Mandraki Mandraki
Rozpocznij
This document is available in English only.

Privacy Policy

Last updated: 11 October 2026

1. Data controller

The data controller for the Mandraki website (mandraki.cloud), the Mandraki applications (app.mandraki.cloud, the desktop and mobile apps) and your account and billing data is Mandraki AB, reg. no 559575-7328, Banvägen 70, 435 43 Pixbo, Sweden. Contact: privacy@mandraki.cloud.

For the content your organisation and its users store and share in Mandraki (messages, files, email, calendar entries, tasks, recordings), your organisation is the controller and Mandraki AB is its processor under our Data Processing Agreement (GDPR Article 28). For questions about how your organisation uses that content, contact your organisation's administrator.

2. Data we collect

Website visitors

We collect minimal data from website visitors. We do not use advertising cookies, tracking pixels, or third-party analytics. Essential cookies are used only for session management and language preferences.

Application users

When you create an account, we collect:

  • Account information: Email address and a hashed password (we never store your password in plain text)
  • Organisation data: Organisation name and membership information if you join or create a team

During use of the application, we process:

  • Messages: Text messages, file attachments, and images you send (encrypted at rest with a key specific to your organisation)
  • Call data: Call metadata (participants, duration, timestamps) and, if recording is enabled with consent, call recordings
  • Files: Documents and media you choose to share within your organisation

3. Data storage and residency

All data is stored and processed within the European Union on evroc cloud infrastructure. Our servers are located in evroc data centres within EU member states. We do not store personal data outside the EU and do not use sub-processors outside the EU for storing or processing your content. The only case in which data passes through a service operated by a non-EU company is the delivery of push notifications to your own device or browser, described in section 5, and you control both whether that happens and what the notification contains.

4. Encryption

Data is encrypted at rest using AES-256-GCM with a three-tier key hierarchy (master key, organisation key, data encryption key). Message content, mail bodies, files, call recordings and audit details are encrypted with your organisation's key. All traffic is encrypted in transit with TLS. Real-time call media is encrypted between your device and our EU-based media servers.

5. Third-party services

Mandraki uses the following sub-processors and services. All processing takes place within the European Union.

  • evroc AB (Sweden): Cloud infrastructure — compute, storage and networking for the production service, including backups.
  • Scaleway SAS (France): Outbound email relay and auxiliary infrastructure (development and monitoring).
  • AI model provider (EU): Engaged only when your organisation enables AI features. Prompts and results are processed within the EU and are not used to train models.
  • Mollie B.V. (Netherlands): Payment processing for paid subscriptions. Mollie receives the payment details you enter at checkout and your billing name and address; we never see or store your full card number.
  • Push notification gateways: Notifications to your phone or browser are delivered by the gateway your own device or browser platform operates (Apple APNs, Google FCM, Microsoft WNS or Mozilla autopush). We do not choose these; they come with the device. By default a notification carries only a generic label such as "New message" or "Incoming call". You decide in your notification settings whether notifications include more detail such as the sender's name or the message text, and you can turn push notifications off entirely. Nothing is stored with these gateways.
  • WebRTC and TURN/STUN: Real-time media for calls is routed through our own EU-based media servers; no third party is involved.

Customers with a data processing agreement are notified at least 30 days before a sub-processor is added.

We do not share your personal data with advertisers, data brokers, or any third parties for marketing purposes.

6. Analytics and conversion tracking

Server-side analytics

We collect aggregated business metrics server-side to operate and improve our service:

  • Account events (signups, subscription changes) - counts only, no personal details
  • Feature usage patterns - which features are used, not who uses them
  • Error rates - to improve reliability

What we do NOT collect

  • No advertising cookies or tracking pixels
  • No third-party analytics scripts (no Google Analytics)
  • No browser fingerprinting or device identifiers
  • No personal profiling or cross-site tracking

Advertising campaign measurement

We advertise Mandraki on third-party platforms. From time to time we report conversion statistics back to the platform whose advert brought you to us, so that we can see whether a campaign worked. Such a report contains no information about you such as your name or email address, only the click reference the platform itself created when you clicked the advert, together with the type of event (signup or purchase), its time and its value. It is sent from our servers, never from your browser, only if you arrived through an advert, and it is used for nothing other than following up on our campaigns.

Legal basis

  • Service improvement: Legitimate interest (Article 6(1)(f) GDPR)
  • Conversion tracking: Legitimate interest in measuring advertising ROI

Data retention

Business event data is retained for 90 days maximum, then automatically deleted.

7. Legal bases

Where Mandraki AB is the controller, we rely on the following legal bases under Article 6(1) GDPR:

  • Providing the service you signed up for (account, authentication, billing, support): performance of a contract, Article 6(1)(b).
  • Invoicing and accounting records: legal obligation under Swedish bookkeeping law, Article 6(1)(c).
  • Security, abuse prevention and operational analytics: legitimate interest in running a secure and reliable service, Article 6(1)(f).
  • Optional features you switch on (for example push notifications with content): consent, Article 6(1)(a), which you can withdraw in your settings.

8. Your rights

Under the GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate personal data
  • Erasure: Request deletion of your personal data
  • Restrict processing: Limit how we use your data
  • Data portability: Receive your data in a machine-readable format
  • Object: Object to processing of your personal data
  • Withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact privacy@mandraki.cloud. You may also export your data directly from the application settings. Where your organisation is the controller of the content concerned, we will forward your request to your organisation's administrator.

You also have the right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy.se. You may also complain to the authority in the EU country where you live or work.

9. Data retention

Account data is retained for the duration of your account. Messages and files are retained according to your organisation's retention policy. When you delete your account, personal data is removed within 30 days; residual copies in encrypted backups are overwritten in the ordinary backup rotation. Call recordings are deleted according to the retention period set by your organisation administrator. Invoices and accounting records are kept for seven years as required by Swedish bookkeeping law. Anonymised usage statistics may be retained for service improvement.

10. Children's privacy

Mandraki is designed for professional and organisational use. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact privacy@mandraki.cloud and we will delete the information.

11. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or through the application. The "Last updated" date at the top of this policy indicates when it was last revised.

12. Contact

For privacy-related enquiries, contact our privacy team at privacy@mandraki.cloud.

For general support, visit our contact page.