Privacy Policy

This Privacy Policy describes how Mantle, Inc. (“Mantle,” “we,” “our,” or “us”) collects, uses, shares, retains, and protects personal data when you visit our website, engage with our sales or marketing communications, or enter into a commercial engagement with us. It also explains the rights you have over your personal data under applicable law, and how to exercise them.

Mantle is headquartered in Delaware, United States, with team members operating across North America, Europe, and the Middle East. We process personal data of individuals in the European Economic Area, the United Kingdom, the United States, the Kingdom of Saudi Arabia, the United Arab Emirates, and other jurisdictions.

1. Who we are

Mantle, Inc. is the controller of the personal data described in this policy. Our registered office is 16192 Coastal Highway, Lewes, Delaware 19958, United States.

For privacy inquiries, exercise of rights, or complaints, please contact us at privacy@mantlenow.com. If you are a resident of the European Union, the United Kingdom, Saudi Arabia, or the United Arab Emirates and require a local point of contact, we will provide one on request through the same channel.

2. What we collect

We collect personal data in three broad categories: information you provide to us directly, information we receive automatically when you interact with our website or products, and information we obtain from third-party sources.

2.1 Information you provide directly

When you fill in a form on our site, enter into a commercial relationship with us, attend an event we host, or otherwise communicate with us, we may collect:

• Name, job title, and the organization you represent
• Business email address and business phone number
• The country and, where relevant, the city in which you are based
• The nature of your inquiry, including any free-text message you choose to send
• How you learned about Mantle
• Information you choose to include in correspondence with us (including attachments)
• For commercial engagements: contracting party, billing information, signatory details, tax identifiers required by law, and any personal data that appears within the engagement scope

2.2 Information we collect automatically

When you visit our website, our servers and any analytics tools we operate may receive the following:

• IP address and approximate location derived from it
• Device, browser, and operating system identifiers
• Pages visited, time spent on each page, referring URL, and clickstream data
• Cookies and similar identifiers (see Cookies and tracking)

2.3 Information from third parties

We may receive limited personal data from:

• Customers and prospects who introduce you to us as a relevant contact within their organization
• Business-information providers who lawfully maintain professional databases (for example, professional networks where contact information is published by you)
• Joint marketing partners and event co-hosts where you have consented to share information with both parties
• Public sources such as a company’s public website, regulatory filings, or press releases

2.4 Website chat

Our website offers a chat with Maya, Mantle’s AI assistant. Maya is an automated assistant, not a person. When you use the chat, we collect and record:

• The messages you send and Maya’s replies (the chat transcript)
• Any details you choose to share so our team can follow up, such as your name, organization, email address, phone number, and scheduling preferences
• How you heard about Mantle, if you tell Maya when she asks, and the campaign tags of the link that brought you to our website, if it had any
• The pages of our website you were viewing while you chatted, the language of the chat, and the time it took place
• Your IP address, used only to protect the chat from abuse and not stored with the transcript

We use this information to answer your questions, pass your request to the right person at Mantle, and follow up as you asked. Chat transcripts and the requests captured in them are available to authorized Mantle staff. To generate replies, your messages are processed by our AI model provider and our hosting provider, acting as our service providers under the terms described in How we share data. Please don’t share passwords, payment card numbers, or other sensitive information in the chat.

2.5 Phone calls with Maya

Calls to our phone line, +1 (888) 730-6292, are answered by Maya, Mantle’s AI assistant. Maya is an automated assistant, not a person, and she tells you at the start of each call that it is transcribed. When you call, we collect and record:

• A written transcript of the call (what you say and Maya’s replies). We do not keep an audio recording of the call.
• The phone number you call from (caller ID)
• Any details you choose to share so our team can follow up, such as your name, organization, email address, phone number, and scheduling preferences, or the details of a problem you report
• How you heard about Mantle, if you tell Maya when she asks
• The time and length of the call and the language it was held in

We use this information to answer your questions, pass your request to the right person at Mantle, follow up as you asked, and for training and quality purposes, such as reviewing calls to improve Maya’s answers. Call transcripts and the requests captured in them are available to authorized Mantle staff. To handle the call, your voice and the conversation are processed by our service providers for telephony, speech-to-text, voice generation, AI replies, and hosting, acting as our service providers under the terms described in How we share data. Our telephony provider also keeps standard call records (the phone numbers involved, and the time and length of the call). If you would rather not be transcribed, you can end the call at any time and reach us through our contact page instead. Please don’t share passwords, payment card numbers, or other sensitive information on the call.

