Last updated: October 8, 2026

This Privacy Policy explains how Manitrak (“Manitrak”, “we”, “us”), operated by Pixel38, collects, uses, discloses, and protects information when you visit our public websites, create or join a workspace, or use the Manitrak platform at manitrak.com and related subdomains, APIs, emails, and support channels (collectively, the “Services”).

This Policy explains our processing practices; it is not a request for blanket consent. Capitalized terms used but not defined here have the meanings in our Terms of Service.

1. Who we are

Manitrak is a multi-tenant business workspace for finance, accounting, HR & payroll, operations, and related administration. The Services are provided by Pixel38, a company based in Beirut, Lebanon.

Operator / controller (account & platform data): Pixel38
Registered / postal address: Pixel38, Beirut Souks, Hermes Building, Patriarch Howeiyek Street, Beirut, Lebanon
Privacy contact: info@pixel38.com
Website: pixel38.com

2. Scope and roles

2.1 Controller vs processor

Platform account data. For information about your user account, authentication, billing contacts, marketing preferences for Manitrak itself, and service telemetry, Pixel38 acts as an independent controller (or equivalent under applicable law).
Customer Content. Content that your organization stores in a workspace — such as clients, vendors, invoices, journals, employees, payroll, files, credentials vault entries, and similar business records (“Customer Content”) — is controlled by your organization. For that data, Pixel38 processes it on your organization’s instructions to provide the Services (a “processor” / service-provider role), except where we must process it to secure the platform, comply with law, or enforce our Terms.

2.2 Workspace administrators

If you use Manitrak under an organization workspace, your administrator’s policies may apply in addition to this Policy. Direct privacy requests about Customer Content to your organization first; we may redirect end-user requests to the workspace administrator when appropriate.

2.3 What this Policy does not cover

This Policy does not cover third-party websites, payment rails outside our control, or customer-owned systems you connect to Manitrak. Those parties have their own privacy practices.

3. Information we collect

3.1 Information you provide

Account & profile — name, email address, password (stored hashed), role, timezone, language/preferences, and optional profile fields.
Organization & billing — workspace name, legal/business profile fields, billing contacts, plan selections, payment references you or we record, affiliate codes, and related correspondence.
Customer Content — business records and files your users enter or import into a workspace.
Support & communications — messages, attachments, and metadata when you contact us (including via the Contact page or email).
Email notification preferences — optional digests and reminders you enable or disable in Profile.

3.2 Information collected automatically

Technical & security logs — IP address, user-agent, approximate location derived from IP, timestamps, request paths, error diagnostics, and security events needed to operate and protect the Services.
Session & device signals — session identifiers, authentication state, and multi-factor authentication status.
Usage signals — coarse product usage needed for reliability, abuse prevention, and (where permitted) product improvement. We do not sell personal information.

3.3 Information from others

Invitations and memberships created by workspace administrators.
Affiliate referral attribution when someone arrives via a partner link or code.
Infrastructure providers that surface delivery or abuse signals (for example email bounce/complaint events).

4. How we use information

We use information to:

Provide, operate, maintain, and improve the Services
Create and authenticate accounts; enforce roles, permissions, and plan entitlements
Host, back up, and restore Customer Content at your organization’s direction
Send transactional messages (invites, password resets, security alerts, billing notices, and other service mail)
Send optional product digests or reminders you have enabled
Process trials, subscriptions, invoices, affiliate attribution, and related support
Monitor reliability, debug issues, prevent fraud/abuse, and secure the platform
Comply with law, respond to lawful requests, and enforce our Terms
Communicate about material Service changes when appropriate

Where data-protection law requires a “legal basis,” we rely on one or more of: performance of a contract; legitimate interests in running a secure B2B SaaS platform (balanced against your rights); consent where required (for example certain optional emails or cookies); and legal obligation.

5. Cookies and similar technologies

We use browser storage for distinct purposes: essential sign-in, preferences, and referral attribution. These purposes should not be treated as interchangeable:

Session cookies — keep you signed in and associate requests with your workspace (including cookies scoped to .manitrak.com for subdomain workspaces).
Referral attribution - affiliate and referral codes may be stored in cookies and local storage when you follow a partner link. Local storage can remain until you clear it; it is not automatically removed when you close a tab. This attribution is separate from essential sign-in.
Local preferences — browser storage for UI preferences such as theme or navigation layout.

We do not use third-party advertising cookies on the public site. You can control cookies through your browser; blocking essential cookies may prevent sign-in or core features from working.

6. AI features

Optional AI features can answer questions, summarize permitted records, extract information from documents, assist recruitment, and support configured workflows. Requests may include prompts, attachments, and relevant workspace records. Depending on configuration, processing uses Cloudflare Workers AI or OpenAI, including a workspace's own configured provider account.

