Privacy policy

Effective 20 October 2026. Last updated 20 October 2026.

This policy explains what personal data Manskap collects, why, how long we keep it, and your rights. It is written for UK data protection law (UK GDPR and the Data Protection Act 2018). We do not offer Manskap to, or contact, people in the EU or EEA at this stage.

1. Who we are

Manskap is run by Deal Baker Ltd, registered in England and Wales, company number 14906367, registered office International House, 64 Nile Street, London, N1 7SR, United Kingdom. Deal Baker Ltd is the controller of the personal data described in sections 2 to 4.

Contact for all privacy questions and requests: [email protected]. We are a very small company and have not appointed a data protection officer; the founder, Mykola, handles privacy.

ICO registration number: TODO: ICO data protection fee registration number.

Today Manskap is in stage 0: the founder runs each role by hand, using Claude, on top of the customer's existing tools. Where this policy describes the app, it says so.

2. Website visitors

This site sets no cookies and uses no analytics, trackers or third-party scripts.

The site is hosted on Cloudflare Pages (Cloudflare, Inc., United States, served from its global network). Cloudflare processes standard request data (IP address, browser type, page requested, time) to deliver the site and keep it secure, as our processor. Lawful basis: our legitimate interest in running a secure website. We keep no server logs ourselves and do not access Cloudflare's.

If you email us, we use your name, email address and message to reply. Lawful basis: legitimate interests (answering you). We keep the email for as long as the conversation is active and then for up to 12 months.

3. People we contact about Manskap

We contact a small number of people, one at a time, to offer Manskap. This section is the information we must give you when we did not get your details from you (UK GDPR Article 14). There are two groups.

• Business owners whose company may use Manskap.
• Agencies and freelancers we invite to resell Manskap to their clients.

Where we got your details

• Business owners: your company's public job postings, which we find through SignalsAPI, a job-postings data service we run ourselves; then your public LinkedIn profile, which we look up by hand.
• Agencies and freelancers: your public listing in a partner directory: the HighLevel partner directory, GHL Admins, the GHL HQ partner directory, n8n Expert Partners, n8n Creators or the HubSpot Solutions Directory; then your public LinkedIn profile.

We do not use scraping tools or data brokers.

What we hold

Your name, job title, company, company website, country, your LinkedIn profile link, the job posting or directory listing that led us to you (title, link, date), and the messages we exchange. For agencies and freelancers, we may also hold the business email address shown on your directory listing. We hold only business email addresses published in a directory listing, and no phone numbers or sensitive data.

Why, and on what basis

To send you a short, one-to-one message about Manskap and to follow up at most twice. Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)).

Summary of our legitimate interests assessment:

• Purpose: offering a business service, or a resale partnership, to someone whose business it may help.
• Necessity: we hold only business-role details, send one message and at most two follow-ups, and never send in bulk.
• Balance: a business owner who is hiring, or a builder listed in a partner directory, can reasonably expect a relevant one-to-one business message. The intrusion is low: one message, at most two follow-ups, easy opt-out, and deletion after 60 days if you do not reply. The details are about your work role and were published for business use.
• Who we do not contact: sole traders or ordinary partnerships in the UK, and anyone in the EU or EEA. We contact people only in the United States and the United Kingdom.

How we contact you

• By LinkedIn: our connection request names the job post or directory where we found you. Our first message after you accept says the same, links this notice, and tells you how to opt out.
• By email (agencies and freelancers only): one email to the business address on your directory listing. It says where we found you, links this notice, gives our postal address and tells you how to opt out.

We make no decisions about you by automated means alone. A person picks every company and writes or checks every message.

Opting out

Reply "stop" (or anything like it) to our message, or email [email protected]. We stop contacting you the same day. We delete everything else the same day and keep only a do-not-contact entry: a one-way hash of your LinkedIn profile link or email address (a scrambled form we can match against but not read back) and the date, so we never contact you again. You have an absolute right to object to direct marketing.

Who sees it

Only the founder. LinkedIn handles LinkedIn messages under its own privacy policy, as a separate controller. We may use Claude (Anthropic) to help draft a message; see section 7. Our outreach list is kept in TODO: where the outreach sheet is hosted (e.g. Google Sheets).

4. Customers

When your firm hires a Manskap role, we are the controller for your account and billing data: names and work email addresses of the people who use Manskap, your company details, what you bought, invoices and payment records. Card details are collected and held by Stripe; we never see your full card number.

• To provide the service and bill for it. Lawful basis: contract.
• To keep accounting records. Lawful basis: legal obligation.
• To send service notices (approvals, caps reached, changes to terms). Lawful basis: contract and legitimate interests.

We need account and billing details to provide the service; without them we cannot. We make no decisions about you by automated means alone.

5. Data in our customers' tools

Our roles work with data in your tools: your clients' names and emails, call transcripts, CRM records, tasks, applicants and candidates. For this data your firm is the controller and we are your processor. We process it only on your instructions, under a data processing agreement (UK GDPR Article 28). If you are a client, candidate or contact of one of our customers, please send requests to that firm first; we will help them answer.

