Legal

Privacy notice

Last updated: 11 July 2026

Mandact processes personal data because a mandate binds an agent to a real legal person — that is the point of the product. This notice says which data, for what purpose, and how long.

1. Controller

Innopulse Consulting GmbH, Gotthardstrasse 30, 6300 Zug, Switzerland.
Data protection contact: hello@mandact.com

2. Which data we process

Account data: email address, display name, organisation, role.
Mandate data: what you authorise an agent to do — action types, limits, counterparties, validity period — plus the identity root of the principal.
Decision data: every verification with its reason code, timestamp, and signature. This is the evidence chain.
Technical data: log data required to operate and secure the service.

3. Purposes and legal bases

Processing serves contract performance (providing the service), legal obligations (retention, accounting), and legitimate interests (security, abuse prevention). Where consent is required, it is obtained separately and can be withdrawn.

4. Processors

We use processors for hosting, database, email delivery, and payments. Primary data residency is the EU (Frankfurt). The German version lists the processors individually, including the ones that may involve a transfer outside the EU/EEA and the safeguards that apply.

5. Retention

Account data is deleted when the account is deleted. Verification receipts are retained in anonymised form: they are the record that a check happened before an action, and deleting them would remove the protection of both sides of a past transaction. Statutory accounting retention periods apply independently.

6. Security

Data is encrypted in transit and at rest, access is scoped per tenant at the database level, and administrative actions require a second factor. The evidence chain is append-only and hash-chained, which makes later changes detectable — not impossible.

7. Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR and the revised Swiss FADP. A full JSON export is available directly in the app under Account. Requests go to hello@mandact.com; you may also lodge a complaint with a supervisory authority.

8. Cookies

We set only what the service needs: a session cookie after sign-in and a language preference cookie (mandact_locale, one year) so your language choice survives the next visit. No advertising or cross-site tracking cookies.

9. Automated decisions

Mandact makes automated decisions by design: allow, deny, or escalate. Each decision carries a stable reason code and is contestable — that is what the disputes function exists for. Decisions above the configured threshold are escalated to a human rather than decided automatically.

10. Changes

Material changes are announced before they take effect.