1. Introduction
ManuHive ("we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and share your data when you use the ManuHive platform.
This policy applies to all users of the Service, including Workspace owners, team members, and visitors to our website. We process data in compliance with the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), Greek Law 4624/2019, and the ePrivacy Directive. People sign up from many countries. Wherever you live, this policy and the rights in section 9 apply to you, and where the law of your own country gives you further rights, we respect those too.
This policy is published in English, Greek and German. If the language versions differ, the English version prevails.
2. Who Is Responsible for Your Data
ManuHive, based in Thessaloniki, Greece, is the controller of the personal data we process for our own purposes: your account and sign-in details, billing, support conversations, security logs and the analytics of our website. For data protection questions, contact us at manuhiveos@gmail.com.
The data an organization enters in its Workspace (its orders and products, its customers and suppliers, the names and work records of its people, delivery details and files) is that organization's data. For it, the organization is the controller and ManuHive processes the data on its behalf as a processor, under our Data Processing Agreement. If your data was entered by an organization that uses ManuHive, for example your employer or a company you buy from, please contact that organization first; we will help it answer you. The Data Processing Agreement is published at manuhive.com/dpa.
3. Data We Collect
Account Information
- Full name, email address, and profile avatar.
- Workspace name, organization details, country, and timezone.
- Sign-in details: passwords are stored only as hashes (bcrypt), never in plain text. PINs for machines and people are kept in a restricted store that only the Workspace's administrators can read.
Business Data in Workspaces (processed for our customers, see section 2)
- Manufacturing jobs, orders, stock, and customer records you create.
- Custom field data and file attachments uploaded to jobs.
- Logistics data: shipping addresses, tracking numbers, delivery photos, driver assignments, and the location of a driver who shares it while driving a delivery route (visible only to administrators and logistics staff, and deleted when the route ends).
- Work records (which person worked on which step of work, when and for how long) and the analytics and schedules calculated from them.
- ERP connection credentials (kept encrypted in a secrets vault) and the data synced from your ERP system.
Automatically Collected Data
- Browser type and device information, and a country worked out from your device's time zone. IP addresses are kept in sign-in sessions, which end after 30 days without use, in security logs and, for 30 days, with failed PIN attempts.
- Usage data: pages visited, features used, actions performed.
- Authentication logs and session data.
4. Legal Basis for Processing (GDPR Art. 6)
- Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service under our Terms.
- Legitimate interest (Art. 6(1)(f)): Security monitoring, fraud prevention, and service improvement.
- Legal obligation (Art. 6(1)(c)): Tax records, regulatory compliance, and responding to lawful requests.
- Consent (Art. 6(1)(a)): Marketing communications and optional analytics cookies (you may withdraw consent at any time).
5. How We Use Your Data
- Providing, maintaining, and improving the Service.
- Processing payments and managing subscriptions via Stripe.
- Sending transactional emails (account verification, password resets, workspace invitations, notifications).
- Monitoring security, detecting abuse, and preventing unauthorized access. The sign-up, sign-in and password forms are checked by Cloudflare Turnstile, which tells people from automated programs: when you use them, your browser connects to Cloudflare, which receives technical details such as your IP address and browser, and uses them for this check and to improve how it recognizes automated programs.
- Generating aggregated, anonymized analytics to improve the Service (never sold to third parties).
7. International Data Transfers
The database and file storage of the Service are hosted in the European Union, in Ireland. Some of the companies in section 6 are established in the United States or in Singapore, or may access data from there. Such transfers are covered by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses, in line with GDPR Chapter V. If you use the Service from outside the European Union, your data is sent to the European Union and stored there. Several countries, including the United Kingdom and Switzerland, recognize the European Union as giving adequate protection. Where the law of your country requires a basis for this transfer, it is that the transfer is necessary to provide the Service that you or your organization signed up for. While personal data is in another country, it is subject to that country's laws and may be accessed by its courts, law enforcement and national security authorities.
8. Data Retention
We keep your account (name, email address and sign-in details) while it belongs to a Workspace. When it stops belonging to any Workspace, because you were removed or the Workspace was deleted, we delete it automatically after 30 days, unless a Workspace's records still name you (for example work you recorded or routes you drove); it is then kept until you or that organization ask us to delete it. You can ask us to delete your account at any time (section 9). When an administrator deletes a Workspace, its data is deleted immediately and permanently, and the files uploaded to it within 30 days. When a customer's account ends in any other way, its Workspace data is deleted within 30 days. A driver's location is deleted when their route ends, and at the latest after 24 hours. Records of page views, feature use and errors are deleted after 365 days. Copies in our hosting provider's backups expire in its normal backup cycle. We keep a record that a Workspace was deleted, with its name and the person who deleted it, as proof of the deletion, and billing records for as long as Greek tax law requires (up to 10 years).
Anonymized, aggregated analytics data that cannot identify you may be retained indefinitely for product improvement purposes.
9. Your Rights Under GDPR
Wherever you live, you have the following rights:
- Right of access (Art. 15) — Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16) — Request correction of inaccurate data.
- Right to erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten").
- Right to restrict processing (Art. 18) — Request that we limit how we use your data.
- Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — Object to processing based on legitimate interest.
- Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise these rights, contact us at manuhiveos@gmail.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA — dpa.gr) or the supervisory authority in your country of residence.
