Privacy Policy

Last updated 5 September 2026. This policy explains what MANDATE ("we") collects when you use Mandate and why.

What we collect

• Account: your email address, name and profile image from Google if you sign in with Google, passkey public keys if you add a passkey. Never a password.
• Workspace data: agents, mandates (limits, merchants, hours), purchase requests made by your agents (amount, merchant, purpose), approvals and denials, and the ledger that records them.
• Notification channels you add: an email address or a webhook URL.
• Connected agents: the OAuth clients you authorised and the scopes you granted.
• Provider keys you store for the API proxy, encrypted at rest with a key held outside the database.
• Technical: request logs with timestamps, IP addresses and identifiers needed to operate rate limits and investigate abuse, kept for a limited period.

Why

To run the service you asked for: decide requests, notify approvers, keep the record, and let you connect agents. We do not sell personal data and do not use it for advertising.

Who else sees it

Processors we rely on to run the service: our hosting and database providers, an email delivery provider for sign-in links and alerts, the webhook destinations you configure, Google Fonts (your browser fetches the typefaces from Google, which sees your IP address), and Stripe if virtual cards are enabled — Stripe holds the cardholder identity details you enter and the card itself, under its own privacy terms, and keeps them after you delete your account where card-programme rules require. Each receives only what its function needs. Agents you connect see the mandates in your workspace and the decisions on their own requests.

Your choices

Disconnect an agent, remove a channel, revoke a mandate, leave a workspace, or delete your account at any time from Settings. You can export your ledger. Google sign-in uses only your basic profile; you can revoke Mandate's access in your Google account.

Retention and security

Workspace data is kept while the workspace exists. The ledger is append-only by design; deleting a workspace deletes its ledger. Agent credentials are stored hashed; provider keys are stored encrypted; sessions are signed. Report a security concern to mandateappnotify@gmail.com.

Contact

mandateappnotify@gmail.com.