Generated results may be saved in workspace records, conversations, or workflow history; service usage and diagnostic records may also be retained. Provider processing and retention depend on the selected service and account terms. Do not submit information you are not authorized to share. Administrators should review their provider configuration before enabling AI for sensitive data.

AI output can be inaccurate. People should review results before accounting entries, payments, hiring decisions, or other consequential actions. Workspace organizations determine the purposes and lawful basis for processing employee and applicant information and are responsible for required notices, human oversight, and safeguards against unlawful automated decisions.

Public website chat is provided through Interactic. Loading the widget connects your browser to Interactic; messages and any contact information you choose to submit are processed through that service to handle your enquiry. Avoid sharing passwords or sensitive business records in website chat.

We do not sell personal information. We share information only as needed to operate the Services, including with:

Infrastructure & hosting — cloud providers that run compute, databases, object storage, DNS, and related edge services for Manitrak (currently including Cloudflare).
Email delivery — transactional email providers (currently including Postmark) to send service messages.
AI inference — providers including Cloudflare and OpenAI that power enabled AI features, under contractual safeguards appropriate to the service.
Professional advisors & auditors — under confidentiality, when reasonably required.
Authorities — when we believe disclosure is required by law, legal process, or to protect the rights, safety, or security of users, Pixel38, or the public.
Business transfers — in connection with a merger, financing, or sale of assets, subject to appropriate continuity of protection.

Authorized workspace members, guests, export recipients, and integrations selected by an administrator may also receive the records shared with them. Those recipients may have their own privacy terms. Subprocessors process data only to provide services to us and are required to protect it appropriately. Workspace administrators remain responsible for any third parties they invite into their tenant.

8. International transfers

Manitrak is operated from Lebanon and delivered via globally distributed cloud infrastructure. Your information may be processed in countries other than where you live, including locations where our subprocessors maintain data centers or edge points of presence. Where required, we use appropriate safeguards (contractual and technical) for such transfers.

Contact us before uploading data that requires a particular hosting region or a data-processing agreement. A plan name does not by itself guarantee data residency. Where applicable, the signed processing agreement sets out processing instructions and any agreed transfer safeguards.

9. Retention

Active workspaces — Customer Content and account data are retained while the workspace remains active and as needed to provide the Services.
After cancellation or deletion — we delete or de-identify personal data within a commercially reasonable period, except where retention is required for backups, dispute resolution, security logs, billing records, or legal compliance.
Backups — encrypted backups may persist for a limited rolling window after deletion from primary systems.
Security & audit logs — retained for a period appropriate to investigate incidents and meet operational needs.

Cancelling a subscription is different from requesting deletion. Export needed records before closing a workspace, then contact us through an authorized administrator for deletion requests. Retention is determined by the service purpose, workspace instructions, configured backup expiry, outstanding disputes, and applicable accounting or legal obligations. Backup copies expire under their configured schedule rather than being removed immediately with live records. Contact us for the schedule relevant to your workspace; we do not promise indefinite recovery of deleted records.

10. Security

We implement administrative, technical, and organizational measures designed to protect information, including TLS in transit, access controls and role-based permissions, tenant isolation, hashed passwords, optional two-factor authentication, encrypted backups, and monitoring for abuse. No method of transmission or storage is perfectly secure. You are responsible for safeguarding credentials, enabling available security features, and configuring workspace access carefully.

11. Your rights and choices

Depending on applicable law and your relationship to a workspace, you may have rights to:

Access, correct, or update personal data we hold about you
Request deletion or restriction, subject to legal and contractual exceptions
Object to certain processing, or withdraw consent where processing is consent-based
Export or receive a copy of certain account data in a portable format where feasible
Lodge a complaint with the competent data-protection authority where applicable
Manage optional email preferences in Profile → Email notifications

To exercise rights regarding your user account, email info@pixel38.com or use the Contact page. For Customer Content held in a workspace, contact your workspace administrator; we will support administrators with verified requests. We may need to verify your identity before acting. We will respond within a reasonable period consistent with applicable law.

12. Children

The Services are designed for business use and are not directed to children under 16 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided personal data, contact us and we will take appropriate steps.

13. Changes

We may update this Policy from time to time. The “Last updated” date will change when we post revisions. We will communicate material changes through appropriate notices. If a new purpose requires additional notice or consent under applicable law, we will provide that notice or seek consent before the relevant processing. Continued use is not a substitute for required consent.

14. Contact

Privacy questions, requests, or complaints: info@pixel38.com
Pixel38, Beirut Souks, Hermes Building, Patriarch Howeiyek Street, Beirut, Lebanon

Related: Terms of Service · Contact

Privacy Policy