Effective date: 21 September 2026 Version: 1.0
This policy explains how Manras handles personal information in connection with the Communicat-O website at communicat-o.com and the Communicat-O service.
It covers two quite different situations, and the distinction matters, so it is set out plainly here rather than buried further down.
Where we are responsible (we are the “controller”). When you visit our website, request a demo, start a trial, contact us, or use Communicat-O as an administrator or agent of a customer organisation, we decide how your information is used. This policy describes that processing, and Sections 3 to 13 apply to it.
Where our customer is responsible (we are the “processor”). Communicat-O is business software. Our customers use it to conduct their own conversations with their own customers over messaging channels such as WhatsApp, SMS, and Facebook Messenger. The content of those conversations belongs to the customer organisation, which decides why and how it is processed. We handle it strictly on that organisation’s instructions and for no purpose of our own. Section 14 explains this and what to do if you are one of those individuals.
If you exchanged messages with a business and reached this page looking for an explanation, Section 14 is the part you want.
The Manras entity responsible for your information depends on where you are:
| If you are located in | The controller is | Registered office |
|---|---|---|
| The United Kingdom or the European Economic Area | Manras Technologies UK Limited, company number 13281588 | 71–75 Shelton Street, London, Greater London WC2H 9JQ, United Kingdom |
| The United States of America or Canada | Manras Technologies Corp, a Wyoming corporation, federal tax identification number 35-2804080 | 5830 E 2nd Street, Suite 7000 #8999, Casper, Wyoming 82609, United States of America |
| Anywhere else | Manras Software Private Limited, corporate identity number U72200HR2022PTC103282 | 8 Preet Nagar, Ambala Cantt, Haryana 133001, India |
References in this policy to “we”, “us”, and “our” mean the entity identified above. Our contact details, and those of our data protection officer and our representative in the European Union, are in Section 15.
| Category | Detail |
|---|---|
| Device and connection data | IP address, browser type and version, operating system, device type, screen size, language setting |
| Usage data | Pages viewed, time on page, referring page, links clicked, approximate location inferred from IP address |
| Cookie and identifier data | Cookie identifiers and similar identifiers set by us and by the third parties named in Section 5 |
| Category | Detail |
|---|---|
| Contact details | Name, business email address, telephone number, company name, job title where you give it |
| Enquiry content | The message you send us, and our correspondence with you |
| Booking data | Where you book a meeting through our scheduling tool, the time you select and any information you enter in the booking form |
| Trial signup data | The details you provide to start a free trial, and which Salesforce organisation you connect |
| Category | Detail |
|---|---|
| Account and identity data | Your name, business email address, your Salesforce user identity, your organisation identifier, and the role and permissions assigned to you |
| Authentication data | Authentication identifiers and tokens used to establish that a request comes from your organisation. We do not receive or store your Salesforce password |
| Activity data | Your presence status, conversation ownership and assignment, and timestamps of your activity within the service |
| Configuration data | The settings, templates, business rules, and channel configuration you create |
| Support data | Your support requests and our correspondence about them, including any diagnostic information you choose to share |
Billing contact name and business contact details, purchase and subscription history, invoice records, and tax registration details of the customer organisation. We do not take payments through our website and we do not store payment card numbers.
| Source | What we obtain |
|---|---|
| Business contact data providers | Business contact and company information used for business-to-business marketing, as described in Section 4.4 |
| Our customers | The identity and role of the administrators and agents a customer authorises to use the service |
| Salesforce and channel platforms | Technical identifiers required to connect your organisation and its channels |
| Publicly available sources | Company information, and professional information you have made public, for example on a professional networking profile |
We do not ask for, and ask you not to send us, information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information, or information about sexual orientation or sex life. We do not knowingly collect information from children — see Section 11.
