Privacy and data
What we do with data, and where it lives
Two kinds of data reach us, and they are worth separating: what you type into this site, and what your integration sends to the API. The first is a handful of fields about you. The second is evidence, which is the product, and it is kept differently on purpose.
What we store when you create an account
- The organisation name, the email address and the optional country you typed.
- A SHA-256 hash of every API key. Never the key itself — we cannot recover one.
- A session row when you sign in to the dashboard, holding a hash of the session token and the time it was last used. It expires after twelve hours.
The address is not verified: we send you nothing, so there is no confirmation link to click. We use it to reach you and to find your account if you write to us. It is not a login. The one message this service does send is to ourselves — a notice that a registration happened, containing the fields above — and it goes through Scaleway Transactional Email, which is the same processor that runs everything else here.
What we store when your integration calls the API
Per decision: the request line and headers you passed us, the agent key and operator
we verified, the policy version that applied, the outcome, the reasons, and the
timing. That record is canonicalised, hashed, and appended to an append-only Merkle
log; the receipt gets a public URL under /r/ so a counterparty can check
it without an account.
Consider what you send. Anything you put in the request context ends up in a receipt, and a receipt is designed to be impossible to alter after the fact — that is the whole point of it. Personal data does not belong in a field whose defining property is that it cannot be quietly rewritten. Send an identifier that means something to you, not a customer's name.
The log itself holds only hashes. A leaf reveals nothing about a receipt, across tenants or otherwise, which is why one tree can serve everyone.
Where it lives, and who else touches it
| Party | What for | Where |
|---|---|---|
| Scaleway | Compute, managed PostgreSQL, object storage, key management, DNS | France (fr-par) |
| mijndomein | Domain registration and the mailbox on the contact address | Netherlands |
| Soverin | The mail service behind that mailbox — the party that actually handles a message you send us | Netherlands |
There is no third-country processor in the production path, and no analytics, no tag manager, no third-party fonts and no cookie banner — because there is nothing to consent to. The only cookie this site sets is the dashboard session, and it is set when you sign in and not before.
How long it is kept
Receipts and decisions are kept for as long as they are useful as evidence, which is a period we will agree with you rather than guess at; the AI Act's six-month floor for logs is a floor and not a plan. Sessions expire after twelve hours. Account details stay until the account is deleted. Ask us to delete an account and the tenant, its keys, its decisions and its receipts go with it — the log keeps the leaf hashes, which is the one thing that cannot be removed without breaking the proofs everyone else holds.
Your rights, and what to expect
Access, rectification, erasure, portability, objection, the usual and the ones the GDPR gives you. Write to info@mandaton.eu and expect to be asked something that establishes you are who you say — we hold no verified identity for anyone, so that check is a conversation rather than a click.
What this page is not
It has not been through a lawyer, and there is no data processing agreement or sub-processor commitment behind it yet. Both are being prepared and neither exists today. If you need one before you can send us anything real, say so — that is a reasonable requirement and we would rather hear it than be assumed to have one.
Last updated 2026-08-09.