Privacy Policy

Effective: 17 September 2026
Last updated: 5 November 2026

Manifold is an inventory, order, purchasing and customer-relationship platform for merchants, made available at getmanifold.io and through the Manifold app for Shopify. It is operated by Bam Sock Pow Pty Ltd (ABN 53 165 151 708) ("Manifold", "we", "us"). This policy explains what personal information we collect, why, how it is stored and protected, and the choices you have.

We are bound by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle personal data of people in the European Union or the United Kingdom, we also honour the rights the GDPR and the UK GDPR give them.

1. Two roles: who is responsible for what

Manifold holds two kinds of personal information, and our responsibility differs between them.

Account and identity data — Manifold is the controller. When you create an account, sign in, join an organisation or connect an AI agent, we decide how that information is handled and this policy governs it directly.

Merchant data — Manifold is the processor. The products, stock, orders, purchase orders, suppliers and customers a merchant keeps in Manifold belong to that merchant. The merchant (the organisation that opened the account) is the controller of that data, including the personal information of its own customers and contacts, and we process it only on the merchant's instructions and to run the service. If you are a merchant's customer and want to know how your information is handled, or want it corrected or removed, please contact the merchant first; we will assist them.

Shopify data. Where a merchant connects a Shopify store, the data Shopify sends us is also governed by Shopify's own privacy policy and the terms of the Shopify app the merchant installed. Shopify's rules for apps, including its mandatory privacy webhooks, apply to that data and are described in section 6.

2. What we collect about account holders

When you use Manifold as a signed-in person we collect:

  • Identity: your name, email address, and whether that address has been verified.
  • Credentials: a password hash (never the password itself) if you sign in with a password; a passkey's public key and credential identifier if you register a passkey (WebAuthn); or the identifier Google returns for your account if you sign in with Google.
  • Sign in with Google: we request only the openid, email and profile scopes — your Google account identifier, email address, name and profile picture. We do not request access to your Gmail, Drive, contacts, calendar or any other Google data, and we do not use Google data for advertising.
  • Sessions: a session record with the time it was created, when it expires, and the organisation you are currently acting in. A session lasts seven days from your last activity.
  • Organisation membership: which organisations (tenants) you belong to, your role in each, the jobs (permissions) you have been granted, and the invitations you have sent or received. Invitations are sent by email to the address the inviter supplies.
  • Platform administration: whether you hold the platform administrator role. When a platform administrator acts as another user (impersonation, for support), the administrator's identity is recorded on every change made during that session, so the record always shows who really acted.
  • AI agent grants: if you connect an AI agent (see section 8), the agent's client identity, which organisation you allowed it to act in, and when you connected or disconnected it.
  • Transactional email: we send email verification, password reset and organisation invitation messages. We do not send marketing email.
  • Billing: for the organisation's subscription, the billing contact's name and email address, the billing address and any tax identification number entered at checkout, the Stripe customer and subscription identifiers, the subscription's status and trial dates, invoice amounts and statuses, and how many sales orders were counted each billing period. Card and bank details are entered on Stripe's pages and held by Stripe; they never reach Manifold — we see only that a payment method is on file.
  • Support correspondence: anything you send us when you ask for help.
  • Product usage: how you use the Manifold admin, recorded with PostHog (section 9). This covers which screens you open, when and for how long, and which buttons and links you click. It also records your browser, operating system, device type, screen size, page-load timings, and the approximate country and city derived from your IP address. Each event carries your user identifier, your organisation's identifier and name, your roles, and whether you are working inside Shopify's admin. It does not carry your name or email address, or any of your organisation's records. Specifically:
    • Session recordings. We record how the admin's screens are laid out and how you move through them: where the pointer goes, what you click, how you scroll. Every piece of text on screen and everything you type is masked in the browser, and images are blocked, before the recording is sent. A recording shows the shape of a screen, never what a record says.
    • Errors. When something in the admin fails, the error and where it happened in our code are recorded.
    • Performance. The admin records how long each of its requests to Manifold took and whether it succeeded, named by the kind of request, never its content.
    • Surveys. If you answer a survey we show you, PostHog holds what you write.

