How we handle your data
The short version: we take the least access each role needs, nothing leaves your firm without your approval, your data is never used to train AI models, and we delete it when you ask.
Last updated 20 October 2026. Legal detail is in our privacy policy.
Stage 0 is hand-run. Today the founder, Mykola, runs each role by hand with Claude on top of your existing tools. Drafts reach you by email, you approve, and he makes the approved changes himself and logs them. He sees the drafts and send records of what you approve, as part of running the service for you. From stage 1, the app takes over one role at a time, as each role passes its tests.
What each role touches
"Reads" is what the role looks at. "Writes" is what it changes in your tools. "Sends" always waits for your approval.
| Role | Reads | Writes | Sends (after approval) |
|---|---|---|---|
| Client Follow-through | Call transcripts (Zoom, Fathom, Granola, or a Google Meet transcript file you export or upload); CRM contacts, deals, notes and tasks (HubSpot, GoHighLevel) | CRM notes and tasks | Follow-up emails to your clients |
| Chief of Staff | Tasks, owners, due dates and comments in your tracker (Linear; later Asana, ClickUp, monday.com) | Tracker comments | Nudges to your team; a Monday letter to you |
| Front Desk (email only) | Only the emails you forward to your Manskap address; the FAQ you give us. Not your mailbox. | None | Replies to your clients, from your Gmail |
| New-Business Prospector | Public job postings (from SignalsAPI, our own job-postings service); the niche and client size you describe; the name and business email of the decision-maker you approve a pitch to (TODO: decision-maker source, e.g. enrichment provider; if a third party, add it to the subprocessors below) | New leads in your CRM: companies, posting links, dates and the job title to approach. No named people | One pitch per company, one to one, from your Gmail (or you send it yourself). Never in bulk |
| Recruiting Coordinator | Jobs, applications and candidate details (Workable or Ashby, via an API key you create); your written hiring bar; booked events (Calendly, Cal.com) | Screening notes in your ATS | Chases and screening invites to candidates, with a booking link inside |
- Roles suggest; people decide. No role makes a decision about a person on its own, such as rejecting a candidate.
- For Google we request only the send-only Gmail permission (
gmail.send) plus your sign-in email. We never read your mailbox. Details: Google user data. - We do not request Google Calendar or Google Meet access today. Meet transcripts reach us only as files you give us. We will list the exact permission here before any role asks for more.
- Prospector leads: we are the controller of the SignalsAPI job-postings data (Deal Baker Ltd runs SignalsAPI). We remove any recruiter names and emails from postings before we give you a lead.
- We test each role on cases from our own businesses' data, not from customers. We never keep your content as a test case unless you agree in writing.
Approvals
- Every email to a client, candidate or prospect waits for approval. You see the full text and can approve, edit then approve, or reject.
- No bulk sends and no automatic sequences, ever.
- In stage 0, every change waits for your approval by email.
- In the app, internal changes that can be undone (a CRM task, for example) may apply on their own, and you can undo them. Anything that cannot be undone waits for you.
What can and cannot be undone
In stage 0, undo is by hand: ask, and Mykola reverses the change where the tool allows it.
In the app (planned, stage 1)
| Action | Undo |
|---|---|
| CRM note or task (HubSpot, GoHighLevel) | Yes |
| New CRM lead | Partly. We remove it only if nothing else was added to it since. If the contact already existed, we restore the old details |
| Tracker comment in Linear | Planned, being tested |
| Tracker comment in Asana, ClickUp, monday.com | Not checked yet |
| Booking link | No. It is single-use, and it only goes out inside an email you approve |
| Sent email | No. Once sent, it is in the recipient's inbox |
| Note added in your ATS (Workable, Ashby) | No |
| Meeting someone has booked | No. You can cancel it in your calendar tool |
- If someone edited a record after a role changed it, undo skips that record and shows you which one.
- Undo reverts the record, not automations your CRM or ATS ran because of it (for example, a workflow email).
- Notifications and mentions already sent are not undone.
