Last updated: October 22, 2026
Privacy Policy
Privacy is built into MantAI from the mounting position upward. This page explains what we collect on this website, what our devices and platform process for fleets, who can access what, and the rights you have.
1. Who we are
MantAI Inc. is a Delaware C corporation with operations in Berlin, Germany. We build a connected vehicle intelligence platform: a self-powered device that records sound, vibration, motion, position and enclosure climate, and a cloud platform that turns those signals into early, calibrated maintenance and safety insights for fleets. In this policy, "MantAI," "we," "us," and "our" refer to MantAI Inc.
For data protection law, the controller of personal information collected through this website is MantAI Inc. You can reach us at [email protected]. Company details are also listed in our imprint.
2. Scope of this policy
This policy covers two things. First, the MantAI website at mantai.io, including the documentation area and the demo and booking flows. Second, a summary of how the MantAI platform and device handle data when a fleet deploys us, so that drivers, fleet staff and customers can see how privacy is designed into the product.
In a typical deployment, the fleet operator is the controller of vehicle and driver data and MantAI is the processor, acting under a data processing agreement. If you drive a vehicle equipped with MantAI, your employer or the vehicle owner decides the purposes of that processing, and the contract between them and us governs the details. Section 4 below summarizes how the platform works; the agreement with your fleet operator takes precedence where it is more specific.
3. Data we collect on this website
3.1 Website usage and technical data
When you visit pages, our hosting provider processes standard technical data such as IP address, approximate location derived from IP, browser type, device type, referring URL, pages viewed, and timestamps. We use this to operate, secure, and improve the site.
3.2 Analytics
We use Vercel Web Analytics, which collects aggregate usage metrics in a privacy-oriented way. See Vercel's Privacy Policy.
3.3 Booking a demo or a call (Calendly)
If you book a meeting through our Calendly embed, you submit information directly to Calendly, for example your name, email address, and meeting preferences. We receive what is needed to hold the meeting. Opening the scheduling widget loads Calendly scripts, which are governed by Calendly's Privacy Policy.
3.4 Get started requests, sign-in and feedback
If you tell us about your fleet through the get started flow, sign in on this website, or send feedback, we process the details you submit, for example your name, work email, company, fleet size, and the content of your message, together with a session token stored in your browser where sign-in is used. These requests are handled by our API on Cloudflare, and transactional email may be sent via Resend. See Cloudflare's Privacy Policy and Resend's Privacy Policy.
3.5 Preferences stored in your browser
The site stores your theme choice (light or dark) and your cookie preferences in your browser's local storage. These never leave your device.
3.6 Communications you send us
If you email us, we process the content of your message and its metadata to respond and to manage our relationship with you.
4. The MantAI platform and device data
This section summarizes how the MantAI device and cloud handle data in a fleet deployment. We design the platform to meet the EU General Data Protection Regulation and the European Data Protection Board's guidelines on connected vehicles, and our security program follows the EU radio equipment cybersecurity requirements (EN 18031) and the Cyber Resilience Act.
4.1 What the device records
The device records short acoustic samples of about 20 seconds, together with synchronized acceleration, rotation, position and enclosure climate data, on a schedule and when its motion sensor detects that the vehicle is driving. It is mounted outside the cabin and does not record sounds from inside the cabin. Collection focuses on the vehicle in motion, because that is when mechanical signals carry information.
4.2 Privacy by design
- Recordings are tied to driving, not to people.
- Segments containing human speech are filtered out in our processing pipeline.
- Data minimisation is built in: exterior mounting, motion-triggered recording, and a roadmap toward compact acoustic fingerprints in place of audio.
- We provide customers with a data protection impact assessment template and published retention defaults.
4.3 How data is stored and protected
On the device, recordings are buffered locally until the cloud confirms receipt. In transit, every record travels over an encrypted, authenticated TLS or DTLS session, using the device's secure key storage and hardware cryptography. In the cloud, audio is held in encrypted object storage and metadata in an operational database, separated strictly by customer organisation, with retention periods defined per customer.
