Privacy Policy

1. Person Responsible for Personal Information

In accordance with Québec's Act respecting the protection of personal information in the private sector (Law 25), Immeria Inc. has designated a Person Responsible for the Protection of Personal Information (RPRP):

Stéphane Hamel
Person Responsible for the Protection of Personal Information (RPRP)
Immeria Inc.
Email: [email protected]

2. Local Captures and Data Received by MANTIS

MANTIS audits tabs you choose and pages in monitors you configure. Raw capture evidence stays in your browser during normal audits. The MANTIS service receives account information for sign-in and minimized technical details for tool identification and managed analysis.

What stays in your browser

Starting with extension version 0.7.1, the first toolbar audit shows a privacy notice and waits for you to click Start capture. MANTIS remembers your confirmation in that browser.

When you record a selected tab or configure a monitor, MANTIS captures network requests and supported navigation, consent, dataLayer, cookie and browser-storage observations. Full URLs, query values, captured headers, request and response contents, and cookie values stay in your browser during normal audits. These can contain personal or confidential information from the site you inspect. Private notes, local overrides and personal report templates are also stored locally by default. See Enterprise sharing below for the optional workspace records that can be synchronized.

Capture evidence is held in browser memory and bounded session-storage recovery checkpoints. Saved audits, local definitions, settings and caches use their respective local storage or exported files. You can export or share evidence yourself, including by attaching it to a support request; review files before sharing them. Removing the extension removes its browser-managed storage but does not delete files you have exported or records held in your MANTIS account.

Account identity and authentication

MANTIS receives your email address and, when you use Google sign-in, the Google account identifier needed to associate your sign-in with your account. For email/password registration and sign-in, your password is sent over HTTPS and stored on the server as a password hash rather than plaintext. Google authentication tokens and MANTIS session tokens are processed to verify identity and authorize API requests. Reusable MANTIS session credentials are stored in the extension's browser-managed storage; this is not an encrypted credential vault.

We use account identity and authentication information to provide account access, apply plan entitlements, secure sessions and support account recovery. Password recovery emails are delivered through Brevo, using reset links that expire after 30 minutes. Stripe handles payment details; MANTIS keeps the customer/subscription references, plan and status needed to manage account access, rather than raw card details.

Technical inputs sent for identification and enrichment

Tool identification sends minimized technical inputs to MANTIS, such as normalized endpoint patterns, public script filenames and resource types. MANTIS can submit eligible unresolved third-party patterns automatically while recording. Manual enrichment uses a selection you review. Depending on the workflow, inputs can also include field names, public tool identities and minimized technical identification evidence. Raw captured field values, authentication headers, cookie values, request bodies and private notes are excluded from these analysis requests.

The inspected site's base domain (such as example.com) can accompany a target so the MANTIS server can exclude first-party and verified affiliated requests. MANTIS omits that page-domain context from the AI provider's input. Endpoint patterns retain public hostnames and normalized path components. MANTIS removes query values and removes or replaces segments that resemble identifiers. Hostnames, ordinary paths and field names can still reveal site or business context.

Technical inputs sent for assessments

Managed assessments send a minimized evidence summary: normalized endpoint patterns, resource types, public tool/category labels, request counts, review flags, aggregate consent states and counts of technical signals such as observed cookies or fingerprinting indicators. They do not send the complete audit, raw cookies, request bodies, private notes or captured personal field values.

Optional Enterprise sharing and monitoring

When you use an encrypted Enterprise workspace, MANTIS can synchronize selected notes, governance records and local definitions or reassignments. Shared records are encrypted in the browser before upload. MANTIS stores the encrypted records and the workspace, account and version information needed to synchronize them. Authorized workspace members with the workspace key can read the shared contents.

Scheduled monitoring keeps raw captures and comparisons in your browser. If you configure email delivery, the extension sends the monitor name, monitored hostnames, recipient email addresses, run times and statuses, and aggregate finding counts to MANTIS. Brevo delivers the summary to the configured recipients. The email payload excludes raw captures, full page URLs, cookies, headers, payloads and private notes.

Connection metadata, operational records and startup checks

The API and hosting infrastructure receive the connecting network address and request metadata when the extension contacts them. The API uses keyed hashes derived from network addresses for rate limiting and abuse prevention. This does not require GPS or browser-geolocation access. We also maintain account-linked or pseudonymous records of service use, such as request/event counts, timing, model/token usage, error categories and last account activity.

Routine Admin diagnostics show API endpoint, status, timing and selected technical summaries. The inspected page domain used for identification and affiliation checks is not retained as an account-linked browsing log or displayed alongside the account. Diagnostics exclude full captured URLs, raw request and response bodies, authentication headers and private audit evidence.

