Privacy Policy

The data controller for your account and workspace data is MantraPath Technologies Private Limited, operating under the MantraWorx brand. Our contact details are:

We collect data in the following categories:

2.1 Account and Registration Data

When you create an account or accept an invitation, we collect your name, email address, job title, and organisation details. For billing purposes we may collect billing contact information and payment method details (processed via our payment provider — we do not store full card numbers).

2.2 Workspace and Customer Data

All data you and your team enter into MantraWorx — including projects, tasks, sprints, documents, chat messages, HR records (attendance, leave, payroll, performance), finance records, and any files uploaded — is Customer Data. You own this data. We process it only to provide the Service to you.

2.3 AI Interaction Data (WorxAI)

When you or your team use WorxAI queries, we process your Customer Data contextually to generate responses. Queries, retrieved context, and AI-generated outputs may be temporarily stored to deliver the response and improve response quality within your workspace. We do not use your Customer Data to train shared AI models used by other customers.

2.4 Usage and Telemetry Data

We automatically collect information about how you interact with the Service, including pages visited, features used, actions taken, session duration, AI token consumption, and error logs. This helps us monitor platform health, improve features, and detect abuse.

2.5 Device and Log Data

We collect device information (browser type, OS, device identifiers), IP addresses, and access timestamps for security monitoring, troubleshooting, and audit purposes. This data is retained in accordance with our retention policy in Section 7.

2.6 Communications

If you contact our support team or respond to our emails, we retain that correspondence to resolve your query and improve our service.

We use data we collect to:

• Provide and operate the Service — authentication, project and task delivery, HR modules, chat and meetings, document management, finance, and reporting.
• Power WorxAI — generating AI daily briefs, blocker detection, cost analysis, team performance insights, and natural language queries over your workspace data.
• Billing and payments — processing subscription fees, issuing invoices, and managing upgrades or cancellations.
• Security and fraud prevention — detecting unauthorised access, preventing abuse, enforcing rate limits, and maintaining audit trails.
• Customer support — diagnosing issues, responding to requests, and providing onboarding assistance.
• Product improvement — analysing anonymised and aggregated usage patterns to improve features, performance, and reliability. We do not identify individual users in this analysis.
• Legal compliance — complying with applicable laws, regulatory requirements, and lawful requests from authorities.
• Service communications — sending operational notifications, security alerts, billing notices, and (where you have opted in) product updates.

We do not sell, rent, or trade your personal data or Customer Data to third parties for their own marketing purposes.

MantraWorx includes modules for managing employee attendance, leave, payroll, salary slips, loans, reimbursements, and performance reviews. When you use these modules, you (the organisation) are the Data Controller and MantraWorx acts as your Data Processor.

• You are responsible for obtaining any required consents from employees for processing their personal data.
• You are responsible for complying with applicable employment and data protection laws (including the Digital Personal Data Protection Act, 2023 in India, and equivalent laws in other jurisdictions).
• Employee personal data is processed strictly on your instructions and is not used by MantraWorx for any purpose beyond providing the HR modules.
• A Data Processing Agreement (DPA) is available to enterprise customers upon request.

5.1 WorxAI (Cloud-hosted plans)

On cloud-hosted plans, WorxAI queries are processed using your Customer Data on our infrastructure. Queries are scoped by your RBAC configuration — employees only receive AI insights based on data they are authorised to see. Query logs are retained for up to 30 days for debugging and quality improvement, then deleted.

5.2 On-Premise Deployments

Enterprise customers on On-Prem or Private Cloud deployments run AI inference on their own infrastructure. Customer Data never leaves your environment for AI processing. Only anonymised health telemetry (if not disabled) is transmitted to MantraWorx for licence validation and support purposes.

5.3 No AI Model Training on Your Data

We do not use your Customer Data — including chat messages, documents, project records, HR data, or AI query history — to train, fine-tune, or improve AI models that are shared with or accessible by other customers.

We share data only as follows:

• Infrastructure and hosting providers — to store and run the Service (e.g., cloud hosting providers under data processing agreements).
• Payment processors — for billing and payment processing. These providers handle payment card data under their own PCI-DSS-compliant environments.
• Email delivery services — to send transactional emails (notifications, alerts, billing).
• Security and monitoring tools — for error tracking, uptime monitoring, and security scanning (processing anonymised or aggregated data only).
• Legal requirements — if required by law, court order, or governmental authority, we may disclose data. We will notify you where legally permitted.
• Business transfers — in connection with a merger, acquisition, or asset sale, Customer Data may be transferred. We will provide notice before any transfer.

All third-party sub-processors are bound by data processing agreements and are prohibited from using your data for their own purposes.

• Active accounts: Customer Data is retained for the duration of your Subscription.
• Post-cancellation: Customer Data is retained for 90 days to allow data export, then permanently deleted or anonymised.
• Audit and security logs: Retained for up to 12 months, then deleted.
• AI query logs: Retained for up to 30 days, then deleted.
• Billing records: Retained for 7 years as required by applicable tax and financial regulations.
• Support communications: Retained for 2 years after resolution.

We implement commercially reasonable technical and organisational security measures, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest.
• Role-based access control (RBAC) enforced at the platform and data query level.
• Complete audit logs of all access and administrative actions.
• Regular security reviews and vulnerability assessments.
• Employee security training and access controls.
• Isolated customer data environments to prevent cross-tenant access.

No system is completely secure. If you discover a security vulnerability, please report it responsibly to legal@mantrapath.com.

Depending on your jurisdiction, you (and your employees, where applicable) may have the following rights over personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of personal data (subject to legal retention obligations).
• Data portability — request an export of your data in a machine-readable format.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at legal@mantrapath.com. We will respond within 30 days (or as required by applicable law). Note that many rights can be exercised directly through the platform's settings and admin tools.

For requests relating to your employees' personal data (where you are the Data Controller), employees should contact their employer (you) directly. You should then use the platform tools or contact us as your Data Processor.

MantraWorx uses essential cookies and local storage to maintain your authenticated session and preserve your in-app preferences (such as theme, language, and layout settings). We do not use third-party advertising cookies or tracking pixels on the main application.

• Session cookies — required for authentication. Deleted when you log out or your session expires.
• Preference cookies — store your UI preferences (dark/light mode, etc.).
• Analytics — we may use privacy-respecting analytics on public-facing marketing pages. These do not track you inside the application.

MantraWorx is operated from India. If you access the Service from outside India, your data may be transferred to and processed in India. For Enterprise customers in specific jurisdictions (e.g., EU, UK), we offer Data Processing Agreements with appropriate transfer safeguards (Standard Contractual Clauses or equivalent) upon request.

On-Prem customers retain full control over data location — no Customer Data leaves your designated infrastructure.

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor's data has been submitted, contact us immediately and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by a prominent notice in the Service at least 14 days before the change takes effect. The “Last updated” date at the top of this page indicates when the policy was last revised. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, requests, or complaints, contact our Privacy team:

If you are located in a jurisdiction with a data protection authority (e.g., the EU), you have the right to lodge a complaint with your local supervisory authority if you believe we have not handled your data in accordance with applicable law.