Where the UK GDPR or EU GDPR applies, we must have a lawful basis for each use. This table states ours. Where another law applies, the equivalent basis under that law applies instead.
| What we use it for | Information used | Legal basis |
|---|---|---|
| Providing the Communicat-O service to the organisation you work for, including authenticating you and giving you the access your role requires | 3.3 | Performance of a contract with your organisation; our legitimate interest in operating the service |
| Responding to your enquiry, arranging and holding a demonstration, and setting up a trial | 3.2 | Steps taken at your request prior to entering a contract; our legitimate interest in responding to business enquiries |
| Administering the customer relationship, billing, invoicing, and collecting payment | 3.3, 3.4 | Performance of a contract; compliance with tax and accounting law |
| Providing technical support and resolving faults | 3.3 | Performance of a contract; our legitimate interest in supporting our product |
| Keeping the service and our website secure, preventing and investigating abuse, fraud, and unauthorised access | 3.1, 3.3 | Our legitimate interest in protecting our service, our customers, and their data; compliance with our security obligations |
| Understanding how our website is used so we can improve it | 3.1 | Your consent, given through our cookie banner |
| Advertising our product, including measuring which advertisements lead to enquiries, and showing advertisements to people who have visited our website | 3.1 | Your consent, given through our cookie banner |
| Sending you marketing about our products, and inviting you to events and webinars | 3.2, 3.5 | Your consent, where consent is required; otherwise our legitimate interest in marketing business software to business contacts — see Section 4.4 |
| Producing aggregated statistics about how the service is used, from which no individual can be identified | 3.1, 3.3 | Our legitimate interest in understanding and improving our product |
| Complying with legal obligations, responding to lawful requests from authorities, and establishing or defending legal claims | Any of the above | Compliance with a legal obligation; our legitimate interest in defending our rights |
We market Communicat-O to businesses, and some of the business contact details we use come from commercial business contact data providers rather than from you directly. Where the law requires your consent before we contact you, we obtain it. Where we rely instead on our legitimate interest, we have assessed that interest against your rights, and we limit ourselves to contacting people in a professional capacity, about software relevant to their stated role, at their business contact details, with a clear means of opting out in every message.
If we hold your details and you did not give them to us, you are entitled to ask us where we obtained them, and we will tell you. You can object to this marketing at any time and we will stop — see Section 10.
If we ever need to use your information for a purpose not described here, we will tell you and, where the law requires it, ask your permission first.
Our website uses cookies and similar technologies. We group them as follows.
| Category | What they do | Set before consent? |
|---|---|---|
| Strictly necessary | Make the site work — routing your request, remembering your cookie choices, protecting against attacks and abuse | Yes. These do not require consent because the site cannot function without them |
| Analytics | Tell us how the site is used, which pages are read, and where visitors leave | No. Only after you consent |
| Advertising | Let us measure which advertisements lead to enquiries, and show our advertisements to people who have visited the site | No. Only after you consent |
Alongside our own cookies, the following third parties set cookies or similar identifiers on our website. Each is named so you can read their own policy.
| Provider | What it does on our site | Category |
|---|---|---|
Google — Tag Manager (containers GTM-PGJ6T3N and GTM-5ZL5KHM) | Loads and manages the tags below. Tag Manager itself sets nothing, but it is the mechanism by which the others load, so the tags it loads are gated on your consent | Necessary for its own operation; gates the rest |
Google — Analytics 4 (property G-FELDTL97ZK) | Website usage measurement: pages viewed, time on page, where visitors come from and leave | Analytics |
Google — Ads conversion tracking (account AW-10785793738) | Measures which Google advertisements lead to enquiries and trials | Advertising |
| LinkedIn — Insight Tag | Measures which LinkedIn advertisements lead to enquiries, and builds audiences for advertising | Advertising |
| Meta — Pixel | Measures which Facebook and Instagram advertisements lead to enquiries, and builds audiences for advertising | Advertising |
| X (formerly Twitter) — Pixel | Measures which X advertisements lead to enquiries | Advertising |
| WhatsApp button (a link to WhatsApp) | Opens a WhatsApp conversation with us in your own WhatsApp app if you click it. It sets no cookie and sends nothing until you click | Sets nothing until clicked |
| Calendly | Meeting booking, where you choose to book a meeting with us | Necessary for the booking you requested |
When you first visit our website you are asked to choose which categories you accept. Analytics and advertising cookies are not set unless and until you accept them. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer of every page. Withdrawing consent is as easy as giving it, and takes effect immediately for any cookie not yet set; cookies already on your device can be removed through your browser.
You can also block or delete cookies through your browser settings, though parts of our website may then not work properly. Where your browser sends a Global Privacy Control signal, we treat it as an objection to advertising cookies and to any sharing of your information for advertising.