Every web address is cut down to its path, and anything that looks like an email address is masked, before anything leaves your browser. Nothing is recorded while a platform administrator is acting as you for support.

We collect this information directly from you, from Google when you choose to sign in that way, or from Shopify when you open Manifold from your Shopify admin (Shopify tells us your shop and the Shopify user who opened the app, so we can create or join the matching organisation).

Visitors to the marketing site. When you browse getmanifold.io (whether or not you have an account) we measure how the site is used with PostHog, without cookies (section 9). For each page you load we record the page's address (including any campaign tags in it, such as utm_source), the page that referred you, your browser, operating system, device type and screen size, the country and city derived from your IP address, the time, and which links and buttons you click. PostHog uses your IP address and browser details only to work out an approximate location and a visitor identifier that changes every day. It does not store the IP address with the event. We cannot use this identifier to recognise you on another day or on another site, and we do not link it to your account.

3. What we process on behalf of merchants

A merchant's organisation in Manifold may hold:

  • Catalogue and stock: products, variants, SKUs, barcodes, prices, locations, stock levels and every movement of stock.
  • Orders and fulfilment: sales orders, their lines, shipments, invoices, payments and refunds — including the customer's name, email, phone number, billing and shipping addresses and the notes on the order.
  • Purchasing: purchase orders, receipts, supplier invoices and landed costs, and the suppliers they name.
  • People and companies (CRM): the merchant's customers, contacts and suppliers — names, email addresses, phone numbers, addresses, tags, tax and marketing settings, and notes.
  • Shopify data: orders, customers, products, inventory levels and locations pulled from a connected Shopify store, and webhooks Shopify sends about them.
  • Files: images and documents uploaded against a SKU or product (photos, specification sheets), up to 100 MiB each.
  • Imports: CSV files a merchant uploads to load or update its data in bulk, and the exports it takes out.
  • Reports and search indexes derived from the above.

Any of this may contain personal information about the merchant's customers, contacts, staff or suppliers. The merchant decides what to enter and is responsible for having the right to do so.

Addresses you enter are checked against, and may be added to, Manifold's shared address reference (including unit numbers), without any name, contact detail or link to you or your customer.

4. How we use information

We use personal information to:

  • create and secure your account and sign you in;
  • operate the service for your organisation: recording stock, orders, purchases and customer records, and showing them back to the people your organisation has authorised;
  • synchronise with the Shopify stores and AI agents your organisation has connected;
  • bill the organisation's subscription: start its free trial, count its sales orders, raise invoices and take payment through Stripe, and restrict an organisation to read-only access when its subscription has lapsed;
  • send the transactional emails described above;
  • understand which pages of the marketing site are read, where its visitors come from, and which pages lead people to sign up, so we can improve the site;
  • understand how the admin is used — which features organisations rely on, where people get stuck, and which screens are never opened — so we can decide what to build and fix;
  • keep an auditable history of who did what in an organisation (section 5);
  • monitor, secure and troubleshoot the platform, and investigate misuse;
  • comply with the law, and respond to lawful requests.

We do not sell personal information, and we do not use it for advertising or profiling.

5. Facts are kept as an append-only record

Manifold is built on an append-only event journal. Every change to an organisation's data — a stock movement, an order placed, a customer created — is recorded as a fact that is never edited or deleted. This is what makes stock figures reproducible and the history auditable, and it shapes how deletion works:

  • Facts about business records are permanent for as long as the organisation exists. A correction is recorded as a new fact; the earlier one remains.
  • A person's identifying details are sealed. In the CRM, everything that identifies a person (name, email, phone, addresses, notes) is encrypted under a key created for that person alone, and the journal holds only the sealed form plus a one-way hash of the email address used to prevent duplicates. Nothing readable about the person is written into the permanent record.
  • Erasure destroys the key. When a person is erased — by a merchant acting on a request, or by a Shopify customers/redact webhook — Manifold destroys that person's key in the same transaction that records the erasure. The sealed data cannot be read again by anyone, including us. Orders and other documents that referred to the person continue to exist but now show "Erased person" in place of their details. Personal details that were written elsewhere in the clear (for example, a shipping address on an order line) are the merchant's business record and are removed when the organisation's data is deleted (section 12).
  • Every fact records who made it: the acting user, or the platform administrator behind an impersonated session, or the named system job (such as the Shopify connector) that acted, along with the external identifier that triggered it (a webhook delivery, a job, an import).

