Privacy Policy

Overview

Mantis ("we," "us," or "our") operates the SEO auditing platform at usemantis.app. This Privacy Policy describes how we collect, use, store, and share information about you when you use our Service.

This policy applies to all users of usemantis.app, api.usemantis.app, and any related tools or communications. By using the Service, you agree to the practices described in this policy.

Data We Collect

2.1 Account Data

When you create an Account, we collect:

• Email address — used for authentication, billing, and transactional notifications.
• Name — displayed in your profile and used in emails.
• Password (hashed) — stored using Node.js scrypt. We never store plaintext passwords.
• Avatar URL — optional profile image.

2.2 Billing Data

Payment processing is handled entirely by Paddle. Mantis does not store credit card numbers, CVVs, or bank account details. We retain:

• Paddle customer ID and subscription ID for account management.
• Plan tier, billing period start/end dates, and subscription status.
• Balance top-up amounts and transaction timestamps.

2.3 Usage & Activity Data

We log the following user activity with associated IP addresses and timestamps:

• Authentication events (logins, logouts, password resets, OTP requests).
• Site registrations and deletions.
• Scan jobs started, completed, or failed.
• Balance top-ups and charges.
• Fix approvals and dismissals.
• Plan upgrades, downgrades, and cancellations.
• JS snippet installations and verifications.

Activity logs are retained indefinitely for security, abuse prevention, billing disputes, and support purposes.

2.4 Crawl & Scan Data

When you initiate a scan, we collect and process:

• The URLs you submit for crawling.
• HTML content, meta tags, headings, link structures, and structured data extracted from crawled pages.
• Page performance metrics (load times, PageSpeed Insights scores).
• SEO issue types and severity scores assigned to each page.
• GEO readiness scores per AI search engine.
• AI-generated fix suggestions associated with each issue.

2.5 Technical Data

We automatically collect technical information to operate and improve the Service:

• IP address (logged on every request for security and activity tracking).
• Browser type, operating system, and device type (via User-Agent header).
• Request timestamps and API response codes.
• Session tokens (JWTs and refresh tokens stored server-side in Redis).

2.6 JS Snippet Data

If you install our JavaScript snippet on your website, the snippet pings our API on each page load. We receive the page URL, your site ID, your snippet token, and the visitor's IP address. The snippet also detects your CMS type (e.g., WordPress, Shopify). We do not track your website's visitors beyond this.

How We Use Your Data

How We Share Your Data

We do not sell, rent, or trade your personal data. We share data only in the limited circumstances below:

• Service providers: We share necessary data with Paddle (payments — Paddle is our merchant of record and processes your payment details under its own privacy policy), Resend (email delivery), OpenAI (AI processing of page content), Groq and Cloudflare (answering messages you send to Twiggy, our AI support assistant), Bright Data (web crawling infrastructure), and our cloud hosting providers. Each is bound by data processing agreements.
• Legal requirements: We may disclose data if required by law, court order, or government authority, or to protect the rights, property, or safety of Mantis, our users, or the public.
• Business transfers: If Mantis is acquired, merged, or undergoes a change of control, your data may be transferred to the acquiring entity, subject to equivalent privacy protections. We will notify you of any such transfer.
• With your consent: We may share data for any other purpose with your explicit consent.

Cookies & Tracking

5.1 Cookies & Browser Storage We Use

We only use first-party cookies and browser storage that the Service needs to work. Your sign-in tokens and the signed-in cookie are removed from your browser when you sign out.

5.2 No Third-Party Ad Tracking

We do not use third-party advertising cookies, social media tracking pixels, or behavioral analytics SDKs. We do not participate in cross-site tracking.

Data Retention

Upon account deletion, we remove your personal profile data and scan history within 30 days. Billing records and activity logs may be retained longer where required by law or to resolve outstanding disputes.

Security

We implement appropriate technical and organizational measures to protect your data:

• All data in transit is encrypted via TLS 1.2+.
• Passwords are hashed with Node.js scrypt — a memory-hard algorithm designed to resist brute-force attacks.
• Refresh tokens are single-use, rotated on every exchange, and revoked on logout.
• Authentication is rate-limited to prevent credential stuffing.
• Database access is restricted to the application layer; no public database endpoints are exposed.
• Redis is configured with noeviction policy to prevent silent data loss.

No system is perfectly secure. If you discover a security vulnerability, please disclose it responsibly to security@usemantis.app.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent (e.g., marketing emails).

To exercise any of these rights, contact us at privacy@usemantis.app. We will respond within 30 days.

Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@usemantis.app and we will delete it promptly.

International Transfers

Mantis operates servers in Europe (Contabo VPS) and uses services with global infrastructure (Paddle, OpenAI, Groq, Cloudflare, Bright Data, Resend). Groq is based in the United States. Your data may be processed and stored in jurisdictions outside your own.

Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent mechanisms as required by applicable data protection law.

Third-Party Services

Each provider has their own privacy policy governing their use of data. We encourage you to review them if you have concerns about a specific provider.

AI Processing

Mantis uses OpenAI's GPT-4o model to generate SEO issue reports, fix suggestions, and GEO readiness scores. When you run a scan, the content extracted from your pages (HTML structure, meta tags, headings, visible text, link structure) is sent to the OpenAI API for processing.

We send only the structured page content necessary for analysis — we do not send your Account details, billing information, or other personal data to OpenAI. OpenAI's data usage policies apply to this processing. Mantis has opted out of OpenAI's data-training program for API calls.

Twiggy, our AI support assistant

When you use Twiggy on usemantis.app while signed in, the messages in your conversation and the name of your plan are sent to an AI model run by Groq or, as a backup, by Cloudflare Workers AI, to produce an answer. The request comes from our servers, so the providers don't receive your IP address. Twiggy does not receive your email address, billing details, website data or scan results, and it cannot see or change your account. Neither provider uses these messages to train its models. Our Groq account is set to zero data retention, so Groq does not store your messages or Twiggy's answers. If Cloudflare is used as the backup, it may keep messages for a short period for security and abuse monitoring, under its own terms.

We don’t store Twiggy conversations on our servers: the conversation stays in your browser tab and is cleared when you close it or start a new one. We only keep a daily count of messages and tokens per account, to apply fair-use limits. If you choose “Talk to a person”, the conversation (and any note you add) is sent to our support team and kept as a support ticket. Answers are AI-generated and can be wrong; please don’t share passwords, card numbers or other sensitive details with Twiggy.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date and, where the changes are significant, notify you by email. Your continued use of the Service after the updated policy takes effect constitutes acceptance.

Contact

For privacy-related questions, data access requests, or to exercise your rights, contact us: