Privacy policy
Last updated: July 2026
1. Who we are
Manisma is software for planning field service work (technician scheduling, work orders, client approval). When your company uses Manisma to manage your own clients and jobs, your company is the data controller for the personal data of your clients, contacts and technicians. You decide why and how that data is used. Manisma acts as a processor: we process that data only on your instructions, as set out in the Data Processing Agreement.
For the data we collect directly from you to deliver and bill the service (e.g. your account details, billing information and website usage),Manisma itself is the data controller. This policy describes both roles.
2. What data we process
- Account & users: name, email address, phone number, role, language preference, login credentials.
- Client & job data: client names, contacts, job descriptions, schedules, photos and signatures on job completion, materials used, notes.
- Location / address: service addresses, technician home and depot addresses, and the coordinates derived from them for routes and ETA calculation.
- Usage data: login times, device type, and technical logs for security and troubleshooting.
3. Purposes & legal bases
- Performance of the contract: delivering the planning service itself: scheduling jobs, directing technicians, generating work orders, letting clients approve slots.
- Legitimate interest: security, abuse prevention, product improvement and anonymized AI planning proposals (see below).
- Consent: where required, e.g. for marketing communication you can opt out of separately.
4. Subprocessors
Manisma engages a small number of specialized parties to deliver the service. These are the actual subprocessors today:
| Name | Purpose | Location / EU | What they receive |
|---|---|---|---|
| OpenRouter | AI planning proposals (LLM) | US, outside the EU | No personal data. Only anonymized planning snapshots: synthetic IDs, postal code/street and coordinates. We never send names or house numbers. The mapping back to real client or technician names always stays inside Manisma's own infrastructure. |
| HERE Technologies (HERE Global B.V.) | Geocoding, routing & ETA calculation | EU | Addresses and coordinates of service locations. |
| Mollie | Payments & subscription management | Belgium / EU | Company details, VAT number and payment details. |
| Railway | Application and database hosting | EU | All data the application stores, hosted with Railway (EU region) with tenant isolation and least-privilege access. |
| Hostinger | Domain registration & platform transactional email delivery (SMTP) | EU | Email address, name and content of platform emails sent by Manisma itself (e.g. account signup, billing, system notifications). Our domain is also registered with Hostinger. |
Your own email traffic with your clients (e.g. appointment confirmations, reminders) is sent by Manisma through the SMTP server you configure yourself in email settings. That email provider is your own choice and your own processor, not a Manisma subprocessor.
5. Retention periods
We retain client and job data for as long as your subscription is active. After cancellation we keep your data for a further 90 days so you can export it or reactivate your account, after which it is deleted, see "Cancellation & offboarding" in the terms of service. Once that window passes, deletion is permanent and also covers uploaded files (photos, documents, logo).
6. Transfers outside the EU
Most processing happens within the EU. One subprocessor, OpenRouter, may serve models running outside the EU (including the US), as described above, OpenRouter does not receive personal data, only anonymized planning data. To the extent any transfer of personal data outside the EU does occur, it relies on the European Commission's Standard Contractual Clauses (SCCs).
7. Rights of data subjects
You have the right to access, rectify, delete, transfer (data portability) and object to the processing of your personal data. If you are an end-customer of a company using Manisma, please direct your request to that company (the data controller) first. We support the company as its processor. For questions about your own Manisma account you can contact us directly.
8. Security
- Tenant isolation: each company sits in its own segregated data space.
- Least-privilege access: internal services and staff only get the permissions they need.
- Sensitive fields (such as SMTP passwords) are write-only. Even admins cannot read them back.
- Regular backups of the production database.
9. Cookies
See our separate cookie policy for details on which cookies and storage techniques we do (and don't) use.
10. Contact & DPO
Questions about this privacy policy or your data? Email hello@manisma.com. Our Data Protection Officer (DPO) can be reached at dpo@manisma.com (placeholder, to be confirmed).