The Communicat-O application itself, which runs inside our customers’ Salesforce environments, does not use advertising or analytics cookies. The cookies described in this Section relate to our marketing website only.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising except through the advertising cookies described in Section 5, which operate only with your consent.
We share information with the recipients below. The infrastructure providers that process personal information on our behalf in operating the Communicat-O service are listed in full; other recipients are described by category, as the law permits, because the specific suppliers we use for our own business operations change from time to time.
Providers that operate the Communicat-O service
| Recipient | Why | Where they process |
|---|---|---|
| Google Cloud Platform | Hosting and infrastructure for the Communicat-O service — compute, message queuing, storage, key management, logging, and analytics | India (Mumbai region). Message content itself rests in our customer’s own Salesforce environment, wherever the customer has chosen to host that; our infrastructure handles it in transit and holds undelivered messages for at most seven days |
| Twilio | Sending and receiving SMS, where a customer purchases our SMS channel | United States and Ireland |
| Manras Technologies UK Limited | Customer relationship management, support, and contract administration for customers in the United Kingdom and the EEA | United Kingdom |
| Manras Technologies Corp | Customer relationship management and support for customers in the United States and Canada | United States |
| Manras Software Private Limited | Engineering, operations, security monitoring, and technical support for the service. Our platform personnel are employed by this company | India |
| Manras Technologies Private Limited, our sister concern and implementation partner | Implementation, configuration, and integration services. Where a customer buys these from us, Manras Technologies Private Limited works as our subcontractor under our instructions. Where a customer contracts it directly, it works for that customer under its own agreement. In either case its consultants work in test environments by default and reach a customer’s live environment only where the customer grants access | India |
Providers we use for our own business — by category
| Category | Examples and purpose | Where they process |
|---|---|---|
| Website measurement and advertising | Google (Tag Manager, Analytics, Ads), LinkedIn, Meta, and X — each only with your consent, as described in Section 5 | United States and globally |
| Website hosting | Hostinger | India |
| Productivity, email, and document tools | Microsoft 365, for our email, calendars, and internal documents | India |
| Customer relationship management | Salesforce, as the CRM we use for our own customer and prospect records. This is our use of Salesforce as a customer; it is separate from our customers’ own Salesforce environments described in Section 14 | India |
| Meeting scheduling | Calendly, where you choose to book a meeting with us | United States |
| Professional advisers | Lawyers, accountants, auditors, and insurers | As applicable |
| Authorities, courts, and regulators | Where we are legally required to disclose, or to establish or defend a legal claim | As applicable |
| An acquirer or successor | If we sell or reorganise our business, subject to the protections in this policy continuing to apply | As applicable |
Everyone who processes personal information on our behalf does so under a written contract requiring them to protect it and to use it only for the purposes we specify.
The platforms that carry messages — WhatsApp, Facebook Messenger, Instagram, Telegram, LINE, WeChat, Viber, Zalo — are in a different position from everyone listed above, and it depends on who holds the account with that platform.
Channels where our customer holds the account. For every channel other than SMS, the customer opens and holds its own account with the platform — its own WhatsApp Business account with Meta, its own official account with LINE or WeChat, and so on. The platform is the customer’s supplier, not ours. We are a conduit between the platform and the customer’s Salesforce environment, and the platform’s own handling of the conversation is governed by its terms and its privacy policy, and is a matter between it and the customer.
Channels where we hold the account. For SMS we hold the account with Twilio and Twilio acts on our instructions, so it appears in the first table above as one of our providers. If we ever hold the account for a further channel we will add that platform to the table.
Our group operates from the United Kingdom, the United States, and India, and some of the providers above process outside your country. Where we transfer personal information out of the United Kingdom or the European Economic Area, we rely on one of the following.
