1. What Mandaire Does
Mandaire is a private context layer that connects to your digital services (email, messaging, calendar, contacts) and makes that context available to the AI you choose to use. To do this, Mandaire requires access to data from these services, which you authorize explicitly.
2. Data You Authorize
When you connect a service to Mandaire, we access data from that service solely to perform actions you have requested or that your Mandaire determines are helpful based on your preferences. This may include:
- Email messages, calendar events, and contact records
- Messaging conversations (iMessage, WhatsApp, and others you connect)
- Files you explicitly share with your Mandaire
- Instructions, preferences, and feedback you provide
You connect sources one at a time, at your own pace. You can disconnect any source at any time.
3. How Your Data Is Stored
Isolation. Each user's data is stored in a completely isolated environment. There is no shared database between users. Your Mandaire knows nothing about any other user.
Encryption. Your data is encrypted at rest and in transit. Today, encryption at rest uses server-side keys on your dedicated server. As we build toward full cryptographic privacy, we are implementing user-side key derivation that will move the decryption key to your device, so only you hold it.
Location. Your data is processed and stored on infrastructure under your control, or on infrastructure we operate on your behalf (depending on your setup).
4. What We Never Do
- We never sell your data. Not to advertisers, data brokers, or anyone else.
- We never train AI models on your data. Your conversations, emails, and personal information are never used to improve models for other users or any third party.
- We never share your data with third parties except when required to operate the service (for example, sending an email you asked us to send) or when required by law.
- We never access your data without your knowledge. Mandaire operates transparently. You can review what your Mandaire has done at any time.
5. Third-Party Services
When Mandaire connects to external services (Google, Apple, Meta, etc.) on your behalf, it uses OAuth tokens scoped to the minimum permissions required. These tokens are stored encrypted and can be revoked by you at any time through the connected service's settings.
Mandaire uses AI models to process your requests. You choose your own AI provider (Anthropic, OpenAI, a local model, or others). Your data goes directly from your device to the provider you select. Mandaire does not intermediate, log, or retain your AI conversations. The privacy of those conversations is governed by your relationship with the provider you choose.
6. Verifiable Privacy
Mandaire uses widely-audited open-source encryption libraries for end-to-end encrypted message storage and transport, including Matrix Olm and Megolm for E2E messaging and the Python cryptography library for key operations. These libraries are independently maintained; their security properties do not depend on trusting Mandaire. We conduct regular internal security reviews and track findings in a risk register.
7. Data Retention
Your data is retained for as long as your account is active. If you close your account, all data associated with your Mandaire is deleted within 30 days. Backups are purged within 90 days.
8. Your Rights
You may at any time:
- Request a complete export of all data your Mandaire holds
- Revoke access to any connected service
- Delete your account and all associated data
- Ask us what data we hold and how it is being used
- Correct inaccurate personal information we hold
- Limit the use of sensitive personal information (California residents)
To submit any of these requests, use our privacy request page or email [email protected] with the subject "Privacy Request." We will respond within 45 days (CCPA) or 30 days (GDPR).
9. Security
Our infrastructure uses end-to-end encryption, isolated processing environments, and regular security reviews. If we discover a breach that affects your data, we will notify you within 72 hours.
10. Children
Mandaire is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.
11. Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify you through your Mandaire or by email. Continued use of the service after changes constitutes acceptance.
12. Contact
For questions about this privacy policy or your data, contact us at [email protected].