Legal

Last updated: 2026-11-05

Status: Draft, not reviewed by a lawyer.

1. The short version

• Your camera feed never leaves your phone. The AR runs in your browser, and we never receive the camera picture.
• We store the photos, videos and files you upload so your designs can play. Keepsake media is kept private. Business card, flyer and wedding invitation media is kept at public addresses that are long and random. Section 6 explains.
• Anyone with a scan link can see the design behind it. There is no login on a scan.
• When a print shop uses AI animation, the photo goes to our AI video provider.
• We count scans for the owner of each design, without names.
• We do not sell personal data. The only advertising tracker we use is Meta's ad measurement, on our public marketing pages, and only after you click "Allow". Section 3.13 explains.
• MANZAR is run by one person, operating from Mauritius, not by a company.

2. Who is responsible for your data

MANZAR is run by one person, operating from Mauritius. There is no company yet. For the data described here, that person is the controller, except where section 5 says a print shop is.

Contact for anything about privacy: [email protected]. That is the one address we use for privacy requests, support and legal notices. We do not keep a separate postal address.

We have not appointed a data protection officer, or a representative in the European Union, the United Kingdom or Saudi Arabia.

3. What we collect

3.1 Accounts

• Your email address and password, or the sign-in Google shares with us, if you use Sign in with Google. We never see your password in plain text.
• The country you choose at sign-up, and a record that you accepted the terms.
• Session records created when you sign in.

3.2 Print shop details

• Your shop's name, logo, phone, WhatsApp number, city, address and map position, if you give them.
• Your credit balance and a ledger of what you topped up and what each publish, add-on and AI clip cost.
• Your designs, their titles and client labels, and the request links you send.

Approved shops with a location appear on the public find-a-shop map, with the details listed above.

3.3 What you upload

Photos, videos, logos, text and links. The tracking file we make from your photo. Print files, previews, and AI clips made from your photos. The settings you choose for each design.

These can contain other people's faces and personal details. You must have their written consent. See Acceptable Use.

3.4 A print shop's clients

When a print shop sends a request link, the client can fill in their details, such as a name, a business name and a way to contact them, upload a photo or video, and write a wish for the AI animation. We store what the client submits so the shop can publish it. The client does not need an account. Section 5 explains who is responsible for that data.

3.5 The camera

The scanner asks your browser for camera access. The camera picture is analysed on your device to find the print, and then thrown away. It is never uploaded, never stored, and never used for face recognition. If you refuse camera access, the AR will not play, but the rest of the site works.

If you record your screen while scanning, that recording stays on your own device. We never receive it unless you choose to send it to us or post it somewhere we can see it.

3.6 Scan counts

When someone opens a scan link, we record events for that design. An event can include what happened (for example a view, a scan or a link click), the approximate country, whether the device is a phone or a computer, the page the visitor came from, how long they stayed, the time, and a random visitor id kept in the browser. There is no name, email or account in it, unless the visitor is signed in to My MANZAR. We use it to show the design's owner how the design is doing, and to show a signed-in visitor their own scan history.

3.7 Lead forms

A design can include a contact form chosen by its owner. It cannot be sent without ticking a consent box. What you send goes to the owner of that design, who decides what to do with it. We store it and pass it on for them.

3.8 The waitlist

If you join the waitlist, we store what you put in the form: your email address, your name and your role if you give them, your business name and type, your team size, your country and city, your WhatsApp number if you give it, your website or social handle, how you market today and roughly what you spend on it, how you heard of us, and your other answers, including the prices you suggest. We use it to contact you about early access and to plan the product.

If you tick the box that says you intend to use MANZAR when it opens, we record that stated intention, the price you named and the time you ticked it. It is not a commitment to buy, and you owe us nothing. We use it to judge demand, and we may show it, with your business name, to people assessing MANZAR, such as investors or grant bodies.

We do not store your IP address for this, only the country your request came from. We contact you about the waitlist only. We send tips and news only if you tick that box. You can ask us to delete your answers at any time by writing to [email protected].

3.9 Payments

Dodo Payments takes every payment: plans, credit packs, keepsakes and print shop credit. It collects your card details directly, under its own privacy policy. We never see your full card number. We receive what we need to support the purchase, such as the amount, the status, the product and the email used.

3.10 Email

We send and receive email through an email service provider.

3.11 Support and errors

If you write to us, we keep your message and your contact details to answer you. Error reports can include your browser type, the time and the error, so we can fix faults.

3.12 Achievements and referrals

If you are signed in, we keep a short record of what you do with MANZAR, so we can give you badges and points. That means your scans, the videos you finish recording, when you share or save one, the links you tap, the wearables you try and the camera you use, each with your local day and hour. The videos you record with the record button stay on your phone; we only note that you finished, shared or saved one, never the video itself. We also keep the random visitor id from your browser, so that your own scans of your design are not counted as someone else's. If you share your invite link, we record which accounts joined and paid through it, so we can give you points; the person you invited can see that they came through your link. If you are not signed in, none of this is kept about you.

