Privacy Policy

Welcome to Mantle. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI chat platform. We are committed to protecting your privacy and handling your data responsibly.

This policy also covers people we contact about Mantle for business purposes, even if they have never used it. See Business Outreach below.

Mantle Chat is based in Amsterdam, the Netherlands, and is the controller of the personal data described in this policy.

You can reach us about privacy at [email protected].

Information you provide

• Account information (email address, name)
• Payment information (processed securely through Stripe)
• Content you create (messages, conversations, documents)
• Communications with us (support requests, feedback)

Automatically collected information

• Usage data (features used, interaction patterns)
• Device information (browser type, operating system, IP address)
• Log data (access times, pages viewed)
• Cookies and similar tracking technologies

We use the information we collect to:

• Provide, maintain, and improve our services
• Process AI requests by sending your messages to third-party AI providers
• Enable search and collaboration features
• Process payments and send transaction information
• Send service updates and support messages
• Respond to your questions and provide customer support
• Monitor and analyze usage to improve our services
• Detect and prevent fraud and security issues
• Comply with legal obligations

Under the GDPR and the UK GDPR, we rely on the following legal bases:

• Contract: To provide the service you sign up for, including processing your content, AI requests and payments.
• Legitimate interests: To keep Mantle secure, prevent abuse, understand how it is used, improve it, and contact businesses for which Mantle may be relevant (see Business Outreach).
• Consent: Where we ask for it, for example when you connect a third-party account. You can withdraw consent at any time.
• Legal obligation: To keep records we are required to keep, such as tax records.

We sometimes contact people at companies that may benefit from Mantle, by email or on LinkedIn, to introduce the product or to invite them to a research interview. This section explains how we handle personal data for that outreach.

What we use and where it comes from

We use business contact details only: your name, job title, employer, business email address and LinkedIn profile URL, plus any replies you send us. We obtain them from professional contact databases such as Apollo.io, from public professional profiles such as LinkedIn, and from company websites.

Why we use it

We rely on our legitimate interest in introducing Mantle to businesses for which it may be relevant. We keep messages relevant to your professional role, limit the number of follow-ups, and stop as soon as you ask.

Who processes it for us

We use service providers to find contact details and send messages, such as Apollo.io, Instantly and Gojiberry. Where a provider processes data outside the European Economic Area or the United Kingdom, the transfer relies on an adequacy decision, such as the EU–US Data Privacy Framework for certified US providers, or otherwise on the European Commission’s standard contractual clauses and, for UK data, the UK addendum. You can request a copy of these safeguards at [email protected].

How long we keep it

If you do not reply, we delete your details within six months of our last message. If you ask us to stop, we keep only your email address on a suppression list, so that we never contact you again.

Opting out

You can object at any time and we will stop: reply "no" to any of our emails, use the unsubscribe option, or write to [email protected]. You also have the rights listed in Your Privacy Rights below.

Connecting a Google account is optional. Before you connect, Mantle explains the integration and Google asks you to approve its permissions. The permissions you approve and the tools you enable determine what your agent can access and do. Google sign-in to Mantle is separate from connecting an integration.

Information accessed and actions supported

• Gmail: Account identification, messages, attachments, drafts, labels and mail settings. Available actions include reading, composing, sending, organizing and permanently deleting email. Contact and profile tools can read contacts, other contacts, email addresses, phone numbers, addresses, birthdays and language preferences.
• Google Calendar: Calendars, events and sharing settings, including creating, changing, sharing and deleting calendars and events.
• Google Drive, Docs and Sheets: Existing files and folders, document and spreadsheet content, metadata and sharing permissions. Available actions include searching, reading, creating, editing, copying, sharing and deleting files.
• Other Google integrations, where available: Google Chat spaces, memberships, messages and reactions; Google Contacts and contact groups; and Google Forms questions and submitted responses. The Chat, Contacts and Forms tools request read-only access.

Composio, AI processing and conversation history

Mantle uses Composio to handle Google connections, authorization tokens and API requests. When you enable an integration for an agent, data returned by its tools can be sent to the AI provider or model service selected for the conversation to carry out your request. Tool results, related messages and generated responses can be stored in conversation history and used as context for later requests. Other people with access to that conversation may see this content. Connecting an account does not itself publish your Google data to other users.

