Privacy Policy
Last updated:
This policy explains how avanexx GmbH processes personal data: on this website, and in Manager, the AI-first project management platform we offer as a hosted service. Manager is also available as a self-hosted server edition and as a desktop edition; where you use one of those, the organisation or person running it decides what happens to the data (see Section 6).
For the content that businesses and other organisations store in the platform, they are responsible themselves; we process it on their behalf. If you use Manager privately, we are also responsible for your content and process it only to provide the service to you.
1. Controller
Email: privacy@manager-agent.com
Managing director: Kevin Fischer
Depending on the data concerned, we act either as controller or as processor:
- As controller (Art. 4(7) GDPR) we decide the purposes and means ourselves. This covers this website, account registration and administration, authentication and security, operating and supporting the service, our billing, our communication with you, and the content of customers who use Manager privately for personal or household purposes.
- As processor (Art. 4(8), Art. 28 GDPR) we only execute the documented instructions of a customer who uses Manager professionally, for example as a business, a self-employed person or another organisation. This covers everything such a customer and its users create and store in the platform: work items, comments, wiki pages, canvases, files, meeting notes, channel and topic entries, messages, time entries and agent sessions (“Customer Content”). The customer remains the controller; the relationship is governed by our Data Processing Agreement and by that customer’s own privacy notice.
Which one applies to you:
| What you are using | Who is responsible |
|---|---|
| This website | Us, as controller |
| Hosted Manager: your account, login, security and audit data | Us, as controller |
| Hosted Manager at work: the project content you and your colleagues create | Whoever booked the account for professional use, as controller; us as its processor |
| Hosted Manager, used privately: your project content | Us, as controller |
| Self-hosted server edition or desktop edition | The organisation or person operating that installation |
2. This website
This website runs on a server we rent from a hosting provider, who is bound to us as a processor under an Art. 28 GDPR agreement.
What the web server records
Each request your browser makes is written to a server log:
| Data | What it is used for |
|---|---|
| IP address | Delivering the response to you; blocking abusive traffic |
| Date and time of the request | Correlating requests when something goes wrong |
| Requested path and HTTP method | Finding broken links and missing files |
| HTTP status code and amount of data transferred | Detecting errors and unusual traffic |
| Referring URL, if your browser sends one | Understanding which link brought you here |
| User agent string (browser, version, operating system) | Fixing rendering and compatibility problems |
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the pages you asked for, to keep the server stable and available, and to be able to recognise, trace and defend against attacks.
We do not combine these logs with other data. As a rule they are deleted after no more than 30 days, unless we need them to investigate a specific security incident.
Cookies and third parties
This website sets no cookies, stores nothing in your browser and uses no analytics or tracking services. Fonts, images and scripts are served from our own server; nothing is loaded from third parties.
Contacting us by email
If you write to us by email, we receive your email address, whatever name your mail program transmits, and the content of your message.
Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or steps taken prior to entering into one, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries addressed to us). Our mailboxes are hosted by an email provider acting as our processor.
We keep correspondence for as long as the matter requires and delete it afterwards. Where a message qualifies as a commercial or business letter, the statutory retention periods under commercial and tax law apply, and the message is retained for their duration and then deleted.
Contact form
The contact form sends us your name, if you give one, your email address, your message and the language of the page you sent it from. They reach our mailbox as an email, with your address as the one our reply goes to; the form sends nothing to you or to anyone else.
Before the form sends, your browser solves a small computing task from our own server (a proof of work). It keeps automated spam out without a cookie, without storing anything in your browser and without any third party, and it starts when you first click into the form.
Like any request, sending the form appears in the web server log described above. The form’s server itself holds your IP address only in its memory, for at most an hour, to limit how many messages one connection can send; it neither logs nor stores it. Your message is not kept on the web server.
Legal basis: for your message, as for an email: Art. 6(1)(b) GDPR where it concerns a contract or steps taken prior to entering into one, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries addressed to us). For the spam protection and the limit per connection, Art. 6(1)(f) GDPR: our interest in keeping the form usable and our mailbox free of automated messages.
We keep your message like any email to us, as described above.
3. The hosted Manager service
This section describes the service we operate for customers. It applies once you have an account in the hosted service.