3. Why we collect it

We process personal data for the following purposes:

• To respond to your inquiries. When you contact us, we use your information to address your question and arrange follow-up.
• To deliver our services. Where we have entered into an agreement with you or the organization you represent, we use personal data to perform the engagement.
• To communicate about Mantle. We may send you operational updates and, where permitted, marketing communications you can withdraw from at any time.
• To improve our website and products. Aggregated analytics help us understand how our website is used and where we can improve.
• To meet legal and regulatory obligations. Tax, accounting, anti-money-laundering, sanctions screening, and other statutory requirements apply to commercial engagements.
• To protect Mantle, our customers, and the public. We process information to detect fraud, prevent abuse of our systems, defend or pursue legal claims, and respond to lawful requests by competent authorities.

4. Lawful bases for processing

Where the EU/UK GDPR or the UAE PDPL applies to our processing, we rely on one or more of the following lawful bases for each processing activity:

• Performance of a contract: to deliver an engagement you or your organization has entered into with us.
• Legitimate interests: where we have a clearly identified business interest, such as understanding which prospects engage with our content, that is not overridden by your rights and interests. We have considered whether each such activity is reasonable, proportionate, and would be expected by a reasonable individual in your position.
• Consent: for purposes that require it, such as marketing communications to individual subscribers in jurisdictions where consent is required, or non-essential cookies.
• Legal obligation: where the law requires us to retain, disclose, or otherwise process information.

Where the Saudi Arabia PDPL applies, we rely on the lawful bases set out in Article 5 of the PDPL, including performance of a contract, compliance with a legal obligation, and legitimate interest as defined in the PDPL Implementing Regulations. Where consent is required under the PDPL, we obtain it before processing begins.

Where the California CCPA/CPRA applies, we process personal information for the business purposes disclosed in this notice and do not sell or share personal information as those terms are defined in the CCPA.

5. How we share data

Mantle does not sell personal data. We share personal data only with the following categories of recipient, and only to the extent necessary for the purposes set out in this policy:

• Service providers and processors acting on our instructions, including hosting providers, communications platforms, contact-form delivery services, analytics providers, payment processors, and professional advisors. Each such provider is bound by written terms requiring them to process personal data only for the purposes we specify, to maintain appropriate security, and to return or delete data at the end of the engagement.
• Customers and engagement counterparties, where doing so is necessary to deliver a service or to coordinate a meeting you have requested.
• Auditors, regulators, and legal advisors where required by law, regulation, or legal process, or where necessary to establish, exercise, or defend a legal claim.
• An acquirer or successor in the event of a merger, acquisition, financing, restructuring, or sale of assets, subject to confidentiality obligations and continuing application of this policy.

Where personal data is processed by an Mantle service provider on our behalf, we enter into a written agreement that incorporates the Standard Contractual Clauses or other applicable transfer mechanism as required.

6. International transfers

Mantle operates internationally. Personal data we collect may be transferred to, stored in, or processed in countries other than the country in which you are located, including the United States, member states of the European Union, the United Kingdom, the Kingdom of Saudi Arabia, the United Arab Emirates, and any other country where Mantle or its service providers operate.

When personal data is transferred out of the European Economic Area, the United Kingdom, Saudi Arabia, or the United Arab Emirates to a country that has not been recognized as providing an adequate level of data protection by the relevant authority, we put in place appropriate safeguards. These may include:

• The European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable)
• Binding Corporate Rules where adopted
• The transfer mechanisms set out in Article 29 of the Saudi PDPL Implementing Regulations
• The transfer mechanisms set out in Article 22 of the UAE PDPL and its Executive Regulations
• Other lawful transfer mechanisms recognized by the applicable supervisory authority

You may request a copy of the transfer mechanism we rely on for a specific transfer by contacting us at privacy@mantlenow.com.

7. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, or regulatory requirements. Our default retention periods are:

Category	Typical retention period
Contact form submissions and inquiry correspondence	24 months from last interaction, then deleted or anonymized
Website chat transcripts and requests captured in the chat	24 months from last interaction, then deleted or anonymized
Phone call transcripts, caller numbers, and requests captured on calls with Maya	24 months from last interaction, then deleted or anonymized
Marketing contact records (subscribers)	Until you withdraw consent or unsubscribe, plus a short period for suppression-list management
Commercial engagement records	The duration of the engagement plus a period required by applicable contract, tax, audit, or limitation-period rules (typically 6 to 10 years)
Server access logs	90 days, except where retained longer for security investigation
Analytics aggregates	Indefinitely as anonymized statistics that do not identify any individual

At the end of the applicable retention period, we delete personal data or render it anonymous in a manner that does not allow re-identification.

8. Security

Mantle implements technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, and destruction. These measures include encryption in transit, access controls and least-privilege provisioning, logging and monitoring, vendor due diligence, secure software development practices, and personnel confidentiality obligations.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required by law, you, within the timeframes set out in the applicable regulation (72 hours under GDPR; 72 hours under KSA PDPL; the period prescribed by the UAE PDPL Executive Regulations; the period prescribed by California law for affected California residents).