6. Shopify

If a merchant connects a Shopify store, we receive the shop's domain and an access token limited to the scopes the merchant granted (orders and their customers, products, markets, fulfilments and fulfillment orders, locations and inventory). The token is stored in a dedicated table, never in the journal, and is deleted when the app is uninstalled.

We handle Shopify's mandatory privacy webhooks as follows:

  • customers/data_request — recorded as a fact against the merchant's organisation. The merchant answers the request from its own records, which it can read and export from Manifold; we assist on request.
  • customers/redact — we look up the person by the email address in the request and erase them as described in section 5. The outcome (erased, no matching person, or refused) is recorded.
  • shop/redact — we delete the store's access token. The organisation's own journal is the merchant's business record and is not deleted by this webhook; it is deleted when the merchant closes the organisation (section 12).

Every one of these webhooks is verified against Shopify's HMAC signature before it is acted on.

7. Slack

If an owner or administrator installs the Manifold app into their organisation's Slack workspace, we receive from Slack the workspace's identifier, name and domain, the identifier of the app's bot user, the scopes granted, the identifier of the Slack user who approved the install and a bot access token. When a person in that workspace uses /manifold or pastes a link to their organisation's Manifold admin, Slack sends us their Slack user identifier, the command they typed or the links they pasted, and the channel and message they are in; to show their name on the page where they link their account, we ask Slack for their display name.

  • What we keep. The organisation's journal records that the workspace was installed or uninstalled, and each Slack user's link to a Manifold person being offered, confirmed and ended — with the Slack workspace and user identifiers, the workspace's and Slack user's names, who did it and when. We do not keep message text, what a command asked for or what we answered. A link's one-time code is kept only as a digest until it is used or expires (15 minutes). The bot token is sealed under a platform key in a dedicated table, never in the journal; an install started from the Slack Marketplace waits, sealed, for at most 30 minutes for someone to choose the organisation it is for, and is then removed.
  • How we use it. Only to answer the person who asked: lookups and link summaries are read with that person's own Manifold access, so they see in Slack only what their role lets them see in Manifold. A summary of a pasted link is visible to everyone in the channel, including guests and people from other organisations in a shared channel, so it shows only what the person who pasted it may see. We do not read other messages, use Slack data for advertising or to train AI models, or share it with anyone but Slack.
  • Ending it. A person ends their own link with /manifold unlink, in Settings › Apps › Slack; an owner or administrator can end anyone's. Uninstalling the app — in Manifold or in Slack — deletes the bot token and ends every link, and every person's authorisation, at once.
  • Erasure after uninstalling. Seven days after the app is uninstalled, the workspace's remaining Slack data — the Slack identifiers and names of the workspace and of the people who linked — is erased automatically: the record of the install and the links stays in the organisation's journal, but the Slack details in it are sealed under a key of the workspace's own, which is destroyed, so they can no longer be read by anyone, including us. Adding the app back within the seven days keeps them. Database backups holding them expire 14 days later (section 12).

8. AI agents

An organisation may allow an AI agent (for example Claude, via the Model Context Protocol) to act in Manifold. The agent signs in through OAuth: a person in the organisation is shown a consent screen naming the agent and the organisation, and on approval the agent receives a token that lets it act as that person, with that person's permissions, in that organisation only. Every change the agent makes is recorded as made by that person. The grant can be revoked at any time under Settings › Agents, which deletes the agent's tokens. We do not send your data to any AI provider ourselves; an agent you connect receives the data it asks for, under the policy of whoever operates that agent. We record how agents use Manifold, with PostHog: which tool was called, by which user and organisation, through which agent, how long it took, and whether it succeeded. We do not record what the agent asked for or what it received.

