Legal

Privacy policy

Information on how personal data is processed on manta.vet.

Updated 30 September 2026

1 Introduction

This privacy policy explains how we process personal data when you use our website https://manta.vet/, our Manta Scribe application (app for iOS and Android and web app) and our social media profiles. Personal data means any information relating to an identified or identifiable natural person, for example a name or an IP address.

1.1 Contact details

The controller under Art. 4(7) of the EU General Data Protection Regulation (GDPR) is Manta Technologies GmbH, Erich-Weinert-Straße 10, Berlin, Germany, email: info@manta.vet. We are legally represented by Robert Friedemann and Fynn Merlevede. Our data protection officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, email: datenschutz@heydata.eu.

1.2 Scope of processing, purposes and legal bases

We describe the scope of processing, the purposes and the legal bases in more detail below. In principle, the following legal bases may apply:

Art. 6(1) sentence 1 lit. a GDPR is our legal basis for processing that requires consent.
Art. 6(1) sentence 1 lit. b GDPR applies where processing is necessary to perform a contract, for example if a visitor purchases a product or we provide a service. This also covers processing required for pre-contractual steps, such as enquiries about our products or services.
Art. 6(1) sentence 1 lit. c GDPR applies where we process personal data to comply with a legal obligation, for example under tax law.
Art. 6(1) sentence 1 lit. f GDPR applies where we can rely on legitimate interests, for example cookies required for the technical operation of our website.

1.3 Processing outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, adequacy decisions of the European Commission under Art. 45(3) GDPR safeguard the transfer where they exist, for example for the United Kingdom, Canada and Israel. Transfers to service providers in the United States are based on an adequacy decision if the provider is also certified under the EU-US Data Privacy Framework. In other cases (for example where no adequacy decision exists), the legal basis for the transfer is usually, unless we state otherwise, the Standard Contractual Clauses. These are a set of clauses adopted by the European Commission and form part of the contract with the third party. Under Art. 46(2) lit. b GDPR they safeguard the transfer. Many providers give additional contractual guarantees beyond the clauses, for example encryption or a duty to notify data subjects if law-enforcement authorities request access.

1.4 Storage period

Unless this privacy policy states otherwise, we delete stored data as soon as it is no longer needed for its purpose and no statutory retention duties apply. If data is not deleted because it is still needed for other lawful purposes, processing is restricted, i.e. the data is blocked and not processed for other purposes. This applies, for example, to data we must keep for commercial or tax reasons.

1.5 Rights of data subjects

Data subjects have the following rights regarding their personal data:

right of access,
right to rectification or erasure,
right to restriction of processing,
right to object to processing,
right to data portability,
right to withdraw consent at any time.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority. Contact details are available at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6 Obligation to provide data

Customers, prospects or third parties only have to provide the personal data that is required to establish, perform and end the business or other relationship, or that we are legally obliged to collect. Without this data we will generally have to refuse a contract or a service, or we will no longer be able to perform an existing contract or relationship. Mandatory fields are marked as such.

1.7 No automated decision-making in individual cases

To establish and perform a business or other relationship we do not, as a rule, use fully automated decision-making under Article 22 GDPR. If we use such procedures in individual cases, we will inform you separately where the law requires it.

1.8 Contacting us

If you contact us, for example by email or phone, we store the data you provide (for example names and email addresses) in order to answer your questions. The legal basis is our legitimate interest (Art. 6(1) sentence 1 lit. f GDPR) in answering enquiries. We delete this data when it is no longer needed, or we restrict processing if statutory retention duties apply.

1.9 Customer surveys

From time to time we run customer surveys to understand our customers and their needs. We collect the data requested in each survey. It is our legitimate interest to understand our customers, so the legal basis is Art. 6(1) sentence 1 lit. f GDPR. We delete the data once the survey results have been evaluated.

We reserve the right to inform customers who have already used our services or bought goods about our offers by email or otherwise, unless they have objected. The legal basis is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest is direct marketing (recital 47 GDPR). Customers may object to the use of their email address for marketing at any time and at no extra cost, for example via the link at the end of each email or by emailing the address given above.

Prospects may subscribe to a free newsletter. We process the data provided at sign-up only to send the newsletter. Sign-up happens by selecting the relevant field on our website, ticking the relevant box on a paper form, or another clear action by which prospects consent to the processing, so the legal basis is Art. 6(1) sentence 1 lit. a GDPR. Consent may be withdrawn at any time, for example by clicking the link in the newsletter or by notifying the email address given above. Processing until withdrawal remains lawful. Based on recipients’ consent (Art. 6(1) sentence 1 lit. a GDPR) we also measure open and click rates to understand which content is relevant.

