Privacy Policy

Who we are

Mansa is operated by Chameleon Technology, Inc., a Delaware corporation ("Chameleon Technology", "we", "us"). We are responsible for the personal information described in this policy, except where Section 2 says we act on behalf of a customer.

Chameleon Technology, Inc.
2810 N Church St STE 90792
Wilmington, DE 19802
United States
support@kupoluyi.com

What this policy covers

This policy applies to:

• this website, mansa.kupoluyi.com;
• the Mansa application and its API, where you create agents and work with them;
• phone numbers bought through Mansa, and texts sent to and from them; and
• the Mansa chat widget when a customer embeds it on their own website.

When a customer embeds the widget, that customer decides what their agent does and what it's told to collect. For visitors to that site we process widget conversations on the customer's behalf, and the customer's own privacy notice also applies. If you're a visitor with a question about your data, contact the website owner, and we'll help them respond.

Information we collect

Account information

When you sign in, our sign-in service holds your username, email address, name and password (stored hashed). The rest of Mansa identifies your workspace by an internal account identifier.

What you and your agents create

Prompts and messages you send, your agents' replies, the tools they call and those tools' results (for example, command output and the contents of files an agent reads), automations and their notes, and files your agents publish. We also store your settings, such as agent names, models and working directories.

Agent machines

Each agent has a cloud machine. We store its filesystem, including anything you or your agent put there such as code, packages and data, and saved versions (snapshots) of it.

Secrets and keys

Secrets you give your agents and the model provider keys you connect are stored encrypted. For API keys you create to access Mansa, we store only a hash and the last four characters.

Connected Google accounts

If you connect Gmail or Google Drive, see Section 5.

Phone numbers and texts

Numbers you buy through Mansa, the phone numbers you link to them, the content of texts sent to and from an agent's number, message identifiers from our messaging providers, and records of phone verifications. See Section 6.

Website widget

Messages visitors send and the agent's replies, and the address of the website the widget is running on. A visitor's IP address is used briefly to rate-limit new conversations; it's held in memory and not saved to our database.

Technical information

Our servers record standard logs, such as IP addresses, request details and errors, to keep the service running and secure. We don't use analytics or advertising tools.

How we use information

We use the information above to:

• provide Mansa: run your agents and their commands, deliver texts, connect the integrations you choose, and show you your history;
• keep Mansa secure: enforce limits, prevent abuse, and investigate incidents;
• fix problems and keep the service reliable;
• respond to your requests and send you notices about the service; and
• meet our legal obligations.

We don't sell personal information, use it for advertising, or use your content to train AI models. People at Chameleon Technology don't look at your content unless you ask us to (for example, for support), it's needed to investigate security or abuse, or the law requires it.

Google user data

This section explains how Mansa handles information it receives from Google APIs.

What we access

• Gmail: the gmail.readonly scope, which lets an agent search and read your email and labels. It can't send, change or delete anything.
• Google Drive: the drive.readonly scope, which lets an agent search, list and read your files, including the contents of Google Sheets. It can't create, change or delete anything.
• The email address of the connected account, so you can see which account an agent uses.

How we use it

Google data is used only so the agent you connected can search and read your mail or files when a task needs it. That task can come from your own conversations, automations you set up, or texts from phones linked to that agent. Gmail and Drive are never available in website widget conversations. What the agent reads becomes part of that conversation: it's shown to you and sent to the AI model provider handling the conversation so the agent can respond.

How we store it

We store the Google refresh token encrypted with AWS Key Management Service and keep short-lived access tokens in memory only. We don't keep a separate copy of your mailbox or Drive. Content an agent has already read stays in that conversation's history until the conversation or your account is deleted.

Who we share it with

Google data goes only to the AI model provider processing the conversation and to the infrastructure providers that host Mansa (Section 7). We also share it where the law requires or you direct us to. We don't sell it or use it for advertising.

Limited Use

Mansa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We don't use Google user data to develop, improve or train generalized AI or machine learning models. Model providers get it only so they can generate your agent's responses. If you connect your own OpenRouter key, your OpenRouter account's data settings and the policies of the providers it routes to also apply. You can limit routing to providers that don't train on prompts in your OpenRouter settings.

No one at Chameleon Technology reads your Google data unless you ask us to and agree to it (for example, for support), it's needed for security such as investigating abuse, the law requires it, or it has been aggregated and anonymized for internal operations.

Disconnecting

You can disconnect Gmail or Drive from an agent's Integrations tab at any time. We then delete the stored token. If no other agent in Mansa still uses that Google account, we also revoke access with Google. Deleting an agent disconnects its integrations. You can also remove Mansa's access from your Google Account permissions page. To delete Google content that's already in conversation history, contact us (Section 10).