9. Your rights

Subject to the conditions and exemptions set out in applicable law, you have the following rights in respect of your personal data:

Access

You may ask whether we hold personal data about you, and request a copy.

Rectification

You may ask us to correct inaccurate or incomplete personal data.

Deletion / erasure

You may ask us to delete personal data where one of the bases recognized by applicable law applies.

Restriction of processing

You may ask us to limit the way we process your personal data in certain circumstances.

Objection

You may object to processing carried out on the basis of our legitimate interests, and to direct marketing at any time.

Portability

Where processing is based on consent or contract and is carried out by automated means, you may ask us to provide your personal data in a structured, commonly used, machine-readable format, or to transmit it to another controller where technically feasible.

Withdrawal of consent

Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Not to be subject to a decision based solely on automated processing

Including profiling, that produces legal effects concerning you or similarly significantly affects you, except as permitted by law.

Complaint to a supervisory authority

You have the right to lodge a complaint with the data-protection authority in your jurisdiction. We would, of course, appreciate the opportunity to address your concern directly first.

To exercise any right, please contact us at privacy@mantlenow.com. We will respond within the statutory timeframe applicable to your jurisdiction (typically 30 days, extendable for complex requests). We may need to verify your identity before fulfilling a request.

10. Regional disclosures

10.1 European Economic Area and United Kingdom (GDPR and UK GDPR)

If you are in the EEA or the United Kingdom, Mantle is the controller of your personal data as defined in Article 4(7) of the GDPR. The lawful bases on which we rely for each processing activity are set out in Section 4. You have the rights listed in Section 9. The competent supervisory authority for the EEA depends on your country of residence; in the UK, the supervisory authority is the Information Commissioner’s Office (ICO).

10.2 California, USA (CCPA / CPRA)

If you are a California resident, the CCPA (as amended by the CPRA) gives you specific rights regarding your personal information. In the 12 months preceding the effective date of this policy, we have collected the categories of personal information described in Section 2 and processed them for the purposes described in Section 3. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes other than those permitted under section 7027 of the CCPA Regulations. Your California rights include the right to know what personal information we have collected, the right to delete it (subject to exceptions), the right to correct it, the right to limit our use of sensitive personal information, and the right not to be discriminated against for exercising any of these rights. To exercise these rights, contact us at privacy@mantlenow.com; an authorized agent may submit a request on your behalf in accordance with applicable regulations.

10.3 Kingdom of Saudi Arabia (PDPL)

If you are in the Kingdom of Saudi Arabia, our processing complies with the Personal Data Protection Law (PDPL) issued by Royal Decree M/19 of 1443H and the Implementing Regulations. Mantle is the data controller as defined in the PDPL. The PDPL grants you the right to be informed, the right to access, the right to obtain a copy, the right to request correction, the right to request destruction, and the right to withdraw consent. You may submit a complaint to the Saudi Data & Artificial Intelligence Authority (SDAIA) if you believe we have breached the PDPL.

10.4 United Arab Emirates (PDPL)

If you are in the United Arab Emirates, our processing complies with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and its Executive Regulations. Mantle is the controller of your personal data. The UAE PDPL grants you the right to information, the right of access, the right of rectification, the right of erasure, the right to restrict processing, the right to data portability, the right to object, and the right to withdraw consent. You may submit a complaint to the UAE Data Office.

11. Cookies and tracking

Mantle’s website uses cookies and similar technologies. These fall into three categories:

• Strictly necessary: cookies required for the website to function and for security. These do not require consent.
• Performance / analytics: cookies that help us understand how visitors use the site so we can improve it. Where required by law, we obtain your consent before setting these.
• Functional / preferences: cookies that remember choices you have made, such as language or region.

You can manage cookie preferences through your browser settings and, where we provide one, through our cookie-preference centre. Blocking strictly necessary cookies may impair website functionality.

12. Children

Mantle’s website and services are not directed at children under the age of 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at privacy@mantlenow.com and we will take appropriate action to delete it.

13. AI and automated processing

Mantle delivers solutions that include artificial intelligence and automated decision-making capabilities. When personal data is processed within a customer engagement that uses these capabilities, the customer is the controller of that processing and Mantle acts as a processor under the terms of the engagement agreement. Personal data processed on our website (including the contact form and the website chat) is not used to train Mantle’s or any third party’s AI models without explicit prior consent. The website chat is answered by an AI assistant; it can answer questions and pass your request to our team, but it does not make decisions about you. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you on this website.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page and, where the change is material, provide additional notice (for example, by a banner on our website or by email to subscribers, as appropriate). We encourage you to review this page periodically.

15. How to contact us

For any question about this Privacy Policy or about how Mantle processes your personal data, including to exercise any right described above:

• Email: privacy@mantlenow.com
• Sales & partnerships: sales@mantlenow.com
• Postal address: Mantle, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, United States

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your jurisdiction.