We send newsletters with Zoho from Zoho Corporation GmbH, Trinkausstr. 7, 40213 Düsseldorf, Germany. The provider processes content, usage, meta/communication and contact data in the EU. Further information is available in the provider’s privacy policy at https://www.zoho.com/privacy.html.

We send newsletters with Lemlist from Lempire, 128 rue La Boétie - 75008 Paris, France. The provider processes content, usage, meta/communication and contact data in the EU. Further information is available in the provider’s privacy policy at https://www.lemlist.com/privacy-policy.

3 Data processing on our website

3.1 Notice for website visitors in Germany

Our website stores information on visitors’ devices (for example cookies) or accesses information already stored there (for example IP addresses). The following sections describe which information this is. Storage and access are based on:

Where storage or access is strictly necessary to provide a service expressly requested by the visitor (for example a chatbot used by the visitor, or IT security of our website), it is based on § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
Otherwise, storage or access is based on the visitor’s consent (§ 25(1) TDDDG).

Subsequent processing follows the sections below and the GDPR.

3.2 Informational use of the website

If you use the website for information only, i.e. without sending us other information, we collect the personal data that your browser sends to our server in order to keep the website stable and secure. That is our legitimate interest, so the legal basis is Art. 6(1) sentence 1 lit. f GDPR.

This data is:

IP address
date and time of the request
time-zone difference to Greenwich Mean Time (GMT)
content of the request (specific page)
access status / HTTP status code
amount of data transferred
website from which the request comes
browser
operating system and its interface
language and version of the browser software.

This data is also stored in log files. It is deleted when no longer needed, at the latest after 14 days.

3.3 Web hosting and provision of the website

Our website is hosted by Vercel. The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. The website is operated in the Frankfurt am Main (EU) region, where personal data transmitted via the website — for example content, usage, meta/communication or contact data — is processed. As the provider is a US company, access from and transfers to the United States, for example for support, maintenance and backup purposes, cannot be excluded. Further information is available in the provider’s privacy policy at https://vercel.com/legal/privacy-policy. It is our legitimate interest to provide a website, so the legal basis is Art. 6(1) sentence 1 lit. f GDPR. Transfers outside the EEA are based on Standard Contractual Clauses. The security of data transferred to a third country is ensured by standard data-protection clauses issued under the procedure in Art. 93(2) GDPR (Art. 46(2) lit. c GDPR), which we have agreed with the provider.

3.4 Contact form

If you contact us via the contact form on our website, we store the data requested there and the content of the message. The legal basis is our legitimate interest in answering enquiries, i.e. Art. 6(1) sentence 1 lit. f GDPR. We delete this data when it is no longer needed, or we restrict processing if statutory retention duties apply.

3.5 Booking appointments

Website visitors can book appointments with us. In addition to the data entered, we process meta or communication data. We have a legitimate interest in offering prospects an easy way to arrange appointments. The legal basis is therefore Art. 6(1) sentence 1 lit. f GDPR. If we use a third-party tool for booking, the details are listed under “Third-party providers”.

3.6 Technically necessary cookies

Our website uses cookies. Cookies are small text files stored in the visitor’s browser. They help make the site more user-friendly, effective and secure. Where these cookies are required to operate the website or its functions (“technically necessary cookies”), the legal basis is Art. 6(1) sentence 1 lit. f GDPR. We have a legitimate interest in providing customers and other visitors with a functioning website. We use technically necessary cookies specifically for the following purposes:

remembering language settings

3.7 Third-party providers

3.7.1 Google Analytics

We use Google Analytics for analytics. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The provider processes usage data (for example pages visited, interest in content, access times) and meta/communication data (for example device information, IP addresses) in the United States. The legal basis is Art. 6(1) sentence 1 lit. a GDPR. Processing is based on consent. Data subjects may withdraw consent at any time by contacting us using the details in this privacy policy. Withdrawal does not affect the lawfulness of processing before withdrawal. Transfers outside the EEA are based on an adequacy decision. The security of data transferred to a third country is ensured because the European Commission has decided under Art. 45(3) GDPR that the third country provides an adequate level of protection. Data is deleted when the purpose of collection no longer applies and no retention duty remains. Further information is available at https://business.safety.google/privacy/.