3.13 Meta ad measurement (only if you allow it)

On our public marketing pages, a bar asks whether you allow Meta's ad measurement. It never appears on scan pages or in the app, and nothing below happens there.

If you click "No thanks", or do nothing, Meta's code does not load and we send Meta nothing about you.

If you click "Allow":

• the Meta pixel loads on our public marketing pages and sets two cookies, `_fbp` and `_fbc`, which hold a random browser id and, if you came from a Meta ad, the id of that click. The cookie policy, section 7, has the details;
• the pixel sends Meta the pages you open there, and some of what you do on them, such as signing up, starting a checkout or leaving your details;
• when you pay, or start a free month, our server sends Meta a SHA-256 hash of your email address, a hash of your account number, the two cookie ids, the kind of event, and the amount and currency.

A hash is not anonymous. Meta can match a hashed email to a Meta account. That is how it tells us which ads led to a purchase.

You can withdraw at any time through "Cookie choices" in the site footer. After that we send Meta nothing more about you. Withdrawing does not undo what was sent before.

4. Why we use data, and on what basis

We use data for these purposes and not for unrelated ones. We do not use your uploads to train AI models.

5. Print shops and their clients

When a print shop makes a design for a client, the shop decides what is made, for whom, and what gets published. For the client's details and content, the shop is the controller and we process them on the shop's behalf.

The shop must tell its clients how their data is used, point them to this policy, and hold written consent from every person whose face appears in what it publishes. A client with a question or a request about their data should go to the shop first. They can also write to us, and we will help the shop answer.

6. Where uploads are kept, and who can see them

Keepsake photos, videos and AI clips are kept in a private storage bucket. No one can open them directly. When someone opens the scan link, our servers create a short-lived signed link so the scan can play.

Business card, flyer and wedding invitation media are kept in a public storage bucket, at long random addresses that cannot be guessed. Anyone who has one of those addresses can open the file, with no login and no expiry.

Either way, a scan link itself is public. Anyone who has it can open the design and share it on. People who scan can also record what they see. So do not upload anything you would not want a stranger to see.

7. Who we share data with

These providers run parts of MANZAR for us:

Meta also uses what it receives for its own purposes, under its own terms and privacy policy, and is responsible for that use. Where the law treats us and Meta as joint controllers for collecting the data on our pages and passing it to Meta, we answer for that step and Meta answers for everything after it.

We also share:

• with the owner of a design, its scan counts and its lead form submissions;
• with a print shop, what its clients submit through its request links;
• with anyone who has a scan link, the design behind it;
• with authorities or advisers, when the law requires it, or to protect rights or safety.

If MANZAR moves to a company or a new owner, the data moves with it. We will tell account holders.

8. How long we keep data

Deleted files can survive for a short time in provider backups.

9. Where your data goes

MANZAR's hosting and database providers are based in the European Union, and personal data is stored and processed there.

Dodo Payments, Google, and our AI video and email providers process data in the places their own policies describe. So your data may leave your country. We rely on each provider's own transfer terms, including standard contractual clauses where they offer them.

If you click "Allow" for Meta's ad measurement, the data in section 3.13 goes to Meta, which processes it in the United States and other countries outside Saudi Arabia, the European Union and Mauritius. We send it only on your consent, and clicking "Allow" is that consent. Meta's own transfer terms apply once it has the data.

10. Security

We use HTTPS, scoped access keys, rate limits, per-account separation of records, private storage for keepsakes, and signed links that expire.

We hold no security certification and we do not claim one. No system is perfectly secure. Keep your password and your Google account safe.

If a breach puts your data at risk, we will tell you and the authorities the law requires, as fast as we can.

11. Your rights

Depending on where you live, you can ask us to show you your data, give you a copy, correct it, delete it, or stop using it for a purpose. You can withdraw consent at any time, for the future. For Meta's ad measurement, use "Cookie choices" in the site footer. You can complain to your data protection authority: in Mauritius the Data Protection Office, in Saudi Arabia SDAIA, and in the European Union or the United Kingdom your national authority.

To use a right, email [email protected] from your account address and say what you want. We may check that the account is yours first. We will answer within the time the law gives us.

To delete your account, email us. We delete the account, the designs and the stored files, not just hide them.

If you have no account, for example as a scanner, a lead or a print shop's client, write to us with whatever lets us find your data, such as the scan link or the shop's name.

12. Children

MANZAR is not meant for children. You must be at least 18 to open a print shop account or to sign in to MANZAR at all.

We do not knowingly collect data from children. A child can appear in a photo only with the written consent of a parent or guardian. If you think a child's data is on MANZAR without that consent, tell us and we will remove it.

13. Automated decisions

We make no automated decisions with legal effect on you, and we build no advertising profiles ourselves. If you allow Meta's ad measurement, Meta may use what it receives to decide which ads to show you, under its own policy. Rate limits and the AI content filter are automated. If one of them blocks you unfairly, write to us.

14. Changes

We can update this policy. The date at the top changes when we do. If a change matters, we will tell account holders by email or in the product.

15. Contact

Privacy questions and requests: [email protected]