4.4 Who has access
Each customer sees only its own vehicles, through roles such as administrator, fleet manager, technician and driver. Access to raw audio is a separate permission held by a small number of named MantAI roles, and every access to audio is logged with its purpose.
4.5 Whose data is whose
Customer data, such as positions, events, vehicles and results, belongs to the customer. De-identified acoustic and vibration data and confirmed maintenance outcomes are licensed to MantAI to improve our models for all customers. In line with the EU Data Act, we give customers access to the data their vehicles generate, and our export interfaces support this.
4.6 If you drive an equipped vehicle
Your fleet operator is the controller for driving behavior and location data and is your first point of contact for access, correction or deletion requests. We support our customers in answering these requests under our data processing agreement. You can also write to us at [email protected] and we will route your request to the right place.
5. Purposes and legal bases (EEA, UK, Switzerland)
Where the GDPR or similar laws apply, we rely on the following legal bases:
- Legitimate interests (Article 6(1)(f) GDPR): operating and securing the website, understanding aggregate usage, fraud prevention, and improving our services, where not overridden by your rights.
- Consent (Article 6(1)(a) GDPR): for non-essential cookies and similar technologies, collected through the cookie panel on this site. You may withdraw consent at any time.
- Performance of a contract or pre-contract steps (Article 6(1)(b) GDPR): responding to your request to enter into or perform a contract with us, including demo bookings and pilot requests.
- Legal obligation (Article 6(1)(c) GDPR): where we must retain or disclose information to comply with law.
7. Recipients and subprocessors
We share personal information with service providers who process it on our behalf:
- Vercel Inc.: website hosting and analytics.
- Calendly LLC: meeting scheduling when you use our booking flow.
- Cloudflare, Inc.: API hosting and data storage for get started requests, sign-in and feedback.
- Resend: transactional email where those features are enabled.
We may also disclose information if required by law, legal process, or to protect the rights, safety, and security of MantAI, our users, or others. If we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction subject to appropriate safeguards and notice where required.
8. Retention
We retain personal information only as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law.
- Website, server and analytics data: retained according to our hosting and analytics providers' configurations and our internal policies.
- Platform data: retention periods are defined per customer in the data processing agreement; derived features and model results are kept for the life of the contract to build each vehicle's history.
- Meetings and correspondence: retained as needed for our business relationship.
9. Security
We implement technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction: encrypted transport (TLS or DTLS) for every record, encrypted storage at rest, strict separation between customer organisations, role-based access, hardware security on the device (Arm TrustZone isolation and secure key storage), and logged, purpose-bound access to raw audio. No method of transmission over the Internet is completely secure; we cannot guarantee absolute security.
10. Your privacy rights
Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You may also have the right to lodge a complaint with a supervisory authority.
To exercise your rights, contact us at [email protected]. We may need to verify your identity before fulfilling certain requests. If your request concerns data processed for a fleet operator, we will coordinate with them as the controller.
11. California residents (CPRA / CCPA)
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including:
- Right to know the categories and specific pieces of personal information collected.
- Right to delete personal information we hold, subject to exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising, where applicable.
We do not sell your personal information. We use analytics and scheduling tools as described above; if a jurisdiction treats certain disclosures as "sharing" requiring an opt-out, we will provide the required mechanisms.
12. Children
This website is not directed at children. We do not knowingly collect personal information from anyone under 16 years of age in the EEA or UK, or under 13 in the United States. If you believe we have collected information from a child inappropriately, please contact us and we will take appropriate steps.
13. International transfers
We may process and store information in the United States, Germany, and other countries where we or our service providers operate. Where we transfer personal data from the EEA, UK, or Switzerland to countries not deemed adequate by the relevant authority, we rely on appropriate safeguards such as the Standard Contractual Clauses adopted by our vendors or other lawful transfer mechanisms.
14. Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. If changes are material, we will provide additional notice as required by law.
15. Contact
For privacy questions or requests, contact us at [email protected]. Company details are listed in our imprint.