Privacy Policy

Last updated October 19, 2026

This privacy notice for ManyRows Pty Ltd (‘ManyRows’, ‘we’, ‘us’, or ‘our’) describes how and why we collect, store, use, and share (‘process’) your information when you use our services (‘Services’) — when you visit our website at https://manyrows.com, when you register for and use the ManyRows application, or when you engage with us in any other related way.

ManyRows Pty Ltd, Australia, is the controller for the account and service administration processing described below. Contact us at [email protected] with questions or to exercise your rights, including if you cannot sign in. Using the Services or accepting our terms does not waive those rights or give consent to unrelated processing.

Two kinds of data, treated differently

This distinction runs through the whole notice, so it comes first.

Account data is information about you as a user of ManyRows: the email address you register with, your authentication credentials, your workspace and billing records, and the logs our servers keep. We decide how this is handled, and this notice governs it. In the language of privacy law, we are the controller of account data.

Customer content is what you and your team put into a project: records, types and fields, bills of materials, images, files, comments and history. We process it on the customer’s instructions to run the Services under our customer data processing terms or applicable signed agreement. We do not sell it, mine it for unrelated purposes, or use it to train machine-learning models. We act as a processor for the customer, which determines its purposes and lawful basis; where the customer is itself a processor, it must have the underlying controller’s authority.

Summary of key points

What personal information do we process? Account and contact details, authentication credentials, billing records, technical and usage logs, and any personal information you choose to place in your own project content.

Do we process sensitive personal information? We do not ask for and do not knowingly process sensitive personal information as part of account data. What you place in your own project content is under your control.

Do we receive information from third parties? Your chosen sign-in provider may supply identity details; your workspace administrator or collaborators may supply invitations, contact details and content about you; Stripe provides subscription and payment status. We do not buy personal information from data brokers or advertising networks.

How do we process your information? To provide, secure, bill for, support and improve the Services, to communicate with you about them, and to meet legal obligations.

With whom do we share it? With providers who host, store, bill and deliver service messages, and with recipients authorised by the customer. Their functions and respective roles are in section 5.

Do we sell your information? No. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

How long do we keep it? Specific periods are in section 7, including what happens to your data when you cancel.

What are your rights? Depending on where you live, you may have rights of access, correction, deletion, portability and objection. Section 10 explains how to use them.

1. What information do we collect?

Information you give us. When you register and use the Services we collect your email address, your name or username if you provide one, and your workspace and project names. When you contact us for support, we collect what you put in that message.

Authentication data. We store a cryptographic hash of your password, never the password itself. If you use a passkey we store the public credential; if you use an authenticator app we store the secret needed to verify your codes. These exist only to sign you in.

Shared sign-in and permissions. Our authentication service can support several ManyRows applications. It holds identity-provider details, app memberships, sessions, passkey and consent records, and security events. Removing access to one application does not automatically erase an identity still needed by another. We assess the scope of a request and the purposes for any retained data.

Payment information. Card payments are taken by Stripe on their own hosted checkout page. Card numbers never reach our servers. What we store is the customer and subscription identifiers Stripe gives us, your plan, and its billing status.

Customer content. Whatever you and your team put into a project — records, fields, structures, images, files, comments and their history. This may include personal information about third parties if you choose to model it that way; see the section above on the two kinds of data.

Information collected automatically. When you use the Services we log technical information: IP address, browser and device characteristics, pages and endpoints requested, timestamps, and errors. We use this to keep the Services running, to enforce rate limits, to investigate abuse and faults, and for aggregate analytics. Approximate location may be inferred from an IP address; we do not collect precise geolocation.

Audit records. The Services deliberately keep an audit history of who created and changed what inside a project. That is a product feature your team relies on, and it necessarily records the acting user’s identity against each action.

Privacy requests. We record requests, responses, deadlines, verification outcomes, action history and limited operator evidence. We also retain minimal identifiers needed to prevent revoked access or erased data from returning through old credentials or a backup restoration. Internal evidence is access-restricted and may require reviewed disclosure to protect other people’s rights.