3.7.2 Google Tag Manager

We use Google Tag Manager for advertising and analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (for example pages visited, interest in content, access times) in the United States. The legal basis is Art. 6(1) sentence 1 lit. a GDPR. Processing is based on consent. Data subjects may withdraw consent at any time by contacting us using the details in this privacy policy. Withdrawal does not affect the lawfulness of processing before withdrawal. Transfers outside the EEA are based on an adequacy decision. The security of data transferred to a third country is ensured because the European Commission has decided under Art. 45(3) GDPR that the third country provides an adequate level of protection. We delete the data when the purpose of collection no longer applies. Further information is available at https://business.safety.google/privacy/.

3.7.3 YouTube videos

We use YouTube videos on the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes meta/communication data (for example device information, IP addresses) and usage data (for example pages visited, interest in content, access times) in the United States. The legal basis is Art. 6(1) sentence 1 lit. a GDPR. Processing is based on consent. Data subjects may withdraw consent at any time by contacting us using the details in this privacy policy. Withdrawal does not affect the lawfulness of processing before withdrawal. Transfers outside the EEA are based on consent. Further information is available at https://policies.google.com/privacy.

3.7.4 Google Ads

We use Google Ads for advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (for example pages visited, interest in content, access times) and meta/communication data (for example device information, IP addresses) in the United States. The legal basis is Art. 6(1) sentence 1 lit. a GDPR. Processing is based on consent. Data subjects may withdraw consent at any time by contacting us using the details in this privacy policy. Withdrawal does not affect the lawfulness of processing before withdrawal. Transfers outside the EEA are based on an adequacy decision. The security of data transferred to a third country is ensured because the European Commission has decided under Art. 45(3) GDPR that the third country provides an adequate level of protection. We delete the data when the purpose of collection no longer applies. Further information is available at https://business.safety.google/privacy/.

3.7.5 heyData

We have embedded a privacy seal on our website. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (for example IP addresses) in the EU. The legal basis is Art. 6(1) sentence 1 lit. f GDPR. We have a legitimate interest in showing website visitors confirmation of our privacy compliance. At the same time the provider has a legitimate interest in ensuring that only customers with active contracts use its seal, which is why a mere image copy of the certificate is not a viable alternative. Data is masked after collection so that it is no longer personally identifiable. Further information is available in the provider’s privacy policy at https://heydata.eu/datenschutzerklaerung.

3.7.6 OpenAI Ads (ChatGPT Ads)

We use OpenAI Ads (ChatGPT Ads) for advertising and conversion measurement. The provider is OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, United States. The provider processes usage data (for example pages visited, conversion events, access times), meta/communication data (for example device information, IP addresses) and a privacy-preserving click identifier (oppref) in the United States. The legal basis is Art. 6(1) sentence 1 lit. a GDPR. Processing is based on consent. Data subjects may withdraw consent at any time by contacting us using the details in this privacy policy or by changing their cookie settings. Withdrawal does not affect the lawfulness of processing before withdrawal. Transfers outside the EEA are based on Standard Contractual Clauses. The security of data transferred to a third country is ensured by standard data-protection clauses issued under the procedure in Art. 93(2) GDPR (Art. 46(2) lit. c GDPR). We delete the data when the purpose of collection no longer applies. Further information is available in the provider’s privacy policy at https://openai.com/policies/privacy-policy.

3.7.7 PostHog

We use PostHog to analyse how our website is used, to measure page performance (Web Vitals) and to record sessions (session replay). The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, United States. Collection is sent via our subdomain n.manta.vet (PostHog’s managed reverse proxy; sub-processor Cloudflare, Inc.). Subsequent processing takes place on PostHog Cloud EU (eu.i.posthog.com) in the European Union. The provider processes usage data (for example pages visited, clicks, conversion events, time on page, technical performance metrics), meta/communication data (for example device information, IP addresses, browser and operating system) and session-replay recordings (mouse movements, scrolling, clicks; form-field input is masked). The legal basis is Art. 6(1) sentence 1 lit. a GDPR. Processing is based on consent (statistics cookies). Data subjects may withdraw consent at any time by contacting us using the details in this privacy policy or by changing their cookie settings. Withdrawal does not affect the lawfulness of processing before withdrawal. As the provider is a US company, access from and transfers to the United States, for example for support, maintenance and backup purposes, cannot be excluded. Transfers outside the EEA are based on Standard Contractual Clauses. The security of data transferred to a third country is ensured by standard data-protection clauses issued under the procedure in Art. 93(2) GDPR (Art. 46(2) lit. c GDPR). We delete the data when the purpose of collection no longer applies. Further information is available in the provider’s privacy policy at https://posthog.com/privacy.