| Route | Safeguard |
|---|---|
| From the EEA to the United Kingdom | The European Commission’s adequacy decision for the United Kingdom, renewed on 19 December 2025 and in force until 27 December 2031. For people in the EEA, our controller is Manras Technologies UK Limited, so this is the first step for your information |
| From the United Kingdom to India | The UK Information Commissioner’s International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, together with a documented assessment of the transfer and the technical measures described in Section 9 |
| From the EEA to India directly, if the adequacy decision above were ever suspended or withdrawn | The European Commission’s standard contractual clauses, which take effect automatically as a fallback, with a documented assessment of the transfer |
| From the United Kingdom or the EEA to the United States | The standard contractual clauses or the UK Addendum, or the relevant data privacy framework where the recipient is certified under it |
| To any other country without an adequacy finding | The standard contractual clauses, with a documented assessment of the transfer |
Where your information is processed. Everything we ourselves operate — the Communicat-O service, our website, our email and documents, and our own customer records — is hosted in India. The Communicat-O service runs in Google Cloud’s Mumbai region. Our engineering, operations, and support personnel are in India, and they may access personal information from there to operate, support, and secure the service. That access is logged, limited to what the task requires, and covered by the safeguards above. Message content itself rests in our customers’ own Salesforce environments, in whatever region each customer has chosen — see Section 14.
We do not rely on your consent, or on your use of our website, as a basis for these transfers. You may ask us for a copy of the safeguards we rely on, and we will provide it, redacted where it contains commercial terms.
We keep personal information only as long as we need it for the purposes in Section 4, and then delete it or irreversibly anonymise it.
| Information | How long |
|---|---|
| Website analytics and advertising data | 14 months |
| Enquiries and demo requests that do not become customers | 24 months from our last contact with you |
| Marketing contacts | Until you opt out, or 24 months without any engagement from you, whichever is sooner |
| Customer administrator and agent account records | For the term of the customer’s subscription, then deleted in line with our data processing agreement |
| Support correspondence | 36 months from the closure of the request |
| Billing, invoicing, and tax records | As long as tax and company law requires — six years from the end of the relevant financial year in the United Kingdom, and the corresponding period in India and the United States |
| Service application and audit logs | 30 days |
| Records needed for a legal claim | Until the claim and any appeal period is concluded |
Message content processed on behalf of our customers is retained according to the customer’s own policy — see Section 14. Our own systems do not keep the content of delivered messages: a message passes through our infrastructure on its way to the customer’s Salesforce environment and is retained by us only if it could not yet be delivered, for at most seven days, in our Mumbai processing region. The records we do keep about a message — its status, the channel, and timestamps — do not include what it said.
We take the security of personal information seriously and apply measures appropriate to the risk. These include encryption of data in transit and at rest; envelope encryption of credentials bound to the specific customer they belong to; a data access design in which one customer’s data cannot be reached from another’s context; access on a least-privilege basis granted through directory groups and reviewed on any change of role; multi-factor authentication on administrative access; logging of access to customer data; a documented incident response procedure; and mandatory peer review of every change to our software before it is deployed.
No system is perfectly secure. If a breach affects your personal information and the law requires us to tell you, we will.
Depending on where you are, you have some or all of the following rights. They are free to exercise, and exercising them will not cause us to treat you less favourably.
| Right | What it means |
|---|---|
| Access | Ask us whether we hold information about you and get a copy |
| Correction | Have inaccurate or incomplete information corrected |
| Deletion | Ask us to delete your information, where we have no overriding reason to keep it |
| Restriction | Ask us to pause using your information while a dispute about it is resolved |
| Objection | Object to our using your information where we rely on legitimate interests, and object to direct marketing at any time — for marketing, we will always stop |
| Portability | Receive information you gave us in a portable format, or have us send it to someone else |
| Withdraw consent | Withdraw consent where we rely on it, including for cookies, at any time |
| No automated decisions | We do not make decisions about you by automated means that have a legal or similarly significant effect. If that ever changes, we will tell you and explain your rights |
| Complain | Complain to a data protection authority — see Section 15 |
How to exercise them. Contact us using the details in Section 15. We may need to verify your identity before we act, and will only ask for what is necessary to do so. We respond within one month, or within the shorter period your local law requires, and will tell you if we need longer because your request is complex.
The rights above are those given by the UK GDPR and the EU GDPR. You may complain to your local supervisory authority, or in the United Kingdom to the Information Commissioner’s Office.
Under the Digital Personal Data Protection Act, 2023 you may access a summary of the personal data we process and the processing activities undertaken, seek correction, completion, updating, or erasure, nominate someone to exercise your rights if you die or become incapacitated, and use our grievance redressal process. We will respond to a grievance within ninety days. Our grievance officer is identified in Section 15, and you may escalate to the Data Protection Board of India.