Email and authentication information are necessary to create and secure an account; billing information is needed for a paid subscription. Without them we cannot provide the relevant service. Optional profile details are voluntary. You do not need an account to contact us about privacy.

2. How do we process your information?

We process personal information to: create and administer your account and authenticate you; provide the Services and store the content you put into them; take payment and manage subscriptions, renewals and cancellations; send you service messages such as change-request notifications, approval requests, trial and billing notices, and security alerts; provide support and respond to what you ask us; keep the Services secure, prevent and investigate abuse, and diagnose faults; understand in aggregate how the Services are used so we can improve them; and comply with legal obligations and enforce our terms.

We do not use your information for advertising, and we do not make decisions about you by automated means that have a legal or similarly significant effect.

3. What legal bases do we rely on?

For processing subject to the GDPR or UK GDPR, we use the following bases as applicable to the purpose:

• Performance of a contract — to provide, authenticate and bill for the service when you are the contracting individual.
• Legitimate interests — to administer organisational users and business contacts, provide support and service notices, protect service security and availability, investigate faults and abuse, and retain proportionate legal-claims evidence. We limit the data and access used for these interests and balance them against your rights.
• Legal obligation — to meet applicable data protection, tax, accounting or other duties where that legal basis applies.
• Consent — for processing we ask you to permit separately. You may withdraw it at any time through the stated control or our privacy contact; withdrawal does not affect processing lawfully performed before it.

Where we process customer content, we do so as a processor on the instructions of the customer who controls it, under a contract with them.

If you are located in Canada, we rely on your express or implied consent, with the exceptions applicable law permits.

4. Do we use your data to train AI models?

We do not use your account data or customer content to train machine-learning models, ours or anyone else’s. If you authorise an external AI agent or integration to access the service, it can receive data within the permissions you grant. Review that provider’s terms and revoke its access when it is no longer needed.

The Services include a feature that helps you generate a schema with an AI tool of your own choosing. It works by giving you a specification to copy into whatever assistant you use, and then importing what you paste back. Nothing is transmitted to a model provider by us, and that exchange happens under your own account with that provider and their terms, not ours.

5. When and with whom do we share your personal information?

We do not sell personal information. The service providers and recipient categories are:

• Heroku (Salesforce, Inc.) — application hosting and the managed PostgreSQL database that holds account data and customer content.
• Amazon Web Services — object storage for the images and files uploaded to a project.
• Cloudflare Turnstile, where enabled — checks browser and interaction information to protect authentication forms against automated abuse.
• Stripe, Inc. — payment processing, subscription management and the billing portal. Stripe handles card data as an independent controller under its own privacy policy.
• Transactional email and support mail providers — delivery and handling of service messages, recipient details and support correspondence. This may include CloudMailin or the active SMTP provider for the relevant deployment. Contact us for its identity and processing locations.
• Your selected sign-in providers and authorised recipients — identity verification and data you or your organisation choose to share, publish, export, or expose to connected integrations and AI agents. Their processing may be governed by their own terms.

Our subprocessors process covered customer data under written obligations. We provide the current legal entities, functions and processing locations on request. The customer data processing terms provide advance notice and an opportunity to object to additions or replacements. Google Analytics was used on the marketing website before this update; its tag is now disabled. Previously collected analytics follows the applicable retention and rights procedures.

We may also disclose information where we are legally required to, to establish or defend legal claims, or in connection with a merger, financing, acquisition or sale of assets — in which case we will continue to protect it and will notify you before it becomes subject to a different privacy notice.

We keep provider information current and apply any additional notice or approval requirements in your agreement. Customer-authorised publication and downloaded copies can reach recipients outside our systems; we assist the responsible controller with required follow-up.