• Roles draft and suggest. People decide. A role never makes a decision about a person with legal or similarly significant effects. For example, the Recruiting Coordinator suggests a short list; the hiring firm decides who to interview or hire.
• We do not use customer data to train AI models, and we do not sell it.
• We test each role before it goes live on cases from our own businesses' data, not from customers. We never keep your content as a test case unless you agree in writing.
• In the app, we measure how each live role is doing from approval records only (approved, edited or rejected), not from your content. This is part of the service and is set out in our data processing agreement.
• Read-only checks before you buy: we delete our copies within 7 days, and we confirm deletion in writing (see deletion).

More detail, including what each role reads and writes, is on our data handling page.

6. Google user data (Gmail)

Manskap can send approved emails from your own Gmail or Google Workspace address. This section describes how we access, use, store and share Google user data.

What we ask for

• openid and email: to know which Google account you connected and which address to send from.
• https://www.googleapis.com/auth/gmail.send: to send email as you. This is a send-only permission.

We do not ask for any permission to read, search, label, draft or delete your email. We cannot see your inbox, your sent mail or your contacts. We do not request Google Calendar or Google Meet access today; Meet transcripts reach us only as files you give us. If a role needs more access later, we will update this section with the exact permission before we ask for it.

How we use it

• We send a message only after you (or someone in your firm you allowed to approve) have seen the full text and approved it.
• Emails that clients send you reach Front Desk only if you forward them to your Manskap address. That forwarding is set up by you in Gmail and does not use the Google API.

What we store

• Your Google access and refresh tokens, kept in our credential vault (self-hosted Nango) on our servers at TODO: hosting provider and region. Roles never hold them.
• Your Google account email address.
• A record of each message we sent for you (recipient, subject, text, time, Gmail message ID), so you can see what went out.

Who reads it

While we are small, the founder, Mykola, sees the text and send records of messages you approved, as part of running the service at your request. You agree to this when you sign up, and it is set out in our data processing agreement. No other person reads them. Otherwise, a person at Manskap reads Google user data only with your explicit permission, when needed for security (for example, investigating abuse), or to comply with the law.

What we never do

• We never sell Google user data or transfer it to data brokers.
• We never use it for advertising, including retargeting or personalised ads.
• We never use it to develop, improve or train AI or machine-learning models, ours or anyone else's.
• Data we receive from Google (your account email, tokens and message IDs) is not sent to Anthropic or any AI model. Claude helps write a draft before you approve it; it never receives data from the Google API.
• We share it only as needed to provide the sending feature you use, to comply with the law, or as part of a merger or sale of the business, with notice to you.

Limited Use

Manskap's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting

You can remove Manskap's access at any time at myaccount.google.com/permissions or by asking us.

• If you revoke access in your Google account, the token stops working at once, and we delete our copy the next time we try to use it.
• If you ask us to disconnect, we delete the tokens the same day.

Send records are kept with your account data and deleted when your account closes (see section 9), or earlier if you ask.

Google has not verified our app yet. Until it does, Google shows an "unverified app" warning when you connect.

7. Who we share data with

We use a few service providers (subprocessors) to run Manskap, such as Anthropic (the Claude AI model), our hosting provider and our email provider. Some providers, such as Stripe and LinkedIn, act as separate controllers for their own purposes. The full list, with what each does, where, and the transfer safeguard, is on our data handling page. That list is the single up-to-date source.

In the app, we use Claude through Anthropic's API under its commercial terms, under which Anthropic does not train its models on the data we send. In stage 0, the founder uses Claude through an individual Claude plan, under Anthropic's consumer terms, with the setting that lets Anthropic use chats for model training turned off. Under those terms Anthropic decides how it handles the data itself (it is a separate controller, not our processor) and deletes chats from its systems within 30 days of the founder deleting them. Our data processing agreement tells customers this before any check. In the app, all customer data goes through the API.

We do not sell personal data. We may disclose data if the law requires it.

8. International transfers

Some of our providers are based in the United States, so personal data may be processed there. When we transfer personal data outside the UK we use one of these safeguards:

• the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework), where the US provider is certified under it; or
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, included in the provider's data processing terms.

The safeguard used for each provider is listed on our data handling page. Email us for a copy.

9. How long we keep data

10. Security

Stage 0 today

• The founder does the work by hand on his own computer. Working copies and any API key you give us are kept in TODO: where stage-0 API keys, logins and working copies are kept, and confirm full-disk encryption on the founder's computer, and deleted when the check or service ends.
• Only the founder can access customer data today.

In the app (from stage 1)

• Access tokens and API keys are kept in a credential vault (self-hosted Nango) on our servers. Roles never hold them.

Always

• All connections to this site and to our providers use encryption in transit (HTTPS/TLS).
• We ask for the narrowest access each role needs, read-only where possible. API keys you create can be revoked by you at any time.
• If a breach affects your data, we will tell you without undue delay, and the ICO where the law requires.

We hold no security certifications (such as SOC 2 or ISO 27001) yet. Report security issues to [email protected].

11. Your rights

You have the right to:

• get a copy of your personal data;
• have it corrected;
• have it deleted;
• restrict how we use it;
• object to how we use it, including an absolute right to object to direct marketing;
• receive data you gave us in a portable format;
• withdraw consent where we rely on it.

Email [email protected]. We answer within one month. There is no charge.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, phone 0303 123 1113.

12. Changes to this policy

We will post any change here and update the date at the top. If a change affects customers materially, we will email them before it takes effect.