Text messages

How phones opt in. A phone is linked to a Mansa number only after someone sends that number, from that phone, a one-time code shown in the Mansa app. We never send the first text.

What we send. Once a phone is linked, the agent texts it with replies to its messages, the results of tasks and scheduled automations set up for that phone, and service notices, such as confirming a link or a new conversation. How often depends on how the phone and its automations are used.

Stopping texts. Reply STOP, or unlink the phone in Mansa. The number's owner can also disable or delete the number.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of sharing described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Phone numbers and message content are shared only as needed to run the service: with the messaging provider that carries the text, the AI model provider handling the conversation, and our hosting provider.

Who we share information with

We use these service providers to run Mansa. They may process personal information only on our instructions.

We may also share information:

• At your direction. Agents can reach the internet. When you or your automations tell an agent to use a website, API or service, it sends that service whatever the task requires.
• With a customer, for widget conversations. A website owner sees the conversations their widget has.
• For legal reasons. To comply with law or valid legal process, or to protect the rights, safety and security of our users, the public, or Chameleon Technology.
• In a business transfer. As part of a merger, acquisition or sale of assets. We'll tell you before your information becomes subject to a different privacy policy.

How long we keep information

• Your workspace. We keep your content while your account exists. You can delete agents, numbers, integrations, secrets, automations and API keys in the app. Deleting an agent removes its secrets, integrations and machine. Conversations and the files agents published stay until your account is deleted.
• Deleting your account. Email us and we'll delete your account and everything in it within 30 days: conversations, files, machines and snapshots, secrets, integrations and numbers. The only exception is information the law requires us to keep.
• Paused machines. A machine that has been paused for 7 days is shut down. Its saved versions remain until the agent's data is deleted.
• Run history. Records of finished agent runs in our workflow system are deleted after 7 days. The conversation itself stays in your workspace.
• Texting records. Message identifiers and verification records are kept while your account exists, to prevent duplicate messages and abuse.
• Logs. Server logs are kept for a limited time for security and troubleshooting.

Security

Traffic to Mansa is encrypted in transit. Secrets, model provider keys and Google tokens are encrypted at rest with envelope encryption (AES-256-GCM with keys from AWS Key Management Service), and API keys are stored as hashes. Each agent works in its own isolated cloud machine.

Secrets are filled into commands when they run. If a command prints a secret, that output becomes part of the conversation and is sent to the model provider, so avoid commands that display secret values. No system is perfectly secure. If a breach affects your information, we'll notify you as the law requires.

Your rights and choices

You can ask to access, correct, export or delete your personal information, or object to or restrict how we use it. Email support@kupoluyi.com. We'll confirm your identity and respond within 30 days, or sooner if the law requires. You won't be treated differently for using these rights.

US state privacy rights

Residents of California and other states with privacy laws have the right to know what personal information we collect, use and disclose, and to access, correct and delete it. In the last 12 months we collected: identifiers (name, email, IP address, phone number), account login details, the content of messages, files and connected email, and technical logs. We collected these from you, your agents and your connected services, only to provide and secure Mansa. We don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you. You can use an authorized agent. If we deny a request, you can appeal by replying to our decision.

UK and European Economic Area

We process your information to perform our contract with you (running the service); for our legitimate interests in keeping Mansa secure and reliable; with your consent, when you connect Google or link a phone (you can withdraw it by disconnecting or unlinking); and to meet legal obligations. You have the right to lodge a complaint with your data protection authority, such as the UK Information Commissioner's Office.

International transfers

Chameleon Technology is based in the United States, and our service providers operate in several countries, including the United States and Germany. When we transfer personal information out of the UK or the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

Children

Mansa is for people 18 and older. We don't knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

Cookies and browser storage

• This website sets no cookies and loads nothing from third parties.
• The Mansa app. Our sign-in service sets the cookies it needs to keep you signed in. The app keeps your sign-in tokens in session storage and your preferences, such as theme, in local storage. It loads fonts from Google Fonts, which receives your IP address.
• The widget keeps conversation tokens in the visitor's local storage so a returning visitor can pick up their conversation. It sets no cookies. It loads fonts from Google Fonts.

None of these are used for analytics or advertising.

Changes to this policy

We'll post any update here with a new effective date. For material changes, we'll give notice before they take effect, by email or in the app.

Contact us

Questions or requests: support@kupoluyi.com
Chameleon Technology, Inc., 2810 N Church St STE 90792, Wilmington, DE 19802, United States