3.1 What the platform stores
| Category | What it contains | Our role |
|---|---|---|
| Account data | Email address, display name, password (stored only as a hash), optional avatar, interface language, colour/theme preference, notification preferences, account type (human or agent), account status and role, setup and email-verification status, and which version of each legal document you accepted and when | Controller |
| Authentication and session data | Session records with a session token, the IP address and browser user agent used, and an expiry time; API and MCP keys, stored only as a hash and optionally confined to specific projects; SSO connections with the identity provider and your identifier and email address there (the provider’s access and refresh tokens are not stored) | Controller |
| Security data | Known login devices: a fingerprint derived from IP address and user agent with first and last seen timestamps, used to spot logins from a new device and alert you | Controller |
| Audit log | Security- and administration-relevant events such as successful and failed logins, password changes, key and SSO changes, and account and permission changes, each with the acting user, the action, the affected resource, a timestamp and the IP address | Controller |
| Application logs | Technical server logs of the running service, comparable in content to the website logs above | Controller |
| Presence | While you have a project open, the other members of that project can see that you are there. This information is held only temporarily and is not stored permanently | Controller |
| Content data | Everything a customer and their team create: work items and their fields and history, comments, wiki pages and revisions, canvases, milestones, channel and topic entries including messages from connected sources, meeting notes, time entries, notifications and in-app messages | Processor |
| Files | Uploads and attachments stored by the service, or files in a storage system the customer connects itself (S3-compatible storage, SharePoint/OneDrive, a git remote) | Processor |
| Agent and AI session data | Agent accounts and their configuration and instructions, session transcripts, the tool calls agents make and their results, agent observations and agent-to-human messages | Processor |
| Search index and embeddings | Full-text index entries and vector embeddings derived from content, computed inside the service, used to answer searches | Processor |
| Contract and billing data | Where you conclude a paid contract with us: name or company, contact person, address, plan, invoices and payment records | Controller |
Where a customer uses Manager privately, we are also the controller for their content data, files, agent and AI session data and search index.
We use no analytics, advertising or behavioural tracking inside the product.
3.2 Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service and your account: registration, authentication, delivering the features, and the transactional email that goes with them (email verification, password reset, confirmation of an email change, the notifications you switched on) | Art. 6(1)(b) GDPR (performance of a contract, or steps prior to it) |
| Hosting and processing Customer Content | For professional use, on the customer’s documented instruction under Art. 28 GDPR and the DPA; the legal basis for the processing is then the customer’s responsibility. For private use, Art. 6(1)(b) GDPR (performance of the contract) |
| Security, abuse prevention, integrity, audit logging, new-device alerts, rate limiting | Art. 6(1)(f) GDPR (our interest, shared with our customers, in a service that is secure, available and accountable) |
| Support, and our communication with you about the service | Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR where you are not the contracting party yourself |
| Single sign-on, if you choose it | Art. 6(1)(b) GDPR at your request, and Art. 6(1)(f) GDPR (our interest in offering secure federated login) |
| AI features, including agent sessions and semantic search (Section 4) | Art. 6(1)(b) GDPR where they are part of the agreed service; on the customer’s instruction under Art. 28 GDPR for Customer Content; Art. 6(1)(a) GDPR where we ask you for consent |
| Billing, accounting, and complying with legal obligations such as commercial and tax retention or answering a lawful request | Art. 6(1)(b) and Art. 6(1)(c) GDPR |
| Any email that is not needed to perform the contract, such as a product announcement | Art. 6(1)(a) GDPR (consent, which you can withdraw at any time) |
Where we rely on legitimate interests you may object under Art. 21 GDPR (Section 8). Where we rely on consent you may withdraw it at any time with effect for the future; the processing carried out until then remains lawful.
3.3 Cookies and browser storage in the application
To keep you signed in, the application uses one strictly necessary session cookie. The cookie is not readable by scripts, is transmitted only over encrypted connections, expires after a defined period (30 days by default) and is deleted when you log out. You can end a session yourself at any time from your account settings.
The application also uses your browser’s local storage for functional purposes only, for example to remember your theme, your language and the layout choices you made.
3.4 Where the data comes from, and what you have to provide
Most data comes from you. Where your employer or client set up the account, the account data comes from them, and content about you may be entered by your colleagues. Data from third parties reaches us only through connections a customer configures itself: an identity provider on SSO login, a connected storage system, or a channel that brings email or webhook messages into a project.
An email address and the data needed to authenticate you are required to create and use an account; without them the service cannot be provided. Everything else, such as avatar, language, theme and notification settings, is optional, and leaving it out only limits the corresponding feature.