We do not sell personal information, and we do not share it for cross-context behavioural advertising other than through the advertising cookies in Section 5, which operate only if you consent. You may request to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipient; request deletion; request correction; and limit our use of sensitive personal information — although we do not collect sensitive personal information as the CCPA defines it, beyond what appears in Section 3. You may use an authorised agent. Sections 3, 4, 6, and 8 contain the disclosures the CCPA requires about categories, purposes, recipients, and retention. We will not discriminate against you for exercising a right.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comparable laws have rights of access, correction, deletion, and portability, and may opt out of targeted advertising, of the sale of personal data, and of profiling with legally significant effects. We do not sell personal data or engage in such profiling. Where the applicable law provides an appeal, and we decline a request, we will tell you how to appeal.
Comparable rights apply under the LGPD, PIPEDA and Quebec Law 25, the Australian Privacy Principles, and other laws. Contact us and we will honour the rights your law gives you.
Communicat-O is business software and is not directed at children. We do not knowingly collect personal information from anyone under 18. That figure is above the age of digital consent in every country where we operate, so it applies wherever you are. If you believe a child has given us information, contact us and we will delete it.
We do not make decisions about you solely by automated means that produce legal effects or similarly significantly affect you.
We may update this policy. When we do, we will change the “last updated” date at the top and, where the change is material, tell you directly — by email to customer administrators, or by a notice on our website. Where a change requires your consent, we will ask for it.
Previous versions are available on request.
You may have reached this page because a business you were messaging mentioned Communicat-O, or because you saw our name in a footer.
We are not responsible for that conversation, and we cannot help you with it directly. Communicat-O is software that businesses license to manage their own conversations. The business you were messaging decided to contact you, decided what to say, and decides how long to keep the conversation. In data protection terms it is the controller; we are its processor, acting only on its instructions. We do not read those conversations, we do not keep them — the conversation is stored in the business’s own Salesforce environment, not in ours — we do not use them for any purpose of our own, and we do not use them to train artificial intelligence models.
What to do. Contact the business you were messaging. Its privacy notice will explain its handling of your information and how to exercise your rights, including asking it to stop messaging you or to delete your conversation. Replying with a standard opt-out word such as STOP will usually stop messages on channels that support it.
If you cannot identify or reach the business, contact us at the details in Section 15 with whatever you know — the channel, the number or handle you were messaging, and the approximate date. We will try to identify the customer and pass your request to it, and tell you that we have done so. We cannot give you the content of the conversation or act on the request ourselves, because the information is not ours to disclose or delete.
If the business is unresponsive, you may complain to your data protection authority about that business.
What we hold, and for how long, when acting for a business. The full schedule of the records our systems keep while processing on a business’s behalf — none of which include the content of a delivered message — and the period each is kept for is set out in Annex I of our Data Processing Agreement, which every business customer signs. That schedule is the single authoritative statement of those periods; in summary, undelivered messages are held for at most seven days, operational records for 30 days, and usage metrics that contain no message content and no identifier of yours for 395 days.
| Privacy enquiries and rights requests | privacy@communicat-o.com |
| General enquiries | team@communicat-o.com |
| Data protection officer | We have assessed, as at September 2026, that we are not currently required to appoint one. We will revisit this if our processing changes, if we are designated a Significant Data Fiduciary in India, or if the law requires it. Privacy matters are handled by the contact above |
| Grievance officer for India (Digital Personal Data Protection Act, 2023) | Rakesh Kumar — privacy@communicat-o.com, marking your message “Grievance”. We respond within 90 days, and usually much sooner |
| Representative in the European Union under Article 27 GDPR | Shakti Singh, 9 Gandon Place, Lucan, Co. Dublin, K78 N2Y2, Ireland — eurep@communicat-o.com. Our representative can be contacted by supervisory authorities and by individuals in the EU on any matter relating to our processing of their personal information |
| Postal address | As set out for the relevant entity in Section 2 |
Complaints. We would like the chance to resolve your concern first, so please contact us. You may also complain to a data protection authority: in the United Kingdom, the Information Commissioner’s Office at ico.org.uk; in the European Economic Area, your national supervisory authority; in India, the Data Protection Board of India; in other countries, your national or state authority.
Communicat-O is a product of Manras. This policy does not form part of any contract of employment or service contract.