Sub-processors
These are the third parties that process data on behalf of MANO PLATFORMS LTD when you use Mano. For each one: what it does, what personal data it touches, and where it runs.
This list is derived from what the application actually depends on at runtime, not from memory. If you need it as part of a vendor review, everything you need is on this page.
Who processes data for Mano
Shopify
The platform Mano integrates with. Source of every order, customer and return record, and the channel every webhook arrives on.
Personal dataCustomer name, email, phone, order and return data. Shopify is the origin, not a recipient.
WhereMerchant's own Shopify region
Vercel
Application hosting, serverless compute and edge network. Every request passes through it.
Personal dataAll data in transit; request logs (IP, user agent, path).
WhereUS (primary), global edge
Neon
Managed PostgreSQL. The only place Mano stores data at rest, including customer personal data and the encrypted Shopify access token.
Personal dataEverything in the retention schedule.
WhereUS
Clerk
Authentication for merchant staff. Not shopper-facing.
Personal dataMerchant user email, session data, and the sign-in method chosen.
WhereUS
Resend
Transactional email: merchant notifications, the digest, and data-request acknowledgements.
Personal dataRecipient email address and message content.
WhereUS
Anthropic
AI-assisted reading of a merchant’s written returns policy. When a merchant asks Mano to analyse their policy, the policy text is sent to Anthropic’s API section by section, with Mano’s fixed extraction instructions, and the model proposes the three Policy V1 rules (return window, excluded items, return reasons not accepted) for the merchant to review. It proposes only: nothing becomes active until the merchant approves it.
Personal dataThe merchant-provided returns-policy text and Mano’s fixed instructions. No customer names, emails, phone numbers, orders, returns, addresses, Shopify or workspace tokens, or billing data are sent. Anthropic states that API inputs and outputs are deleted from its systems within 30 days by default; Mano does not currently hold a zero-data-retention agreement.
WhereUS
Sentry
Error monitoring and stack traces.
Personal dataIncidental only: whatever appears in an error context. Not a deliberate store of personal data, but it is not guaranteed free of it and is treated as in scope.
WhereUS
Named because people ask
These are third parties you might expect to find on the list. They are not on it, and this is why.
StripeNo longer used. Mano bills through Shopify (App Pricing): the merchant chooses and approves a plan on Shopify’s own hosted page, Shopify takes the payment, and Mano only reads the resulting subscription. Mano never sees or handles card details, and no code path sends anything to Stripe: the entire purchase and management rail was removed. Listed here rather than omitted because Stripe was previously named as the payment processor on this page, and a reader who checked before deserves to see what changed.
Google FontsFonts are self-hosted from Mano’s own origin: the font files are committed to Mano’s own repository and served by Mano. No request reaches Google at build time or at runtime, so no visitor data is shared with Google at any stage.
Cloudflare TurnstileNot used by Mano’s own code. It is the bot-protection widget Clerk can show on sign-in, so if it appears it is a sub-processor of Clerk rather than a direct relationship of Mano’s. It remains permitted in our content-security policy for that reason.
Google (sign-in)Reachable only as a sign-in option offered by Clerk, and brokered by Clerk. A sub-processor of Clerk rather than a direct relationship of Mano’s, listed here for completeness.
What we do not yet promise
There is no automatic notification when this list changes. A standard data-processing agreement gives you advance notice of a new sub-processor and a right to object. Mano does not have that mechanism yet, so the honest position is that this page is where changes appear, and you should check it rather than expect an email.
Every sub-processor above except Shopify is hosted in the United States. The formal transfer mechanism for that (standard contractual clauses or the UK addendum) is not yet settled, and we will not describe it as settled before it is.
Related
Privacy policy · Data processing agreement · Security
Questions about anything on this page: security@mano.help