6. Where is your information processed?

ManyRows Pty Ltd is an Australian company. Our hosting, storage, payment and email providers operate data centres and support functions in the United States, the European Union and elsewhere, so your information is transferred and processed outside your own country, including outside the EEA, the UK and Australia.

Restricted transfers from the EEA or UK require an applicable adequacy decision or appropriate safeguards, such as the relevant European Commission Standard Contractual Clauses and UK transfer instrument, with assessments and supplementary measures where necessary. Contact us for the countries, applicable mechanism and a copy of safeguards for a particular transfer, with confidential information protected. The customer data processing terms do not themselves replace or execute transfer clauses.

7. How long do we keep your information?

We keep personal information only as long as we need it for the purposes in this notice, unless a longer period is required by law. In practice:

• Records you delete go to a recycle bin and are scheduled for permanent purge after 30 days. Active references or retained revisions can block purge. Unreferenced uploaded files are reclaimed when eligible; files still needed by retained evidence remain stored.
• A workspace that never subscribes is in trial for 7 days. If it is still unsubscribed 7 days after that, it and its content are deleted. We email you before that happens.
• A workspace that has subscribed and then cancels keeps its data for 30 days after the end of the paid period, so a cancellation is recoverable, and is then deleted.
• Audit history and retained evidence serve the customer’s documented recordkeeping purpose, normally for the workspace lifecycle or its configured retention period. Individual requests, legal grounds and retained copies require review; a record’s presence in history does not automatically exempt it from erasure.
• Billing records are retained for as long as tax and accounting law requires, which is longer than the account itself.
• Security and server logs are kept for the operational and investigation period applicable to the system, with case-specific evidence retained only where needed for a documented incident, duty or claim.
• Account and shared identity data are kept while needed for the relevant service or app membership, then removed or minimised after review of applicable requests, obligations and other app use.
• Privacy cases and supporting evidence are retained for handling the request and the necessary accountability or claims period. Minimal revocation identifiers are kept while old credentials or retained/restored data could reinstate access. These records are access-restricted and reviewed for disposal.
• Support messages and historical analytics are kept for the relevant support, follow-up or measurement purpose under the applicable system retention policy, then deleted or minimised.

Backup copies expire under the relevant recovery schedule and are restricted from ordinary use in the meantime. When restoring data, we reapply erasures, restrictions and revocations before returning it to service. Files, noncurrent object versions, caches and processor copies require their own cleanup. Ask us for the applicable period or deletion outcome for your data; we explain any lawful exception and its duration.

You can export portable project bundles containing model definitions, supported records and structures. Asset files, approval history and dedicated workflow evidence require separate downloads or exports. Save the data and evidence you need before deleting anything.

8. How do we keep your information safe?

We use technical and organisational measures appropriate to the risk, including encryption in transit, encryption of stored credentials and secrets, hashed passwords, role-based access control within a workspace, tenant isolation between customers, rate limiting, and audit logging. Access to production systems is limited to those who need it.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law.

9. Do we collect information from minors?

We do not knowingly collect information from, or market to, anyone under 18, and we do not sell such information. By using the Services you confirm you are at least 18. If we learn we hold information from someone under 18, we will delete it. Contact us if you believe that is the case.

10. What are your privacy rights?

Depending on where you live, you may have the right to request access to the personal information we hold about you, to have it corrected or deleted, to receive a portable copy, to restrict or object to certain processing, to withdraw consent where we rely on it, and not to be discriminated against for exercising any of these rights.

Open Profile → Privacy in the application to download local or linked account/auth data, inspect the coverage inventory, submit a request and track responses. The downloads identify their scope and exclusions. Workspace records, files, histories, other applications and external copies may require reviewed delivery; an automatic download is not necessarily the complete answer to an access or portability request.

You may also email [email protected] or use our contact page, including without an account, after access has ended, or through an authorised representative. We may request proportionate information to verify identity or authority. Requests are ordinarily free. Under the GDPR we respond without undue delay and normally within one calendar month; if complexity or number justifies up to two further months, we explain the reasons within the first month.

