only with trusted third parties essential for delivering our services, including:

• Payment processors (e.g. Stripe)

• Cloud hosting providers (e.g. AWS, Supabase)

• Project management integrations (optional)

All third parties are bound by confidentiality and data protection agreements. We do not sell, rent, or trade user data.

12. Employee Privacy Features

Manifest is designed with privacy-first tracking in mind. Employees maintain control through:

• Tracking limited to work hours

• App and website whitelisting

• Timesheet approval before manager review

• Exclusion of non-work activity

These safeguards ensure compliance and transparency for all users.

13. Children’s Privacy

Manifest is not intended for individuals under 18 years of age. We do not knowingly collect data from minors.

14. Policy Updates

We may update this Privacy Policy periodically to reflect service or legal changes. Updated versions will be posted on our website.
Continued use after updates means you accept the revised terms.

15. Complaints

If you believe we have mishandled your data, you may contact:

• Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au

• European Data Protection Authorities (EU): https://edpb.europa.eu

We encourage you to contact us first so we can address your concerns directly.

16. Contact Us

Shutterspeed Pty Ltd
Email: privacy@gomanifest.ai
Address: 13/333 George Street, Sydney 2000, Australia