4 Manta Scribe (app and web app)

Manta Scribe is an application for veterinary practices and clinics (the "practice") that records and transcribes conversations and uses artificial intelligence to turn them into clinical notes. Manta Scribe is offered only to practices that have a contract with us.

4.1 Responsibility

For the content processed with Manta Scribe (in particular recordings, transcripts, notes, photos, documents and the names of pet owners and animals), the practice is the controller within the meaning of Art. 4(7) GDPR. We process this data only on its behalf and on its instructions, under a data processing agreement pursuant to Art. 28 GDPR. Pet owners should contact the practice to exercise their rights; we forward any such requests we receive to the practice.

We are the controller for the data of users (practice staff) that we process to provide their user account and to operate and secure the application.

4.2 Data processed and purposes

To sign users in and manage their accounts, we process name, email address, user identifier, practice membership, permissions, sign-in times and device information. The legal basis is Art. 6(1) sentence 1 lit. b GDPR (our contract with the practice) and our legitimate interest in secure sign-in (Art. 6(1) sentence 1 lit. f GDPR).

On behalf of the practice, we process recordings, the transcripts and notes created from them, and information added by users, in order to provide the application's features. Before a recording, the app reminds the user to inform the pet owner and obtain their consent.

To detect and fix errors, for quality assurance and for support, we process technical data (for example error messages, device and version information) as well as user and practice identifiers. The legal basis is our legitimate interest in a stable and secure application (Art. 6(1) sentence 1 lit. f GDPR).

4.3 Recipients and transfers to third countries

We use carefully selected service providers as processors, each under an agreement pursuant to Art. 28 GDPR. These are providers of hosting and data storage, authentication, speech recognition, AI-based text processing, error analysis and internal communication. Practices receive a list of the sub-processors we use as part of the data processing agreement.

Data is primarily processed in the EU. Where service providers are based or process data outside the EEA, transfers are based on an adequacy decision of the European Commission (in particular the EU-US Data Privacy Framework, Art. 45 GDPR) or on Standard Contractual Clauses (Art. 46(2) lit. c GDPR). We provide a copy of these safeguards on request. The data is not used for advertising or sold.

4.4 Retention

Session data is stored for as long as the practice needs it. Users can delete sessions in the application; they are then immediately no longer accessible and are permanently deleted no later than 30 days after deletion. When the contract ends, we delete all of the practice's data no later than 30 days after the end of the contract, unless statutory retention duties apply or the data processing agreement provides otherwise. We delete user account data when the account is deleted, and technical error data after 90 days at the latest.

4.5 Permissions and data on the device

The app only asks for permissions its features need (for example the microphone for recordings, and the camera and photos for adding images). Permissions can be revoked at any time in the device settings. Data the app stores on the device to operate is deleted when the user signs out. Manta Scribe does not use advertising or tracking services.

We are present on social networks to present our organisation and our services. The operators of these networks regularly process their users’ data for advertising. Among other things they create user profiles from online behaviour, which are used to show advertising on the networks and elsewhere on the internet that matches users’ interests. To do this, the operators store information about usage behaviour in cookies on users’ computers. It cannot be ruled out that the operators combine this information with other data. Further information, including how users can object to processing by the operators, is available in the privacy policies linked below. Operators or their servers may also be located outside the EU, which can create risks for users, for example because it is harder to enforce rights or because public authorities may access the data. If users of the networks contact us via our profiles, we process the data they provide in order to answer the enquiry. That is our legitimate interest, so the legal basis is Art. 6(1) sentence 1 lit. f GDPR.

5.1 Facebook

We maintain a profile on Facebook. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: https://www.facebook.com/policy.php. You can object to processing via the ad settings: https://www.facebook.com/settings?tab=ads. On the basis of an agreement we are joint controllers with Facebook under Art. 26 GDPR for processing data of visitors to our profile. Facebook explains which data is processed at https://www.facebook.com/legal/terms/information_about_page_insights_data. Data subjects may exercise their rights against us or against Facebook. Under our agreement with Facebook we are obliged to forward requests to Facebook. Data subjects will therefore receive a faster response if they contact Facebook directly.

5.2 Instagram

We maintain a profile on Instagram. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: https://help.instagram.com/519522125107875.

5.3 LinkedIn

We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The privacy policy is available here: https://www.linkedin.com/legal/privacy-policy. You can object to processing via the ad settings: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

6 Changes to this privacy policy

We reserve the right to change this privacy policy for the future. A current version is always available here.

7 Questions and comments

If you have questions or comments about this privacy policy, please use the contact details given above.