9. Cookies and browser storage

  • The Manifold admin keeps your session token in the browser's local storage so you stay signed in between visits, along with interface preferences (such as the catalogue you are viewing as). Its product analytics, session recordings and surveys (PostHog, section 2) keep their state in memory only. They set no cookie and write nothing to your browser's storage, and the record is tied to your user identifier only once you have signed in. The admin loads its typeface from Google Fonts, so Google receives your IP address and browser details when the font is fetched. It uses no advertising cookies.
  • Signing in sets a session cookie on the admin's origin. During Sign in with Google, short-lived cookies hold the OAuth state that protects the round trip to Google; they are cleared when it completes.
  • Passkeys use the browser's WebAuthn API; no biometric data ever leaves your device.
  • The marketing site (getmanifold.io) sets no cookies and writes nothing to your browser's storage. It loads PostHog's analytics script in cookieless mode, which counts visits as described in section 2 without storing any identifier in your browser, so there is nothing to consent to and nothing to clear. If your browser blocks PostHog, or sends a "Do Not Track" or Global Privacy Control signal and you block the script, the site works the same.

PostHog is our only analytics tool. The marketing site uses it for cookieless page counts only, with no session recordings, surveys or chat. The admin uses it as section 2 describes. We use no tag managers, advertising pixels or cross-site trackers anywhere.

10. Where and how data is stored

  • Location. All data is stored in Amazon Web Services' Asia Pacific (Sydney) region, in Australia. We do not transfer your data overseas for storage. Data may leave Australia only when you or your organisation direct it to — for example to Shopify or Google under their own policies, or to an AI agent you connect — and for billing: the billing details listed in section 2 are held by Stripe, which stores and processes them in the United States and other countries under its own privacy policy. Usage data from the marketing site and the admin (section 2), and our services' operational logs, metrics and error reports (below), are also held by PostHog in the European Union, and the operational logs by Axiom in the European Union.
  • Databases. PostgreSQL on Amazon RDS, encrypted at rest, with automated backups retained for 14 days.
  • Files. Uploaded files are held in a private Amazon S3 bucket. They are never public; a viewer receives a short-lived signed link, issued only after Manifold has checked they are entitled to the file.
  • Email. Transactional mail is sent through Amazon Simple Email Service.
  • Messaging. Services communicate internally over NATS within our private network.
  • Logs. We keep structured operational logs (one record per request or job) that carry the organisation and user identifiers involved, the outcome and timing, and the reason for any failure. They are held in Amazon CloudWatch for 30 days and are used for security, reliability and support. The same records also go to Axiom (EU), which keeps them as searchable logs for 30 days, and to PostHog, which keeps them as searchable logs, as performance metrics (counts and timings), and as error reports when something fails. Fields that could identify a person or hold a secret (email addresses, phone numbers, addresses, names, tokens, passwords) are removed from every record as it is written, before it reaches CloudWatch, Axiom or PostHog, and anything shaped like an email address is masked.
  • Secrets. Passwords are stored only as salted hashes. Shopify access tokens are held in a dedicated table outside the journal (which is readable to the whole organisation), in the encrypted database; credentials for a migration source (such as a Cin7 account) are sealed under a platform key and destroyed when the migration ends.
  • Access. Every request to the platform carries a signed, organisation-scoped token that expires after 15 minutes and is verified by each service; a person can see and change only what their organisation and role allow. Our staff access production data only to operate the service, to investigate a problem, or when you ask us to.

11. Who we share data with

We disclose personal information only to the following, and only as needed to run the service:

  • Amazon Web Services (Sydney region) — hosting, database, file storage, email delivery and logging.
  • Shopify — when your organisation connects a store, we exchange order, product, inventory, fulfilment and customer data with it, and it sends us webhooks.
  • Slack — when your organisation installs the Manifold app into its Slack workspace, we send it the answers and link summaries people in the workspace ask for, and the bot's messages to them (section 7).
  • Google — when you sign in with Google, Google learns that you are signing in to Manifold.
  • Stripe — our payment processor. Stripe receives the billing contact, billing address, tax identification number and payment details entered at checkout, and the number of sales orders we count each billing period; it holds the card, charges it, raises invoices and emails receipts and payment reminders to the billing contact.
  • AI agents your organisation connects — they receive what they ask for, as that user.
  • PostHog (EU cloud) — analytics and monitoring. PostHog receives the marketing site's page-visit data and the admin's product-usage data, session recordings, survey answers and support messages (section 2). It also receives the record of how AI agents use Manifold (section 8) and our services' operational logs, metrics and error reports (section 10). That data includes user and organisation identifiers. Apart from what you write in a survey or a support message, it includes no names, email addresses or organisation records.
  • Google Fonts — the admin's typeface. Google receives the IP address and browser details of a browser that fetches them.
  • Loqate (GBG) — address verification outside Australia. When an address outside Australia is checked, Loqate receives its postal lines and country, and nothing else: no name, contact detail, organisation or order.
  • Axiom (EU cloud) — log storage and search. Axiom receives the operational logs described under "Logs" in section 10, which carry organisation and user identifiers but no names, email addresses or the content of your records.
  • The other members of your organisation, who can see what your role allows them to.
  • Regulators, courts and law enforcement where the law requires it, and professional advisers under a duty of confidence.

We do not disclose personal information to anyone else, and we do not share it with data brokers or advertisers.

12. Retention and deletion

  • Account data is kept while your account exists. To close your account, contact us at hello@getmanifold.io; we will remove your identity record and sessions. Facts you created in an organisation's journal remain, attributed to your user identifier, because they are that organisation's business record.
  • Organisation data is kept while the organisation exists. Deleting an organisation in the admin removes its membership and identity records at once; its journal, projections, files and search index are deleted by us on the owner's request to hello@getmanifold.io, within 30 days. Uninstalling the Shopify app deletes the store's access token immediately. Uninstalling the Slack app deletes the workspace's bot token and ends every link immediately, and its remaining Slack data is erased seven days later (section 7).
  • Sealed personal data is unreadable from the moment the person is erased (section 5).
  • Backups of the database are kept for 14 days and then expire; deleted data may persist in a backup for up to that long.
  • Billing records — invoices, payments and the subscription's history — are kept for as long as tax and accounting law requires (at least five years in Australia), even after the organisation is closed; Stripe keeps its own records under its policy.
  • Logs expire after 30 days, in CloudWatch and in Axiom.
  • Usage analytics, session recordings, logs, metrics and error reports held by PostHog are deleted after at most 12 months, and sooner where our PostHog plan keeps them for less. The marketing site's page views are not linked to any person, so we cannot find or delete one visitor's views on request. Everything else is linked to your user identifier, and we delete it when you close your account or ask us to.
  • Email. We keep the record that a verification, reset or invitation was sent; the message itself is not kept once it has been delivered.

13. Your rights

Under the Australian Privacy Principles you may ask us to tell you what personal information we hold about you and to correct it. If you are in the EU or the UK you also have the rights to erasure, to portability of the data you supplied, to object to or restrict processing, and to lodge a complaint with your supervisory authority.

To exercise any of these rights, email hello@getmanifold.io. We will confirm your identity, respond within 30 days, and tell you if the law prevents us from doing what you ask (for example, where a record must be kept). There is no charge.

If your request concerns data a merchant holds about you in Manifold, we will pass it to the merchant, who is the controller, and help them answer it. A merchant can export its data as CSV at any time and can erase a person from its CRM in a single action.

If you are unhappy with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EU or UK, to your data protection authority.

14. Data breaches

If a data breach is likely to result in serious harm to anyone whose information we hold, we will notify the affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and any other regulator the law names. Where the breach concerns merchant data we will notify the merchant without undue delay so that it can meet its own obligations.

15. Children

Manifold is a business tool. It is not directed at, and we do not knowingly collect information from, anyone under 18. A merchant that records a customer who is a minor does so as the controller of that record.

16. Changes to this policy

We may update this policy as the service changes. The "Last updated" date at the top tells you when. For a material change we will notify account holders by email or a notice in the admin before it takes effect. Continued use of Manifold after that date is acceptance of the revised policy.

17. Contact

Privacy enquiries, requests and complaints: hello@getmanifold.io

Bam Sock Pow Pty Ltd (ABN 53 165 151 708)

This policy is governed by the laws of Victoria, Australia.