4. AI features, agents and model providers
Manager treats AI agents as participants: they have their own accounts, they can be assigned work, and they read and write project content within the permissions granted to them.
When content is sent to a model provider. Only when an AI feature is actually used: someone starts or continues an agent session, runs an AI action, or an automation that the customer configured runs, such as a trigger or a scheduled agent. Without such an occasion we send no content to model providers.
What is sent. The instruction or message, the conversation so far in that session, the definitions of the tools the agent is allowed to call, and the project content the agent actually reads while working on the task: the work items, comments, wiki pages, search results, channel entries or files it opens, and the results its tool calls return. Whatever personal data that content contains travels with it.
On whose instruction. For professional use this is processing on the customer’s documented instruction; for private use it is part of the service you agreed with us. Either way, the customer decides whether AI features are enabled, which agents exist, what they are instructed to do and which projects they can reach. We do not use Customer Content to train models, neither our own nor anyone else’s.
Which providers. A customer can use AI features in two ways:
- Through models we provide and bill by usage. The model providers are then our processors, for professional use our sub-processors, and are bound by contract with us not to train on the content submitted to them. The current list, with the country in which each provider processes, is set out in Annex C to our Data Processing Agreement. Customers are informed of changes as provided there, and can object.
- With their own access (bring your own key) to a provider of their choice or to a model on their own infrastructure. The customer then chooses the provider, and the customer’s own contract with that provider governs its processing.
Where a provider processes outside the EEA, Section 6 applies.
Search and indexing stay inside the service. Semantic search works on vector embeddings. In the hosted service they are computed by a model that runs inside the service itself; no content leaves the service to build or query the search index.
No automated decision-making in the sense of Art. 22 GDPR. Agents carry out instructions given by the members of a project. They do not make decisions about you that produce legal effects concerning you or similarly significantly affect you. What they produce is project work, such as drafts, suggestions and updates to items, that people in the project review and can undo.
5. Recipients and sub-processors
We disclose personal data only to the following categories of recipient. Every processor works for us under a data processing agreement with the guarantees required by Art. 28 GDPR, and is bound to confidentiality.
| Recipient category | What they do |
|---|---|
| Hosting and infrastructure provider | Provides the servers on which the hosted service (with its database and file storage) and this website run |
| Email provider (sending and our mailboxes) | Sends transactional email such as verification, password reset links, security alerts and notifications, and hosts our mailboxes |
| AI model providers | Only when AI features are used through the models we provide (Section 4) |
| Identity providers | Only if you sign in via SSO: the provider you choose (for example Google, Microsoft, GitHub or another OIDC provider), on your instruction |
| Storage and source systems a customer connects | S3-compatible storage, SharePoint/OneDrive, git remotes. These are the customer’s own systems; the customer connects them and is responsible for them |
| Webhook endpoints configured in the service | The service can send event notifications to endpoints configured by a customer. Whoever operates the receiving endpoint is responsible for the processing there |
| Tax advisers, auditors, lawyers, and public authorities | Only where necessary for our legal obligations or to establish, exercise or defend legal claims |
The current, named list of sub-processors for the hosted service, including the hosting and email providers and the model providers, is set out in Annex C to our Data Processing Agreement. Customers with a Data Processing Agreement receive it with that agreement, and anyone else can request it.
We do not sell personal data, do not rent it out, and do not pass it on for advertising purposes.
6. Storage location, third-country transfers and self-hosting
Where the hosted service stores data. The hosted service runs on infrastructure in the European Union, as a rule in Germany. The application database and uploaded files stay there. At a customer’s request we also run that customer’s instance in another region, for example in the United States.
Transfers outside the EEA. A transfer to a third country can occur in three situations: where a model provider we engage processes outside the EEA (Section 4), where a customer has its instance run outside the EEA at its own request, and where a customer connects a system or model access of its own that is located outside the EEA. In the first two cases we safeguard the transfer under Art. 44 ff. GDPR, on an adequacy decision of the European Commission where the recipient is covered by one, and otherwise on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with a transfer impact assessment and the supplementary technical and organisational measures it identifies. In the third case the customer decides on the transfer and is responsible for its basis. We provide copies of the safeguards on request.
Self-hosting and the desktop edition. Manager can be run on your own infrastructure, and the desktop edition keeps its database and files on the device it runs on. Whoever runs the installation is then the controller; this policy does not apply to that processing. Data leaves such an installation only through the integrations its operator configures, for example an external AI provider. You can read more about the options on our data sovereignty page.
