1. Who we are
Manager is a product of Thisys ([legal entity name, company number and registered address to be added]), referred to here as "we". This policy explains how we handle personal information when you visit this website, contact us, or use Manager.
2. Two different roles
Inside Manager, the company that subscribes (our customer) decides what information about its people, projects and clients is entered and who can see it. For that information the customer is the controller and we are its processor: we act only on its instructions, under a data processing agreement.
For this website, contact messages and account sign-in, we decide how the information is used, so we are the controller.
3. What we collect
- Contact form: your name, email address, company (optional), topic and message. We do not store your network address; we keep only a one-way, keyed fingerprint of it, to stop abuse, and clear it after 30 days.
- Accounts: name, email address, a password stored only as a slow, salted hash, and your second sign-in factor, encrypted.
- Customer content: what a customer and its people put into Manager, such as projects, check-ins, timesheets and invoices.
- Security records: sign-ins, permission changes, exports and other security-relevant actions, in the customer's audit log.
This website uses no advertising or analytics cookies and no third-party tracking. See cookies.
4. How we use it
- To provide Manager under our contract with the customer.
- To answer your messages, which is in our legitimate interest and yours.
- To keep Manager secure and prevent abuse, which is in our legitimate interest.
- To meet legal obligations, such as keeping financial records for the legal minimum.
We do not sell personal information, and we do not use customer data to train AI models.
5. Artificial intelligence
Some Manager features send the minimum information needed to an AI model provider, Anthropic, which processes it in the United States; the data processing agreement and transfer safeguards will be in place before launch. The AI explains, recommends and drafts. It never scores, ranks or judges individuals, and risk scores are fixed formulas, not AI output. Private coaching is never shown to an employer.
6. Where information is stored
Production data is to be stored in London, in the United Kingdom, including data for Australian customers. When information leaves Australia, the United Kingdom or the European Economic Area we use the safeguards the law requires, such as contractual clauses, and take reasonable steps under Australian Privacy Principle 8.
7. Who we share it with
We use a small number of service providers (sub-processors) for hosting, email delivery and AI processing. The full list, with what each does and where, will be published here before launch. We share information with authorities only when the law requires it.
8. How long we keep it
- Contact messages: up to 24 months, then deleted automatically.
- Account and customer data: for as long as the customer's subscription lasts, then as set out in our terms, after an export period.
- Customers set retention for each kind of data in Manager; legal minimums for financial records (for example 7 years in Australia and 6 years in the United Kingdom) always apply.
- Security audit records: at least 2 years.
9. Your rights
You can ask to access, correct, export or erase your personal information, or object to how it is used. Inside Manager, every person can see who can see each kind of their data and download all of it themselves. We complete requests within 30 days. If your information is held for a customer, we will pass your request to that customer and help them answer it.
If you are not satisfied with our answer you can complain to the Office of the Australian Information Commissioner, the UK Information Commissioner's Office, or your local data protection authority in the European Union.
10. Security and data breaches
How we protect information is described on our security page. If a data breach is likely to cause serious harm, we will notify affected customers, people and regulators as the Notifiable Data Breaches scheme and the GDPR require.
11. Changes and contact
We will post any change to this policy here with a new date, and tell customers before a material change takes effect. For any privacy question, contact us.