Privacy Policy

Account data is about you as someone who uses Managio: your name, email and how you sign in. We decide how it is used, as described here.

Business data is what a business records in Managio about its customers, team and money. The business decides what to record and why, and we store and process it on the business's behalf to provide the service. If you are a customer of a business that uses Managio, please contact that business first about your data; we will help it respond.

• Your account: name, email address, phone number (optional), whether you confirmed your email, and when you last signed in. Your password is stored only as a one-way BCrypt hash; we cannot see it.
• Google sign-in, if you use it: Google sends us a signed token with your Google account ID, email address, whether Google has verified that email, and your name. We do not receive your Google password or access to your Gmail, contacts, files or any other Google service.
• Sign-in and security records: for each sign-in attempt and session, the IP address, browser (user agent), time and outcome; counts of failed attempts and temporary lockouts. Session tokens are stored only as hashes.
• Activity log: changes made in a business, who made them, when, and from which IP address, so owners can see what happened.
• Business data entered by businesses and their teams: the business's details (name, contact details, address, GSTIN and settings); customers (name, phone, email, and optionally date of birth, gender, address, a guardian's name and phone, and notes); memberships and plans; invoices, payments and refunds; expenses; team members (job title, phone, employee code, joining date, salary and payroll); attendance, tasks, requests and notifications.
• Customer portal: if a business invites you to its portal, your login (email or phone), a hash of your password and your sign-in records.

Managio records payments that a business has received by cash, UPI, card, bank transfer or other means. It does not process payments and never receives or stores card numbers or bank login details.

• To provide Managio: sign you in, store and show your records to the people allowed to see them, and send the emails below.
• To keep Managio secure: limit repeated attempts, lock an account after repeated wrong passwords, and investigate misuse.
• To answer you when you contact us, and to fix problems and keep the service running, including backups.

We do not sell personal data, show advertising, or use advertising or analytics trackers. Within a business, what each team member can see is set by the role its owner gives them.

Account emails: confirming your email address, resetting a password, and invitations to join a business's team or its customer portal. Businesses can also have Managio email their customers a reminder three days before a plan ends; each business can turn these reminders off. Emails are sent from noreply@managio.me through our email provider.

Managio uses only cookies that are strictly necessary to keep you signed in: mg_rt for team accounts and mg_prt for the customer portal. They cannot be read by page scripts, are sent only to Managio, and last up to 30 days or until you sign out. The short-lived access token that proves who you are is kept in the page's memory, not in a cookie or browser storage.

If you use Google sign-in, Google's sign-in script may store its own small cookie (such as g_state) to remember its state; Google's privacy policy covers it. Because there are no analytics or advertising cookies, Managio does not show a cookie banner.

These service providers process data only to provide their service to us:

• Vercel delivers the website and app pages.
• Render runs Managio's application servers.
• Supabase hosts the PostgreSQL database where account and business data are stored.
• Resend sends Managio's emails.
• Google signs you in, only if you choose Google sign-in.

These providers may process data in countries other than the one you live in. We share data with others only if the law requires it.

• Account and business data are kept while the account or business exists on Managio.
• Payments, invoices and expenses are voided with a reason instead of being deleted, so a business's books stay correct. An archived business keeps its data.
• Expired sessions, one-time links and retry records are deleted automatically about a week after they expire.
• Sign-in records and the activity log are kept for security and auditing while the account or business exists.

If you ask us to delete your account, we will delete it, and the data of any business you own, after confirming the request comes from you, except for anything we must keep to meet a legal obligation or resolve a dispute.

• See and correct your name and phone number on your account page at any time.
• Take your data with you: business owners can export their customer list as a CSV file. For anything else, email us.
• Delete your account or ask what data we hold about you by emailing nitinr0306@gmail.com from your account's email address. Account deletion is handled by email for now.
• Customers of a business should ask that business to correct or delete their records; the business controls them.

Depending on where you live, data-protection law (for example India's Digital Personal Data Protection Act, 2023) may give you further rights. We will respond to requests as the law that applies to us requires.

Managio is served over HTTPS only, keeps every business's data separate, and checks permissions on the server for every request. Our security page describes the protections in place and how to report a problem.

Managio accounts are for adults running or working in a business. Businesses such as schools and coaching centres may record details of students who are children, and are responsible for having permission to do so, for example from a parent or guardian.

When this policy changes, we will update it here and change the date at the top. If a change affects how we use data you have already given us, we will tell account holders by email or in Managio before it takes effect.

Email nitinr0306@gmail.com with any question about this policy or your data. See also our Terms of Service.