Legal
Privacy policy
Draft. This page is being reviewed by our lawyer and may change before it applies. Questions: privacy@mantab.ai.
This policy explains how MantaB handles personal data as a controller: when you visit our website, fill in a form, subscribe to our newsletter, book a call, or become a customer. When we work inside a customer’s systems, we act as their processor, and the Data Processing Agreement applies instead.
1. Who we are
Ana Beatriz Guimarães de Aguiar Gomes, trading as MantaB, NIF Z0942490R, Carrer Roger de Flor 298, 3-1, 08025 Barcelona, Spain. For anything about your data, write to privacy@mantab.ai.
2. What we collect, why, and for how long
| When | What we collect | Why | Legal basis | How long we keep it |
|---|---|---|---|---|
| You subscribe to the newsletter | Email, the consent you gave and when, where you signed up | To send you the newsletter | Your consent (Art. 6(1)(a) GDPR) | Until you unsubscribe. We keep the record of your consent for as long as we may need to prove it |
| You fill in a contact or resource form | Name, email, company, role, your message and what you’re asking about | To answer you and follow up on what you asked | Steps you ask for before a contract (Art. 6(1)(b)), or our legitimate interest in answering business enquiries (Art. 6(1)(f)) | 24 months after our last contact, unless you become a customer |
| You book a call | Name, email, the time you chose and your answers in the booking form | To hold the call | Steps you ask for before a contract (Art. 6(1)(b)) | 24 months after our last contact, unless you become a customer |
| You become a customer | Your team’s contact details, your approver and billing contact, legal name, VAT ID, address, invoices and payment status | To run the contract, bill you and keep the accounts | The contract (Art. 6(1)(b)) and our legal obligations (Art. 6(1)(c)) | For the contract, then 6 years for accounting and tax records, as Spanish law requires |
| You visit the website | Your IP address and technical data, processed by our hosting provider | To run the site, keep it secure (including the bot check on our forms) and count visits in aggregate | Our legitimate interest in a working, secure website (Art. 6(1)(f)) | Our analytics are cookieless and aggregate. The provider keeps logs for a short period under its own terms |
| You accept analytics cookies | How you use the site, through HubSpot cookies | To understand which pages help people | Your consent (Art. 6(1)(a)) | See the cookie policy |
| You email us | Your email and what you write | To reply | Our legitimate interest in answering (Art. 6(1)(f)), or the contract | As long as the conversation is useful, then deleted or archived with the customer record |
We don’t send commercial emails without your consent, except to customers about services similar to the ones they bought, as Spanish law (LSSI, Article 21) allows. Every email has an unsubscribe link.
We don’t sell personal data, and we don’t use advertising cookies.
3. Who processes it for us
We use a small set of providers, each under a contract that protects your data:
- HubSpot (CRM, forms, newsletter, meeting booking, cookie banner). Our account is hosted in HubSpot’s EU data centre in Germany.
- Stripe (payments). We never see your full card details.
- Cloudflare (website hosting, security, bot checks and cookieless analytics).
- Google Workspace (email and documents), hosted in the EU.
- Quipu (invoicing and accounting), in Spain.
- Notion, Slack, Loom and n8n (delivery tools, for customers only).
- AI providers on paid business plans that don’t train on your data (see AI and data trust).
We also share data with tax authorities, advisers or courts when the law requires it.
4. Transfers outside the EU
Some providers are based in the United States or may access data from there. We only use them under a valid legal mechanism: the EU-US Data Privacy Framework where the provider is certified, or the European Commission’s Standard Contractual Clauses.
5. Your rights
You can ask us to access, correct or delete your data, to restrict or object to how we use it, or to send it to you or someone else in a portable format. Where we rely on your consent, you can withdraw it at any time, without affecting what we did before. Write to privacy@mantab.ai. We reply within one month.
If you think we haven’t handled your data properly, you can complain to the Spanish data protection authority, the AEPD (www.aepd.es), or to the authority in your country.
6. Automated decisions
We don’t make decisions about you based only on automated processing.
7. Security
We keep access to the minimum, use multi-factor authentication and a password manager, and encrypt data in transit and on our devices. More detail is in the Data Processing Agreement, Annex II.
8. Changes
We update this policy when how we handle data changes. The date at the top shows the latest version.