Who we are
Manibag is operated by Ivarqo, a company registered in Wyoming, United States. References to Manibag, we, us or our in this policy mean that operator. Contact info@ivarqo.com about privacy, access to your information or this policy.
Manibag helps independent businesses manage products, customer conversations and orders. A shop using Manibag is a separate business. Its own privacy notice and sales policies apply to how it uses your information.
Our role and the shop’s role
We determine how account, subscription, support and platform-security information is used to run Manibag. For these purposes, we act as the controller or equivalent responsible party under applicable data-protection law.
A merchant generally determines why and how its customers’ messages, contact details and order records are used. We process that information on the merchant’s instructions to provide the service, except where we must independently process it for security, legal obligations or enforcement of our terms.
If your request concerns a purchase or a conversation with a shop, contact that shop first. We can help identify the relevant merchant and assist with requests relating to data we process for it. Workspace administrators control who can access their business records.
Information we handle
- Account information: your name, email address, password hash, authentication and verification records, workspace membership, role and preferences.
- Business and subscription information: shop and business details, selected plan, billing contacts, invoices, payment references and subscription history.
- Shopper and order information: names, email addresses, telephone numbers, delivery addresses, baskets, saved items, products ordered, quantities, specifications, order notes and payment or fulfilment status, where the merchant collects them.
- Conversations and AI inputs: messages, prompts, attachments, product information and relevant order or customer context used by an enabled assistant, together with responses and action history.
- Integration information: connected account identifiers, permissions, access tokens and delivery or error information needed to operate channels you connect.
- Technical and support information: IP addresses, browser or device details, session identifiers, request times, security events, error diagnostics and correspondence with our team.
Where information comes from
We receive information from you when you register, use the service, place an order, send a message or contact support. Merchants and their team members may enter or import customer information and invite other users. Connected messaging, payment and delivery services may send information about interactions or transactions you authorize.
Some technical information is generated automatically when a browser or integration connects to the service. Required form fields are identified in the interface. Without information necessary to create an account, deliver an order or authenticate a request, the relevant service may not work. Optional information should only be provided when needed.
Why we use information
Where a legal basis is required, we rely on our agreement to provide account, subscription and support services; legal obligations for required records and disclosures; and legitimate interests, balanced against individuals’ rights, for security, abuse prevention and appropriate service improvements. We rely on consent for optional tracking or communications where the law requires it. A merchant is responsible for the legal basis for its own customer communications and business activities.
- Provide accounts and shops; maintain products, baskets and orders; deliver messages; and carry out authorized integrations and automations.
- Verify users, enforce permissions, prevent fraud and abuse, investigate incidents and keep the service reliable.
- Manage subscriptions, usage allowances, billing, support and necessary service communications, such as verification links, password resets and account notices.
- Understand service performance, diagnose problems and improve functionality using information appropriate to those purposes.
- Send optional communications where permitted and respect unsubscribe or preference choices.
- Meet legal obligations, maintain necessary business records, handle disputes and enforce our agreements.
AI and automated actions
When an AI feature is enabled, relevant prompts, messages, attachments and permitted business context may be sent to the configured AI provider. Depending on the feature and configuration, providers can include OpenAI and Cloudflare. Responses and action results may be stored in conversations, orders, activity records or usage logs.
Provider processing, retention and any model-training treatment depend on the selected service, account and provider terms. This policy does not promise that every provider offers the same retention settings or excludes every input from training. Ask the merchant or workspace administrator which features and providers are enabled before submitting sensitive information.
An assistant can suggest products, collect order details and perform actions allowed by the merchant’s configuration. AI can make mistakes. Merchants must apply appropriate review and must not use the service to make unlawful decisions about people based solely on automated processing. Do not send passwords, payment-card security codes or sensitive information that is unnecessary for the conversation.
International processing
Manibag is provided by a company based in the United States and uses globally distributed infrastructure. Information may be processed in the United States and other countries where service providers operate. A subscription plan does not by itself guarantee storage in a particular country.
Applicable data-transfer requirements must be addressed through the relevant service arrangements and safeguards. Contact info@ivarqo.com for information about providers and transfer arrangements, or before using Manibag for data that requires a specific hosting region or a data-processing agreement.
Retention, closure and deletion
Retention depends on the purpose of the record, the merchant’s instructions and configuration, the status of the account, and legal or operational requirements. Account and business records are kept as needed to provide the service. Authentication tokens, activity records and backups have separate lifecycles; a monthly usage reset does not mean messages or order records are deleted.
Cancelling a subscription does not automatically delete the workspace or all of its data. Use available export tools for supported records before closing a shop, and contact us about other access or deletion requests. Inactive trial workspaces may go through a warning and cleanup process. Data that is no longer needed and has no lawful retention basis is deleted or anonymized through the relevant process.
Raw shop analytics have a default retention period of 395 days, configurable for the shop. Summary statistics may remain after raw events are removed. This setting does not determine the retention of messages, orders or other records.
A shopper-account deletion applies to the relevant store and can remove or anonymize profile details, saved addresses, baskets and saved items. Shared customer details may remain while another active account still uses them. Order, invoice, receipt and accounting snapshots can remain where needed for the merchant’s transaction records, legal obligations or disputes. Deletion does not remove copies already held by a merchant, an export recipient or a connected platform.
Backups, security records, billing records and material subject to a legal hold may outlast deletion from the active account. Contact info@ivarqo.com for the retention criteria or deletion process relevant to a particular category of information.
Protecting information
We use measures such as encrypted connections, password hashing, access permissions and security monitoring to protect information. No online service or transmission method can be guaranteed completely secure.
Keep credentials private, enable available two-factor authentication, review team access and revoke integrations you no longer need. Report suspected unauthorized access promptly through our contact page or info@ivarqo.com. We handle incidents and any required notifications according to applicable law.
Your rights and choices
Depending on applicable law and the circumstances, you may request access to your personal information, correction, deletion, restriction of processing or a portable copy; object to certain processing; or withdraw consent for future processing based on that consent. You may also complain to the competent authority or seek the remedies available in your jurisdiction. Withdrawal does not invalidate processing that was lawful before it.
Send requests to info@ivarqo.com, identifying the account or shop concerned and the request you want us to handle. Do not include your password or a full payment-card number. We may verify your identity and authority using proportionate information, and will respond within the time required by the applicable law. Some records or requests are subject to lawful exceptions.
For information controlled by a merchant, we may refer the request to that merchant and assist it. Marketing opt-outs do not stop essential account, security or transaction messages. You can manage available preferences in the service and use unsubscribe links where provided.
Children and sensitive information
Merchant accounts are intended for adults authorized to run a business. Manibag is not directed at children, and merchants must comply with age restrictions and privacy rules that apply to their own customers and products. Contact us if you believe a child has supplied information inappropriately.
Do not upload sensitive personal information unless it is necessary, you have authority and a lawful basis to use it, and the relevant service arrangements are suitable for that information.
Policy updates and contact
We may update this policy when the service, our practices or legal requirements change. The date above identifies the latest version. We will provide additional notice of material changes where required and obtain consent where the law requires it.
For privacy questions, contact Ivarqo at info@ivarqo.com. The merchant remains the first contact for its products, deliveries, returns and use of shopper information.