Privacy Policy

Effective date: 1 July 2026 · Last updated: 1 July 2026

This Privacy Policy explains how Mandera Software GmbH ("mandera", "we", "us") processes personal data when you visit our website mandera.ai, use our web application at app.mandera.ai, or otherwise interact with us.

mandera is privacy-first by design. This policy concerns data for which we are the controller. Two things are covered elsewhere:

Your website visitors. When you embed mandera's cookieless analytics on your site, mandera does not collect, store or otherwise process the IP addresses or other personal data of your visitors (see our Terms, §7.2).
AI features (you as controller). When you use the AI features, personal data contained in your inputs may be processed by mandera as your processor under our Data Processing Agreement (DPA).

1. Controller & contact

Mandera Software GmbH
Marktplatz 6, 73525 Schwäbisch Gmünd, Germany
Managing Director: Fabian Aldinger
Email: info@mandera.ai

A Data Protection Officer is not mandatory for us. For any privacy matter or to exercise your rights, contact info@mandera.ai.

2. What we process, why, and on what legal basis

2.1 Visiting our website (mandera.ai)

Hosting. We use the following host for our website: Droptop GmbH, Am Grashorn 8, 14548 Schwielowsee OT Geltow, Germany. When you access the website, the host's servers process the technical access data described below on our behalf.
Server log data. Our website host (Droptop GmbH, Germany) automatically records technical access data, which may include the IP address, date/time, the page requested, referrer, and browser/OS information.
Purpose: delivering the website securely and stably, detecting and preventing attacks and abuse.
Legal basis: Art. 6 (1)(f) GDPR (our legitimate interest in a secure, functioning website).
Retention: logs are kept for a short period (up to 7 days) and then deleted or anonymized.
Our own analytics: we use our own cookieless analytics on mandera.ai, which does not process personal data and does not set cookies.

2.2 Cookies

mandera does not use cookies — no tracking, advertising, analytics or profiling cookies. To keep you signed in, the app uses only strictly necessary local storage in your browser. Our payment provider (Stripe) may set strictly necessary cookies on its own checkout pages. No consent banner is required.

2.3 Creating and using an account (app.mandera.ai)

Data: name, email address, password (stored only as a salted hash), organization/company, user role, connected websites, preferences, and usage data generated while using the Service.
Purpose: providing the Service, authentication, account and organization management, support, security.
Legal basis: Art. 6 (1)(b) GDPR (performance of our contract with you); Art. 6 (1)(f) GDPR for security and service improvement.

2.4 Billing and payments

Data: name, billing address, VAT ID, plan, invoices and payment status. Card/bank details are processed directly by Stripe; we do not store full card numbers.
Purpose: processing subscriptions and payments, invoicing, accounting.
Legal basis: Art. 6 (1)(b) GDPR (contract) and Art. 6 (1)(c) GDPR (legal retention obligations).
Retention: invoices and accounting records are retained for up to 10 years as required by German tax and commercial law (§ 147 AO, § 257 HGB).

2.5 Transactional emails

Data: your email address and the content of transactional messages.
Purpose: sending account/security emails such as password-reset links, one-time passcodes (OTP), and important service notifications. We use Resend to deliver these emails.
Legal basis: Art. 6 (1)(b) GDPR (contract) and Art. 6 (1)(f) GDPR (account security).

2.6 AI features

Data: the inputs, prompts and content you submit to the AI features.
Purpose: generating the requested AI Output. To do so, inputs are sent to our AI provider Mistral AI (France). Where you submit personal data through the AI features as a controller, this is governed by our DPA.
Legal basis: Art. 6 (1)(b) GDPR (performance of the Service).

2.7 SEO data

Data: keywords, domains and related query data used by the SEO features, which are sent to DataForSEO (United States) to retrieve search data.
Legal basis: Art. 6 (1)(b) GDPR (performance of the Service).

2.8 Contacting us

If you contact us (e.g. by email or our contact form), we process the data you provide to handle your request. Legal basis: Art. 6 (1)(b) or (f) GDPR.

3. Recipients & subprocessors

We share personal data only with service providers that process it on our behalf under appropriate agreements, and only as necessary to provide the Service:

Provider	Purpose	Location
Hetzner Online GmbH	Hosting / infrastructure	Germany (EU)
Stripe	Payment processing	EU / USA
Mistral AI	AI features	France (EU)
DataForSEO	SEO data	USA
Resend	Transactional email delivery	EU (Ireland)

A current subprocessor list is maintained at mandera.ai/subprocessors. We do not sell your personal data, and we do not use it for advertising.

4. International transfers

Where a provider processes data outside the EU/EEA (in particular DataForSEO and, at the corporate level, Stripe and Resend), we rely on appropriate safeguards under Art. 46 GDPR, in particular the EU Standard Contractual Clauses, and additional measures where required.

5. Retention

We keep personal data only as long as necessary for the purposes above or as required by law. In particular: server logs up to 7 days; account data for the duration of your account and then deleted within 90 days after the contract ends (unless we must retain it by law); invoices and accounting records for up to 10 years.

6. Your rights

Under the GDPR you have the right to:

access your personal data (Art. 15);
rectification of inaccurate data (Art. 16);
erasure (Art. 17);
restriction of processing (Art. 18);
data portability (Art. 20);
object to processing based on legitimate interests (Art. 21); and
withdraw consent at any time, where processing is based on consent (Art. 7), without affecting prior processing.

To exercise any right, contact info@mandera.ai.

You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Stuttgart — baden-wuerttemberg.datenschutz.de

7. Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of our legitimate interests (Art. 6 (1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

8. Is provision of data required?

Providing the data needed to create an account, pay and use the Service is necessary to enter into and perform our contract. Without it, we cannot provide the Service. Providing further data is voluntary.

9. Automated decision-making

We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. The AI features provide recommendations and content for your review; decisions remain with you.

10. Data security

We use appropriate technical and organizational measures to protect your data, including TLS encryption in transit, EU-based hosting (Hetzner, Germany) and access controls. No method of transmission or storage is completely secure, but we work to protect your data and review our measures regularly.

11. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service or the law. We will post the updated version here with a new "last updated" date and, for material changes, notify you where appropriate.

12. Contact

info@mandera.ai
Mandera Software GmbH, Marktplatz 6, 73525 Schwäbisch Gmünd, Germany — further details in our Imprint.