Google API data use restrictions

Our use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API User Data and Developer Policy. These restrictions apply to Google data and information derived from it, and take precedence over the general uses and sharing described elsewhere in this policy.

Google data is used for the user-facing features you choose. It must not be sold, used for advertising or credit decisions, or used to train or improve general-purpose AI models. Transfers to service providers must support those features with your consent, security needs or legal obligations. Human access is limited to the cases permitted by Google’s policy, including your explicit agreement to review specific data, security needs or legal obligations. A merger, acquisition or asset sale involving Google data requires your prior explicit consent. These restrictions also apply to our service providers.

• Google API Services User Data Policy
• Google Workspace API User Data and Developer Policy

Disconnecting, revoking access and deleting data

To stop using a connection, open Settings → Integrations, select the Google app and disconnect the account. Mantle requests removal of the connected account from Composio; if this fails, retry or contact support. You can also revoke Mantle’s access in your Google Account’s third-party connections settings. Revoking access can affect other Mantle integrations that use the same Google app.

Disconnecting or revoking access does not automatically erase earlier conversations, stored tool results, AI responses, or changes already made in Google services. Use Mantle’s conversation, workspace or account deletion controls, or email [email protected] to request deletion of retained Google data. The retention and deletion provisions below apply to stored conversation content. Files or messages created in Google services are managed through those services.

• Manage third-party connections in your Google Account
• Request deletion or ask a privacy question

We may share your information in the following situations:

Service providers

We share data with third-party service providers who perform services on our behalf, including cloud hosting, payment processing, AI services, analytics, and customer support.

AI providers

When you use AI features, your message content is sent to the selected AI provider (OpenAI, Anthropic, Google, xAI, DeepSeek, Moonshot AI, Z.AI, or Mistral AI) to generate responses. These providers process your data according to their own privacy policies.

Legal requirements

We may disclose information if required by law or in response to valid legal processes.

Business transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new owner. Google API data remains subject to the specific restrictions and prior-consent requirement in the Connected Google Accounts section.

We implement appropriate security measures to protect your information against unauthorized access, alteration, disclosure, or destruction:

• Encryption of data in transit (TLS 1.3) and at rest
• Workspace data encrypted with industry-standard encryption (AES-256-GCM)
• Encryption keys managed through Google Cloud Key Management Service
• Regular security assessments and monitoring
• Access controls and authentication mechanisms
• Employee training on data protection

While we strive to protect your data, no method of transmission over the internet is 100% secure. We continuously work to improve our security measures.

We retain your information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Maintain business records

Account deletion

When you delete your account, we will delete or redact your personal information within 30 days, except where retention is required by law. Workspace data is deleted immediately, and encryption keys are permanently destroyed within 24 hours.

Workspace deletion

When you delete a workspace, the encryption key is immediately destroyed, making all encrypted data unrecoverable. File attachments are deleted within 24 hours.

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Restriction: Request restriction of processing in certain circumstances
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing for direct marketing purposes
• Withdraw consent: Withdraw consent where we rely on consent for processing

To exercise these rights, please contact us at [email protected]. We will respond within 30 days.

You can also lodge a complaint with a data protection authority, such as the Dutch Autoriteit Persoonsgegevens or, in the United Kingdom, the Information Commissioner’s Office.

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences
• Analyze usage patterns
• Improve performance and security

You can control cookies through your browser settings. Disabling certain cookies may limit functionality.

Our primary infrastructure is located in the European Union (Amsterdam, Netherlands). Your data is stored and processed in EU data centers.

Some service providers (including AI providers) may process data outside the EU. For transfers outside the European Economic Area, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission.

You can request a copy of the safeguards that apply to your data at [email protected].

Our services are not intended for children under 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising privacy rights

We do not sell personal information. To exercise your rights, contact [email protected].

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes, we will provide additional notice via email or through the platform.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have questions about this Privacy Policy or our data practices, please contact us:

• Company: Mantle Chat, Amsterdam, the Netherlands
• Email: [email protected]
• Website: mantle.chat