Our providers
Subprocessors (act only on our instructions)
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Anthropic, PBC | Claude AI model: reads the inputs a role needs and writes drafts. Under Anthropic's commercial terms, data is not used to train its models | United States TODO: confirm processing region | TODO: UK Extension to the DPF if listed, else IDTA or UK Addendum in Anthropic's DPA |
| Cloudflare, Inc. | Hosts this website (Cloudflare Pages) and runs the manskap.com domain's DNS | United States, served from its global network | UK Extension to the DPF; UK Addendum in Cloudflare's DPA as backup |
| TODO: app hosting provider | Servers that run Manskap and our credential vault | TODO: region | TODO |
| Google LLC (Google Workspace) | Our own email: stage-0 approvals, emails you forward to Front Desk, files you send us. Stage 0: our list of people we contact (prospects only, no customer data), in Google Sheets | United States and other countries | UK Extension to the DPF; UK Addendum in Google's Cloud Data Processing Addendum as backup |
Our credential vault (Nango) is software we run ourselves on our own servers, so no data goes to Nango the company.
Separate providers (their own controllers)
| Provider | Role | Location | Transfer safeguard |
|---|---|---|---|
| Stripe | Subscriptions, invoices and card payments. Stripe is also a separate controller for fraud prevention and its legal checks | United States and other countries | TODO: confirm Stripe, Inc. on the DPF list with UK Extension |
| Anthropic Ireland, Limited (stage 0) | The founder's individual Claude plan, under Anthropic's consumer terms with model training turned off | Ireland; Anthropic processes data in the United States | UK adequacy regulations for the EEA; Anthropic's own safeguards for its onward transfers |
| Carries our messages to people we contact, under its own privacy policy | Ireland and United States | Its own (we do not transfer data to it) | |
| Your own Gmail. Approved emails go out through your Google account, under your agreement with Google | Your Google account | Your agreement with Google |
Your own tools (Gmail, HubSpot, GoHighLevel, Linear, Workable and so on) are not our subprocessors. You choose them, and we connect to them only on your instruction. We will update this list before adding a new subprocessor, and tell customers by email at least 14 days before.
Deletion
- Free read-only checks: we delete our copies within 7 days of sending you the result, including any approval emails, forwarded emails and files in our mailbox. We confirm deletion in writing.
- Claude chats (stage 0): the founder deletes them when the check ends, and Anthropic deletes them within 30 days of that (consumer terms). TODO: Anthropic API retention period, for the app from stage 1
- On request: email privacy@manskap.com and we delete your data within 7 days and confirm in writing. Invoices we must keep by law are the only exception.
- When you leave: we delete working copies, run logs and send records within 30 days, and Google tokens the same day. Your data in your own tools stays yours.
- Prospects: deleted 60 days after our last message if there is no reply. If you opt out, we delete everything else the same day and keep only a do-not-contact entry (a one-way hash of your LinkedIn link or email, and the date) so we never message you again.
We keep only what a role needs. For a check we ask for little: 5 to 10 calls, or one job's applicants.
Data processing agreement
We sign a plain-English data processing agreement (UK GDPR Article 28) with every customer before we touch personal data in their tools, including free checks. It also records that the founder sees what you approve, that in the app we measure roles from approval records, and how stage 0 uses Claude, which you can refuse. Ask for a copy at privacy@manskap.com. TODO: lawyer review of the DPA and the deletion-confirmation template before the first check
Security
Stage 0 today
- The founder works by hand on his own computer. Any API key or login you give us is kept in TODO: where stage-0 keys and working copies are kept; confirm full-disk encryption, and deleted when the check or service ends.
- Claude is used through an individual Claude plan under Anthropic's consumer terms, with model training turned off. Anthropic is a separate controller for that data and deletes chats within 30 days of the founder deleting them. The founder deletes each check's chats when the check ends, and a customer's chats when they leave.
- Only the founder can access customer data today.
In the app (from stage 1)
- Tokens and API keys live in our credential vault. Roles never hold them.
Always
- Encryption in transit (HTTPS/TLS) everywhere.
- The narrowest access each role needs; read-only where possible. You can revoke API keys and Google access at any time.
- No certifications or security audits yet. We will not claim any until we have them.
Security contact: privacy@manskap.com. If a breach affects your data, we tell you without undue delay.