Privacy Policy

This Privacy Policy explains how Mana Play Ventures Pte Ltd ("Mana OS", "we", "us", or "our") collects, uses, and discloses personal data when you use the Canvas application and related services (the "Service"), in accordance with the Personal Data Protection Act 2012 of Singapore (the "PDPA").

Organisation: Mana Play Ventures Pte Ltd, 65 Chulia Street, #46-00, OCBC Centre, Singapore 049513. Unique Entity Number (UEN) 202215860H.

Data Protection Officer: We have appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with the PDPA. You may contact our DPO at dpo@mana-os.com.

1. Who this policy applies to

This policy applies to visitors to our website, individuals who create an Account, and Users authorised by an organisation that subscribes to the Service.

Where an organisation (our customer) uses the Service, that organisation is generally responsible for the personal data in its Customer Content, and we handle that data on its behalf as a data intermediary under the PDPA. In that case, the organisation's own privacy notice governs how it handles your data, and this policy describes our practices.

2. Personal data we collect

You provide to us:

• Account and profile data — name, email address, password (stored hashed), organisation, and role.
• Billing data — where applicable, billing contact and transaction details. Billing is handled by bank transfer against invoices; we do not collect or store payment card numbers.
• Customer Content — briefs, prompts, plans, uploaded files, and other material you submit. This may contain personal data you choose to include.
• Support and communications — messages you send us and their contents.

Collected automatically:

• Usage data — features used, actions taken, and timestamps.
• Device and log data — IP address, browser type, device identifiers, and pages viewed.
• Cookies and similar technologies — see Section 8.

From third parties:

• Authentication providers — if you sign in via a third party (e.g. SSO), we receive basic identity information.
• Integrations — data from services you connect to the Service, subject to your authorisation.

3. Purposes for which we collect, use, and disclose personal data

Under the PDPA, we collect, use, and disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances, and for which you have given (or are deemed to have given) consent, or as otherwise permitted by law. Our purposes include:

Where we rely on deemed consent or an exception under the PDPA (such as legitimate interests or business improvement, subject to the Act's requirements), we do so only where permitted and after any required assessment. You may withdraw consent as described in Section 9.

4. AI processing

The Service uses third-party AI model providers to generate Output. When you use an AI-assisted feature, your prompts and related Content may be transmitted to these providers to produce a response. The providers we currently use include Anthropic, Google (Vertex AI and Gemini), and OpenAI, and this list may change from time to time.

We select providers that offer appropriate contractual and security protections. Our agreements with these providers prohibit them from using your prompts or Customer Content to train their models.

We do not use your Customer Content to train our own or third parties' foundation models except as described here or with your consent.

5. How we disclose personal data

We may disclose personal data to:

• Subprocessors and service providers — hosting, infrastructure, AI model providers, analytics, payment processing, email delivery, and customer support. They act on our instructions under contract. Our current subprocessors are listed in the table below.
• Your organisation — if you use the Service under an organisation's Account, administrators of that organisation may access your Account and Content.
• Professional advisers — lawyers, auditors, and insurers where necessary.
• Legal and safety — where required to comply with law, respond to lawful requests, or protect rights, safety, and property.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

This list reflects our current subprocessors and may be updated from time to time as our providers change.

We do not sell personal data.

6. Transfers of personal data outside Singapore

We may process and store personal data in countries outside Singapore, including Ireland, the United Kingdom, the United States, and the Netherlands (see the subprocessor table in Section 5). Where we transfer personal data overseas, we comply with the PDPA's Transfer Limitation Obligation by ensuring the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA (for example, through contractual clauses or binding corporate rules). You can request further information at dpo@mana-os.com.

7. Data retention

We retain personal data only as long as necessary for the purposes described in this policy, or as required by law, after which we will cease retention or anonymise it in accordance with the PDPA's Retention Limitation Obligation.

• Account data: for the life of the Account and 90 days afterwards.
• Customer Content: for the subscription term; you may export it and it is deleted within 30 days of termination, subject to backups and legal requirements.
• Logs and usage data: 90 days.

8. Cookies and similar technologies

The Service (application). Within the Canvas application we use only strictly necessary first-party cookies — for example, to keep you signed in and to operate core features. We do not use advertising or third-party analytics cookies inside the application.

Our marketing website. On our public marketing website we also use third-party analytics and visitor-identification technologies — Google Analytics (to understand how the site is used) and Snitcher (to identify organisations that visit the site) — which set or read non-essential cookies and similar identifiers. Where required, including for visitors in the European Economic Area and the United Kingdom, we ask for your consent before setting these non-essential cookies through a cookie consent banner, and you can accept, reject, or change your choice at any time. You can also block or delete cookies through your browser settings.

9. Your rights under the PDPA

Subject to the PDPA and applicable exceptions, you may:

• Access — request information about the personal data we hold about you and how it has been used or disclosed;
• Correction — request correction of an error or omission in your personal data;
• Withdraw consent — withdraw consent to our collection, use, or disclosure of your personal data, on reasonable notice (this may affect our ability to provide the Service);
• Deletion — request deletion of the personal data we hold about you, including data obtained from platforms you connected such as Meta (Facebook and Instagram), subject to the PDPA and any legal or contractual retention obligations. See our Data Deletion Policy for how to make a request; and
• Data portability — where and when the PDPA's data portability provisions apply, request transmission of applicable data to another organisation.

To exercise these rights, contact our DPO at dpo@mana-os.com. We will respond within the timeframes required by the PDPA. A reasonable fee may apply to access requests, as permitted. If your data is handled by an organisation using the Service, please direct requests to that organisation; we will assist them as their data intermediary.

To request deletion of your personal data specifically, email platform@mana-os.com or follow our Data Deletion Policy. We action verified deletion requests within 30 days.

If you have a concern about how we handle personal data, please contact us first. You also have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore.

10. Protection of personal data

We make reasonable security arrangements to protect personal data in our possession or control against unauthorised access, collection, use, disclosure, copying, modification, or disposal, including encryption in transit, access controls, and monitoring. No system is completely secure; we cannot guarantee absolute security. Report security concerns to dpo@mana-os.com.

11. Children

The Service is not directed to children under 18 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact dpo@mana-os.com and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice where required.

13. Contact

Mana Play Ventures Pte Ltd
65 Chulia Street, #46-00, OCBC Centre, Singapore 049513
Data Protection Officer: dpo@mana-os.com
General privacy enquiries: dpo@mana-os.com

See also our Terms and Conditions.