Privacy Policy

1. In short

We collect only what we need to create your stories, bill the subscription and talk to you. We do not sell personal data. You can delete everything in Account, at any time, in two taps.

2. Who is responsible

Manifest (legal entity to be defined) is the controller of the personal data processed by Manifest. Contact for privacy matters: [support email to be defined].

3. Data we collect

Questionnaire answers: name, city, gender, relationship status, the names and roles of the people you choose to include, feelings, wishes, dream place, home, what holds you back, what stayed from the past and how you want to work. You choose how much to tell: what you leave out does not go into the story.

Email: to save your stories and send your access, receipts and subscription notices.

Voice recording: only if you choose narration in your own voice and expressly consent on screen. The recording is used solely to create the synthetic voice that narrates your stories. If you do not complete the purchase, the recording is deleted.

Payment data: name, email, country and the last digits of your card, processed by Stripe. Your full card number never passes through our servers.

Technical data: IP address, device and browser type, language, access times and the cookies described below.

What we generate for you: titles, stories, cover images, audio files and a record of what you listened to.

4. How we use it

To generate and narrate your stories (AI text and cover image, synthetic voice); show the preview and apply the preview and daily story limits; process payments, renewals, cancellations and refunds; send access, receipt, renewal reminder and support emails; prevent fraud and abuse; meet legal obligations; and improve the service with aggregated data that does not identify you.

News emails only with your consent, which you can withdraw in any message or by writing to support.

Legal bases (LGPD and GDPR): performance of the contract (generating the stories, billing), consent (voice recording, news emails), legitimate interest (security, fraud prevention, aggregated improvement) and legal obligation (tax records).

We do not use your answers, stories or voice recording to train AI models. The providers below receive only what is needed to fulfil each request, under contracts that limit the use of the data to that purpose.

5. Who we share it with

Providers that process data on our behalf, each with only what it needs: Stripe (payments, including Apple Pay and Google Pay); Anthropic (generation of the story text and of the conversation replies, from your answers); ElevenLabs (synthetic voice for the stories and, if you choose it, the voice created from your recording); Google (Google Pay at checkout; the Gemini API, which generates the cover image of each story and receives, for that purpose, the story title, which may contain first names given in your answers, the story premise, the dream place, the home type and the gender; and traffic measurement tools, when enabled); Vercel (website hosting, servers and storage of the audio files).

Some of these providers are located in the United States. International transfers follow the safeguards set out in the LGPD and the GDPR, such as standard contractual clauses.

We may also share data when the law requires it, to protect rights and safety, or in a corporate reorganization, keeping this policy in place. We do not sell personal data and we do not share it for third-party advertising.

6. Cookies

We use few cookies, all needed for the service to work: mf_lead (a signed session that identifies your account on this device), mf_dev (a device identifier, to count free previews) and mf_lang (your chosen language). They last up to 180 days. Stripe may set its own cookies at checkout to prevent fraud. We do not use advertising cookies.

7. How long we keep it

Answers, stories and audio: for as long as your account exists. Accounts with no subscription and no access for 12 months are deleted.

Voice recording: deleted immediately if you do not complete the purchase; if you do, kept while narration in your voice is active.

Payment records: for as long as tax and accounting law requires. Technical security logs: up to 12 months.

When you ask us to delete, we remove the data from active systems within 30 days and from backups in the following cycle.

8. Your rights

You can: access the data we hold about you; correct what is wrong; delete your data (Delete my data, in Account, removes answers, stories, audio and voice recording, keeping only what tax law requires about payments); receive a copy in a readable format (portability); withdraw consents; object to processing based on legitimate interest; and know who we share data with.

These rights apply to everyone, based on the LGPD (Brazil), the GDPR (European Union and United Kingdom) and the CCPA/CPRA (California), among other laws. Requests: [support email to be defined]. We reply within 15 days (LGPD) or 30 days (GDPR and CCPA), periods the law allows us to extend in complex cases. You can also complain to the data protection authority of your country (in Brazil, the ANPD).

For California residents: we do not sell or share personal data for targeted advertising, we do not use sensitive information for inferences, and you will not be treated differently for exercising your rights.

9. Security

Encrypted transmission (HTTPS), signed httpOnly cookies, system access restricted to those who need it, and providers with recognized security certifications. No system is completely secure: if an incident affects you, we will notify you as the law requires.

10. Under 18

Manifest is not intended for people under 18 and we do not knowingly collect their data. If you believe a minor has used the service, write to support and we will delete the data.

11. Changes

The current version is on this page, with the date at the top. Relevant changes are announced by email or on screen.

12. Contact

Questions, requests about your data or complaints: [support email to be defined].