Privacy & Cookie Policy
Last updated 17 July 2026
This policy explains what personal data Manta collects, why, and the choices you have. Manta is operated by Manta Travel Pte. Ltd. (“we”, “us”), based in Singapore.
1. Who we are
Manta is a group-trip planning service operated by Manta Travel Pte. Ltd. (UEN 202629831Z), a company incorporated in Singapore with its registered office at 10 Anson Road, #20-05, International Plaza, Singapore 079903. Manta Travel Pte. Ltd. is the controller of your personal data. For any privacy question, or to exercise your rights, contact us at support@wemanta.com.
2. Information we collect
We collect only what we need to run the service:
- Account & profile: your email address (for magic-link sign-in), display name, and optional profile details you add (such as avatar, dietary notes, or travel preferences and dislikes).
- Trip content: the trips, wishlists, plans, surveys (including availability windows and free-text answers), documents, journal entries, and messages you and your group create.
- Travel history you log: places you record as visited, with dates, for your private footprint.
- Money amounts you track: trip spending and budget figures you enter (we never move money or hold payment details).
- Contact details you provide for others: the email address (or phone number) you use to invite someone, and the display names of people you add to a trip.
- Usage & analytics: first-party events about how the product is used (pages and screens viewed, features used), tied to an anonymous identifier — see “Cookies” and “Analytics & your choices” below.
- Device & log data: standard technical information such as IP address, browser/user-agent, and approximate country (from your network), used for security and to operate the site.
We do not sell your personal data, and we do not use advertising or cross-site tracking networks.
4. How we use information
- To provide and operate the service — create and manage trips, sign you in, and sync your group’s content.
- To keep the service secure and reliable, and to prevent abuse.
- To understand and improve how the product is used, through analytics (only with consent where required) - see “Analytics & your choices”.
- To communicate with you about your trips and account (for example, magic-link sign-in emails).
- To send you marketing or product-update emails, where you have opted in - you can unsubscribe at any time (see “Marketing communications”).
5. AI-assisted features
Some features use AI models to help you plan: for example, turning a link you save into a wishlist card (we fetch the page and send its text to the model), drafting a starter itinerary from your trip’s inputs, or suggesting activities that fit your group. To do this we send the relevant trip content to AWS Bedrock, which runs the models on our behalf under our AWS agreement; the content is not used to train third-party models. AI output is always a suggestion — it never makes decisions about you, and your group can edit or discard it.
6. Analytics & your choices
We collect analytics first-party: your browser sends events to our own servers, using an identifier we set ourselves, and no analytics vendor’s code runs on your device.
We then share a copy of those events with Mixpanel, our product-analytics provider, so we can understand how the product is used and improve it. Mixpanel receives the events and an anonymous identifier. It does not receive your name or your email address. Mixpanel processes the data in the United States on our behalf, under a data-processing agreement and appropriate transfer safeguards.
We never sell your data, and we do not share it with advertising networks.
If you are in the EU, UK, or EEA, we do not set analytics cookies or collect analytics events until you accept them. Elsewhere, analytics are on by default and you can opt out at any time. Either way, your choice is remembered and you can change it whenever you like via “Cookie preferences”.
If you decline analytics, we do not share your events with Mixpanel.
7. Marketing communications
We send marketing emails (such as product updates and launch news) only to people who have opted in. Where consent is unclear, we confirm your email address first (double opt-in) before adding you to a marketing list.
Every marketing email includes an unsubscribe link and supports one-click unsubscribe, and you can withdraw your consent at any time. When you unsubscribe - or if your address bounces or reports a message as spam - we add you to a suppression list and stop sending you marketing across all of our lists. We keep a record of the consent wording you agreed to and when.
Transactional messages - such as magic-link sign-in, invitations, and notifications about your trips and account - are part of using the service and are not marketing; you receive these while you have an account, regardless of your marketing choices.
8. Legal bases & notices (GDPR / PDPA)
Where the EU/UK GDPR applies, we rely on: performance of a contract (to provide the service), your consent (for non-essential analytics cookies and for marketing emails), and our legitimate interests (to secure and improve the service), as appropriate.
Where Singapore’s PDPA applies, this policy serves as notice of the purposes for which we collect, use, and disclose personal data, and we collect it with your consent (including deemed consent where permitted by law).
10. Who processes data for us
To run Manta we rely on a small number of companies that process personal data on our behalf - to host the service, deliver our emails, protect it from abuse, sign you in, and help us understand how it is used. They act only on our instructions, under contract, and only for the purposes below. This list is current:
| Provider | What they do | Data they receive | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage, email delivery, and AI-assisted suggestions - the platform the whole service runs on. | Effectively all of it: account and profile data, your trip content and documents, email addresses, and technical/log data such as IP address. | United States | Standard contractual clauses |
| Cloudflare | Image storage and delivery (avatars and trip covers), and bot/abuse protection on sign-up. | Profile and trip images you upload, and your IP address when images load or a check runs. | United States | Standard contractual clauses |
| Sign-in with Google, maps, place search, and web fonts. | For sign-in: your email address, name, and profile picture. For maps and fonts: your IP address. For place search: the location terms you type. | United States | Standard contractual clauses | |
| Mixpanel | Product analytics - understanding how the product is used so we can improve it. | Product-usage events and an anonymous analytics identifier. Never your name or email address. Only shared if you have not declined analytics. | United States | Standard contractual clauses |
| Pexels | Suggesting stock photos for trip covers and wishlist items. | The search terms we derive from your trip (such as its destination) - never your identity. | United States | Standard contractual clauses |
| OpenStreetMap Foundation (Nominatim) | Fallback geocoding - resolving a place name you log (for example in your travel footprint) to coordinates when our own gazetteer has no match. | The place name being looked up and the server’s request metadata - never your identity. | European Union (United Kingdom / Netherlands) | Public API; only non-identifying place names are sent |
We update this list in the same change that adds a provider, so it stays current rather than being a periodic snapshot. Replacing a provider with another that does the same kind of work (for example, a different hosting or email provider) is not a material change. If we ever process your personal data for a genuinely new purpose, or share it with a new kind of recipient not described here, that is a material change and we will tell you. This list is part of this policy (see "Changes to this policy" below), and we also publish it on a standalone Sub-processors page for easy reference.
11. International transfers
We operate from Singapore and use reputable providers that may process data in other countries, including the United States. Where personal data is transferred outside your region, we rely on appropriate safeguards - principally the European Commission's standard contractual clauses (and their UK equivalent). The processing location and the safeguard for each provider are shown in "Who processes data for us".
12. Data retention
We keep personal data for as long as your account is active or as needed to provide the service, and thereafter only as long as necessary to meet legal, security, or legitimate-business needs. You can ask us to delete your account and associated personal data.
When you delete your account, our systems remove or anonymise your personal data immediately; residual copies in encrypted backups roll off automatically within about 35 days. Server logs are kept for at most 3 months.
13. Your rights
Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent.
To exercise any of these, contact support@wemanta.com. You may also have the right to complain to your local data-protection authority.
14. Security
We use technical and organisational measures — including encryption in transit, access controls, and authentication — to protect personal data. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.
15. Children
Manta is not directed to children and accounts are for adults (18+) only. A child on a trip is a name-only record added by a responsible adult: children cannot hold accounts or trip roles, and the product does not accept dietary, accessibility, contact, or document details for a child record. If you believe a child has provided us personal data, contact us and we will delete it.
16. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.
17. Contact us
Questions about this policy or your personal data? Email support@wemanta.com.