7. Retention and deletion
| Data | How long we keep it |
|---|---|
| Website server logs | As a rule no longer than 30 days; longer only for an open security investigation |
| Email correspondence | Until the matter is settled; commercial and business letters for the statutory commercial and tax retention periods |
| Account data | For as long as the account exists |
| Sessions | Until they expire (30 days by default), or until you log out or revoke them earlier |
| API and MCP keys | Until you delete them, or until the expiry date you set |
| SSO connections and known devices | Until you disconnect or remove them, or the account is deleted |
| Audit log | For as long as it is needed for security and accountability, and where a statutory retention obligation applies, for its duration |
| Customer Content | For professional use according to the customer’s instructions and the DPA, for private use until the contract ends; then deleted or returned as the Terms of Service provide |
| Contract, billing and accounting records | For the statutory retention periods under commercial and tax law |
Account deletion. When an account is deleted, the account itself and its sessions, API and MCP keys, SSO connections, known devices and avatar are deleted. Authorship details on content that stays in the project, such as comments, work items and time entries, are anonymised; the content itself stays in the customer’s project.
Backups. We keep backups so that data can be restored after a failure. They are retained for a limited period and are overwritten on a rolling basis. Data deleted from the live system therefore still exists in backups until the backup containing it expires, and is restored only in a genuine recovery. Where a restore reintroduces data that was deleted, we delete it again.
Beyond the periods above we retain data only where a legal obligation requires it, or where it is needed to establish, exercise or defend legal claims.
8. Your rights
Subject to the conditions in the GDPR, you have the right to:
- access the personal data we process about you, and to a copy of it (Art. 15);
- rectification of inaccurate data and completion of incomplete data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability, meaning to receive the data you provided in a structured, commonly used, machine-readable format (Art. 20);
- object to processing based on legitimate interests (Art. 21); and
- withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3)).
Right to object (Art. 21 GDPR). Where we process personal data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If you object to processing for direct marketing, we will no longer process your data for that purpose.
How to exercise them. Write to privacy@manager-agent.com or to the postal address in Section 1. Exercising your rights is free of charge. If we have reasonable doubts about your identity we may ask for information to confirm it. We answer without undue delay and at the latest within one month; where a request is complex we may extend that by up to two further months and will tell you why (Art. 12(3) GDPR).
If your data is Customer Content. Where your data sits in the project of a customer who uses Manager professionally, typically your employer’s, that customer is the controller and decides on your request. Please address it to them; if you send it to us, we will forward it and support them as their processor, as the DPA requires.
Complaint to a supervisory authority (Art. 77 GDPR). You can lodge a complaint with a supervisory authority, in particular in the EU or EEA member state where you live, where you work, or where the alleged infringement took place. The authority competent for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Complaining to a supervisory authority does not affect any other remedy. You can also contact us directly at any time.
9. Security
We take appropriate technical and organisational measures under Art. 32 GDPR, taking account of the state of the art, the cost of implementation and the risk to the people concerned. In summary:
- transport encryption (TLS) for every connection to the service and to this website;
- passwords stored only as salted hashes produced by a modern password-hashing function;
- API and MCP keys stored only as hashes and optionally confined to individual projects;
- encryption of stored secrets such as connector and mail server credentials and webhook signing secrets;
- hardened session cookies that scripts cannot read and that are transmitted only over encrypted connections;
- role-based access control, with project membership deciding what a person or an agent can see;
- safeguards on outbound integrations and webhooks;
- audit logging of security- and administration-relevant actions, and alerts on logins from a new device;
- regular backups of the service data.
The full description of our technical and organisational measures is set out in Annex B to our Data Processing Agreement. Customers with a Data Processing Agreement receive it with that agreement, and we provide it to anyone else on request.
10. Children
Manager is made for businesses and adults, at work or privately, and not for children. We do not knowingly process the personal data of children.
11. Changes to this policy
We update this policy when the service, our processors or the legal requirements change. The current version is always the one published here and inside the product, with the date of the last substantive revision at the top. If a change materially affects how we process your personal data, we will inform account holders in advance by email or in the application, and where a change requires your consent we will ask for it.
12. Contact
For any question about this policy, about how we process your data, or to exercise your rights, write to privacy@manager-agent.com or to the postal address in Section 1. Our complete company details are in the Imprint; the agreement covering Customer Content is the Data Processing Agreement, which we supply with the contract and on request.