Privacy Policy
Effective Date: March 12, 2026
Last Modified: September 22, 2026
1. Person Responsible for Personal Information
In accordance with Québec's Act respecting the protection of personal information in the private sector (Law 25), Immeria Inc. has designated a Person Responsible for the Protection of Personal Information (RPRP):
Stéphane Hamel
Person Responsible for the Protection of Personal Information (RPRP)
Immeria Inc.
Email: [email protected]
2. Personal Data Collection & Purpose
MANTIS uses local capture and remote classification. These have different data flows:
- Local capture: Inspected URLs, headers, payloads, cookies, storage values and consent signals can contain personal or confidential information. Capture evidence stays in the browser unless you export or share it. Bounded recovery checkpoints remain in extension session storage until capture stops or the browser session ends; classification caches and account settings persist separately. Review exports before sharing them.
- Remote classification: When enabled, the extension sends normalized request patterns, the inspected site's hostname, minimized technical evidence and an account token or persistent installation ID to the API. Query strings are removed and sensitive path values are redacted heuristically. This reduces disclosure but does not guarantee anonymity: hostnames or unusual paths can still identify a person or organization. Remote lookup can be disabled in extension options.
- Accounts and billing: We store your email, Google identity or password hash, licensed domains, subscription references and account settings. Stripe handles payment details. Reusable MANTIS sessions are stored locally; account-page links no longer contain them.
- Operational records: The API stores account-linked or pseudonymous event counts, timing, model/token usage and error categories for a configured retention period (seven days by default). It maintains short-lived quota records using keyed network identifiers for abuse prevention. The API and hosting infrastructure necessarily receive network addresses; infrastructure logs have separate retention settings.
- Shared classification catalog: Normalized patterns and derived classifications may be retained as shared intelligence. These are separate from account records. Account exports include linked operational records and overrides; deleting an account removes those linked records after billing cancellation is confirmed. Contact us if a shared pattern contains personal information.
3. Analytics & Google Tag Manager
Public marketing pages load Google Tag Manager with analytics and advertising storage denied by default. Denied storage does not necessarily prevent network requests or all measurement. The account and administration pages do not load GTM. The published container configuration determines which tags run on marketing pages.
4. Third-Party Service Providers
Service providers used for the website and product include:
- DigitalOcean: Infrastructure hosting for the MANTIS website and API.
- OVHcloud: DNS hosting for getmantis.net.
- Stripe: Payment processing and subscription management (no raw card data stored by MANTIS).
- Brevo: Transactional emails and mailing list management.
- OpenAI: When server-side AI enrichment is enabled, normalized patterns and minimized technical evidence are sent to the configured model provider for classification. Local capture payloads are not intentionally included in these enrichment requests.
- Google OAuth: User identity authentication during sign-in.
5. Your Rights Under Québec Law 25
Under Québec Law 25, you have specific rights regarding your personal information:
- Right of Access: Confirm whether we hold personal information about you and request access to it.
- Right of Rectification: Request correction of inaccurate or incomplete personal information.
- Right to Deletion / Consent Withdrawal: Withdraw your consent and request the deletion of your account and email data.
- Right to Data Portability: Receive a computerized copy of your personal data in a structured, commonly used format.
- Recourse: If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).
To exercise any of these rights, contact our RPRP at [email protected].
6. Open-Source Software
MANTIS is proprietary software, but it is built with and informed by open-source libraries and public data sources (such as D3.js, Lucide Icons, FastAPI, Uvicorn, SQLAlchemy, Pydantic, httpx, and DuckDuckGo Tracker Radar). Those components remain governed by their respective licenses.