Operational telemetry is retained for up to 28 days. Daily account activity and dashboard aggregates are retained for 65 days. Enrichment allowance records are retained for approximately 35 days, with shorter-lived rate-limit records maintained for abuse prevention. MANTIS application logs have a 28-day retention limit and a disk-size cap; shared infrastructure logs have separate retention settings. These records support service operation, usage allowances, reliability and security.

At recording startup, MANTIS checks a temporary ad-styled page element and requests two harmless, integrity-checked MANTIS diagnostic resources from the inspected page. Each resource contains only a fixed comment. Cross-origin requests omit credentials and referrers; the network check is skipped on the MANTIS origin to avoid sending account cookies. The browser may send the inspected site's origin in its CORS Origin header, and the infrastructure receives the connecting network address. Probe activity is excluded from capture requests, timelines, classification, checkpoints and exports. The result is a best-effort filtering signal, not proof that a particular blocker is installed or disabled.

Shared technical knowledge and account records

Normalized public endpoint patterns and derived classifications may be retained and reused in the shared technical catalog. Raw captures and private notes do not enter that catalog automatically. Provisional classifications are distinct from administrator-validated knowledge. Account exports include linked operational records and overrides; deleting an account removes linked account records after billing cancellation is confirmed. Shared public technical classifications are separate from account records. Contact us if a shared pattern contains personal information.

Chrome Web Store Limited Use

MANTIS handles data from the extension, including information received from Google APIs, in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use extension data to provide, maintain and secure the disclosed audit features. We transfer it only for purposes permitted by that policy. We do not sell extension data or use it for personalized advertising, creditworthiness or lending. Human access is limited to circumstances permitted by the policy, such as when you explicitly share specific evidence for support.

3. Analytics & Google Tag Manager

Public marketing pages use Google Tag Manager and a first-party consent manager to manage analytics, advertising, and functionality and personalization choices. Optional storage is denied by default; denied storage does not necessarily prevent network requests or all measurement. Your choices are stored in a first-party cookie for up to six months. Use Privacy choices below to change your preferences. With advertising consent, a LinkedIn click ID may be retained for the browser session and sent to LinkedIn to measure registrations and extension downloads. The account page uses an isolated measurement frame to record page views and successful sign-ins or registrations without passing account details or credentials to the tag. The administration page does not use this measurement frame. The published container configuration determines which tags run on marketing pages.

4. Third-Party Service Providers

Service providers used for the website and product include:

• DigitalOcean: Infrastructure hosting for the MANTIS website and API.
• OVHcloud: DNS hosting for getmantis.net.
• Stripe: Payment processing and subscription management (no raw card data stored by MANTIS).
• Brevo: Transactional emails, optional Enterprise monitoring summaries and website mailing list management.
• OpenAI: When managed AI enrichment or assessment is used, normalized patterns and minimized technical evidence or aggregate observations are sent through the MANTIS server to OpenAI. Raw captured values, headers, request bodies and private analyst notes are excluded from these analysis payloads. Inspected page-domain exclusion context is not sent to the model. OpenAI response storage is disabled for these requests; provider retention remains subject to the applicable provider configuration and terms.
• Self-hosted feedback: When you open feedback in the signed-in extension or from a signed-in MANTIS website page, our dedicated QuackBack instance at feedback.getmantis.net receives your account email and a stable MANTIS account identifier. It stores the feedback and attachments you choose to submit. Capture evidence and private notes are not attached automatically. Feedback records are managed separately from the MANTIS account; contact [email protected] for access or deletion.
• Google OAuth: User identity authentication during sign-in. Google receives the sign-in requests needed for that flow.
• Public vendor icons and filter lists: The extension requests icons by public catalog ID and refreshes the filter lists through the MANTIS API. MANTIS may contact Google’s favicon service using the public homepage hostname stored in the catalog, or fetch artwork from that public site. MANTIS also retrieves the three fixed lists from their publishers. Those upstream services receive the MANTIS server’s request, and the extension matches list rules locally. Older extension versions may request these assets directly from their publishers.

5. Your Rights Under Québec Law 25

Under Québec Law 25, you have specific rights regarding your personal information:

• Right of Access: Confirm whether we hold personal information about you and request access to it.
• Right of Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Deletion / Consent Withdrawal: Withdraw your consent and request the deletion of your account and email data.
• Right to Data Portability: Receive a computerized copy of your personal data in a structured, commonly used format.
• Recourse: If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).

To exercise any of these rights, contact our RPRP at [email protected].

6. Open-Source Software

MANTIS is proprietary software, but it is built with and informed by open-source libraries and public data sources (such as D3.js, Mantis Icons, FastAPI, Uvicorn, SQLAlchemy, Pydantic, httpx, and DuckDuckGo Tracker Radar). Those components remain governed by their respective licenses.