11. Security Measures
We use industry-standard security measures, including: encryption in transit (HTTPS) and at rest; Row-Level Security (RLS) that keeps each Workspace's data separate; passwords stored only as hashes (bcrypt); optional two-factor authentication; limits on repeated wrong PINs; a tamper-evident audit log; regular security reviews and automated security tests; and access based on the principle of least privilege. The full list is in Annex 1 of our Data Processing Agreement. No method of electronic storage or transmission is 100% secure, so we cannot guarantee absolute security.
12. Children's Privacy
The Service is designed for business use and is not intended for individuals under the age of 15. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 15, we will promptly delete it.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be communicated via email or in-app notification at least 30 days before they take effect. The date at the top of this page indicates when the policy was last revised.
14. Contact
For any privacy-related questions, or to exercise your data subject rights, contact us at:
You may also contact the Hellenic Data Protection Authority (HDPA) at www.dpa.gr if you believe your data protection rights have been violated.
15. Information for Specific Countries
Sections 1 to 14 apply wherever you live. The laws of the following countries ask us to tell you more:
- United Kingdom: the UK GDPR gives you the rights in section 9. You can complain to the Information Commissioner's Office (ico.org.uk). The United Kingdom recognizes the European Union as giving adequate protection; transfers to our providers in the United States and Singapore use the UK Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework.
- Switzerland: we disclose personal data to Ireland and other countries of the European Economic Area, which Switzerland recognizes as adequate, and to the United States and Singapore. For the United States we rely on the Swiss-US Data Privacy Framework where the recipient is certified, and otherwise, as for Singapore, on the EU Standard Contractual Clauses adapted for Swiss law. You can complain to the Federal Data Protection and Information Commissioner (FDPIC).
- Other European countries: in Albania, Bosnia and Herzegovina, Moldova, Monaco, Montenegro, North Macedonia, San Marino, Serbia and Turkey you can complain to your national data protection authority, for example the Autorità Garante in San Marino, the Commissioner for the Right to Information and Personal Data Protection in Albania, the Commissioner for Information of Public Importance and Personal Data Protection in Serbia, the APDP in Monaco or the Personal Data Protection Authority (KVKK) in Turkey.
- United States: we do not sell personal information, do not share it for cross-context behavioral advertising and do not use it for targeted advertising, as those terms are used in US state privacy laws. If a security breach affects your personal information, we notify you as the law of your state requires.
- Canada: the person who runs ManuHive is accountable for the protection of personal information and can be reached at manuhiveos@gmail.com. Your information is stored in Ireland, and some providers process it in the United States and Singapore (section 7). You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.
- Brazil: in addition to section 9, the LGPD gives you the right to confirm whether we process your data, to have unnecessary or excessive data anonymized, blocked or deleted, to know with whom we share it, and to be told when you may refuse consent and what follows if you do. Our data protection officer (encarregado) can be reached at manuhiveos@gmail.com. You can also petition the National Data Protection Authority (ANPD). Transfers from Brazil to the European Union rely on the adequacy decision between Brazil and the European Union.
- Argentina: you may exercise your right of access free of charge at intervals of no less than six months, unless you show a legitimate interest in doing so sooner. The Agency for Access to Public Information (AAIP), as the supervisory body of Law 25,326, handles complaints and claims from anyone whose rights are affected by a breach of the data protection rules.
- Colombia: the controller is ManuHive, as named in section 2, reachable at manuhiveos@gmail.com. Send queries and complaints by email with your name, your request and how we can reach you. We answer queries within 10 business days and complaints within 15 business days. You can complain to the Superintendence of Industry and Commerce (SIC).
- Peru and Chile: our contact address for data subjects, for Peru's National Authority for Personal Data Protection and for Chile's Personal Data Protection Agency is manuhiveos@gmail.com.
- Japan: the name and address of ManuHive are in section 2. Personal data is stored in Ireland, in the European Union, which Japan recognizes as having an equivalent system, and some of our providers are in the United States and Singapore. Each is bound by contract to protect it to a standard equivalent to the Act on the Protection of Personal Information; on request we tell you about those measures and about the data protection rules of those countries. Our security measures are listed in Annex 1 of our Data Processing Agreement. Requests and complaints: manuhiveos@gmail.com.
- South Korea: your account data (name, email address, sign-in records) is transferred over the network when you use the Service to Ireland, where Supabase stores it, and to our providers in section 6, for the purposes in section 5, and kept for the periods in section 8. You can refuse this transfer by not using the Service or by asking us to delete your account.
- India: you may withdraw your consent at any time as easily as you gave it, nominate another person to exercise your rights if you die or become unable to, and, if we do not resolve your grievance, complain to the Data Protection Board of India. Grievances: manuhiveos@gmail.com.
- Singapore, Brunei, the Philippines and New Zealand: our data protection officer, who is also our privacy officer under New Zealand's Privacy Act 2020, can be reached at manuhiveos@gmail.com. You can complain to the Personal Data Protection Commission of Singapore, the National Privacy Commission of the Philippines, the Office of the Privacy Commissioner of New Zealand or, in Brunei, the national data protection authority.
- Africa: in Nigeria, Kenya and South Africa you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng), the Office of the Data Protection Commissioner in Kenya (odpc.go.ke) or the Information Regulator in South Africa (inforegulator.org.za).
- Saudi Arabia and Israel: you can complain to the Saudi Data and AI Authority (SDAIA) or to Israel's Privacy Protection Authority.
Wherever you live, you may complain to the data protection authority of your country. If you can, write to us first: we answer within 30 days.