Privacy Policy

What Manilla is

Manilla is a tool that lets a freelancer or small business (the “account holder”) build a request for files, documents, or short answers, and send it to a client as a single link. The client fills it in without creating an account of their own. This policy covers both account holders and the clients who use a request link.

What we collect

• Account data: the email and password used to sign up (handled by Supabase Auth), plus a display name, brand color, and optional logo you add to your profile.
• Request data: the titles, field labels, and settings you create when building a request, and any client label or client email you attach to it.
• Client submissions: whatever a client uploads or answers through a request link — files, short or long text answers, yes/no responses, or a submitted link.

How it’s used

Collected data is used only to run the product: authenticating you, storing and displaying your requests, delivering uploaded files back to you, and showing status as a client completes a request. We do not use request or submission content for advertising, and we do not sell any of this data to third parties.

Where it’s stored

Account records, request data, and uploaded files are stored with Supabase (database, authentication, and file storage), hosted in the United States. Notification emails are sent through Resend. Payments are handled by Razorpay (INR subscriptions) or PayPal (existing USD accounts) — card numbers, UPI IDs and bank details go straight to whichever processor you’re on, and Manilla never stores them. See Subprocessors for the full list of every service that touches your data, including the two analytics tools mentioned below.

Client request links

A request link works like a password: anyone who has it can open and submit the request it belongs to, without a separate login. Account holders are responsible for sharing request links only with their intended client. If a link is shared more widely than intended, treat it as compromised and contact us to have it reset.

AI request builder

The AI assistant in the request builder sends your title, field list, and instruction to Groq to generate suggested fields. If you attach a photo or scan, or if Groq can’t complete the request, it falls back to Google’s Gemini API. That fallback currently runs on Google’s free tier, which means Google may use what’s sent to it to improve its own products — we’ll say so again in the product before your first image goes through it, and this will change once the project is moved to a paid tier. Using the AI assistant is always optional; every field can be built and edited by hand instead.

Cookies and analytics

Manilla uses a session cookie, set by Supabase Auth, to keep you signed in between visits — this one is essential and isn’t optional, the same way it wouldn’t be for a bank or an email provider.

Beyond that, we use two things, and treat them differently:

• Product analytics (PostHog). Tells us whether signing up and sending a request actually works end to end — not what a client submitted, only that a step happened. This does not run until you actively accept it from the banner shown on your first visit. Decline it, or simply ignore the banner, and it never loads. There is no advertising or marketing tracking of any kind, accepted or not.
• Error tracking (Sentry). Catches crashes so we can fix them before you have to report one. It runs without asking, because it is configured to not collect your IP address or any identifying information — only the technical detail of what broke and where. We are not lawyers and this isn’t a legal determination that error tracking falls outside what the DPDP Act requires consent for; it is the engineering choice that let us make that argument honestly, by scrubbing what would have made it personal data in the first place.

One more small thing, and it is not a third-party tracker. If you arrive from a link that carries a campaign tag (for example ?utm_source=producthunt) or from another website, Manilla saves one short label in your browser’s local storage, such as “producthunt” or “reddit.com”, plus the page you landed on. It is sent nowhere until you create an account, at which point it is saved on your account so we can tell which channels bring useful signups. It contains no IP address and nothing about what you did on the site. A visit with no campaign tag and no referring site saves nothing. You can clear it any time by clearing site data in your browser.

Both of those are third-party processors, not advertisers we share data with for their own purposes — see “How it’s used” above.

Data retention and deletion

We don’t yet have a formal, automated retention schedule. If you want your account, your requests, or a client’s submitted data deleted, email us and we’ll handle it manually.

Who’s responsible for what

Manilla is infrastructure for the account holder’s own client relationships — we are not a party to those relationships. Account holders are responsible for having a lawful basis to request the information and files they ask their clients for, and for how they use whatever is submitted back to them.

Changes to this policy

This policy will change as the product does. Material changes will be reflected on this page; there is no separate notification mechanism yet.

Contact

Questions about this policy can go to help@usemanilla.in.