If your request concerns customer content held in someone else’s workspace — for example if you are an employee or supplier of a ManyRows customer — we are a processor of that content and cannot act on it directly. Please contact that organisation. If you contact us instead, we will refer you to them and assist them in responding.

You can correct supported profile information in the application. You may request human review and contest an applicable significant automated decision. We do not use solely automated decision-making with legal or similarly significant effects for our own account processing. Withdrawal of consent and objections are assessed for the relevant purpose; a case status alone does not stop processing.

If we cannot fulfil all or part of a request, we explain the grounds, any retained categories and applicable periods, and available remedies. You may complain to a supervisory authority, including in the EEA country of your habitual residence, workplace or alleged infringement, or to the UK Information Commissioner, and seek a judicial remedy. In Australia, you may complain to the Office of the Australian Information Commissioner. You do not have to contact us first to complain to an authority.

11. Do we use cookies and other tracking technologies?

The application uses cookies for authentication and session security and stores interface preferences. Blocking required authentication cookies prevents sign-in. The website remembers a language preference when you choose one; fonts are served from our own site.

Google Analytics is disabled on the public website as of this update. We do not load advertising pixels or optional analytics tags. If we introduce nonessential tracking, we will update this notice and provide the applicable consent and withdrawal controls before activating it where consent is required. Accepting service terms is not tracking consent. Previously stored analytics cookies can be removed through your browser settings.

• Sign-in cookies (mr_at_<app-id> and mr_rt_<app-id>) are set by our authentication service for account access and renewal. They expire with the relevant token/session; the duration depends on the app’s session settings and your remember-me choice. Signing out clears the applicable cookies.
• Language cookie (mr_lang) remembers a choice you make on the website for up to one year. You can change the choice or delete the cookie through your browser.
• Local browser storage remembers application language, theme, layout and saved working preferences until changed or cleared. Session storage supports drafts and safe retries during a browser tab’s session and is cleared on completion where applicable or when that session ends.
• Security challenges may use Cloudflare Turnstile on authentication forms when enabled. The challenge processes technical browser and interaction information for abuse prevention; it is separate from optional website analytics.

You can inspect expiry and storage in your browser’s site settings and clear them there. Clearing local drafts can remove unsent work; clearing sign-in cookies ends your browser session. Contact us for the configured session period or security-provider details.

12. Controls for do-not-track features

Most browsers offer a Do-Not-Track (‘DNT’) setting. Because no uniform standard for honouring DNT has been finalised, we do not currently respond to DNT signals. We will revisit this if a standard is adopted.

13. Do United States residents have specific privacy rights?

If you are a resident of a US state with a comprehensive privacy law — including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah or Virginia — you may have the right to know what personal information we hold and how we have processed it, to correct inaccuracies, to obtain a copy, and to have it deleted. We do not sell personal information and do not process it for targeted advertising or profiling with legal effects, so there is nothing to opt out of on those grounds. Use the contact details in section 16 to make a request; you may use an authorised agent where the law allows.

14. Do other regions have specific privacy rights?

Australia and New Zealand. We handle personal information in accordance with Australia’s Privacy Act 1988 and the Australian Privacy Principles, and New Zealand’s Privacy Act 2020. You may request access to or correction of your personal information at any time, and may complain to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.

EEA, UK and Switzerland. See sections 3, 6 and 10 for the legal bases we rely on, how we handle international transfers, and how to exercise your rights.

15. Do we make updates to this notice?

Yes. We will update this notice as our practices or the law change, and we will change the ‘Last updated’ date at the top. If a change materially affects how we handle your personal information, we will tell you directly — by email or in the application — rather than relying on you to notice.

16. How can you contact us, review, update, or delete your data?

For any privacy question or request, email [email protected], or write to ManyRows Pty Ltd via our contact page. You may also ask us to review, correct or delete the personal information we hold about you, as described in section 10.