Manifest is a private client portal operated by Seismic Digital (“we,” “us”). This policy explains what information we collect when you use Manifest, how we use it, and the choices you have. Manifest is an invitation-only service for Seismic Digital’s clients and staff.
Information we collect
- Account information. When you sign in, we receive your email address. If you sign in with Google or Microsoft, we also receive your name and profile picture from that provider.
- Session data. We use cookies strictly to keep you signed in and to operate the service. We do not use advertising or tracking cookies.
- Google Drive (optional). If you choose to connect a Google Drive, we request read-only access (the
drive.readonlyscope) so we can display your files inside the portal. We never modify, delete, organize, or share your Drive content.
How we use information
We use the information above only to authenticate you, show your organization’s projects, dashboards, and files, and to operate, secure, and support the service. We do not sell your information or use it for advertising.
Google user data & Limited Use
Manifest’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google account and Drive data solely to provide the portal features visible to you, do not transfer it to others except as necessary to provide the service or as required by law, do not use it for advertising, and do not allow humans to read it except with your consent, for security, or where required by law.
Storage and security
Account and portal data are stored in our Supabase (PostgreSQL) database, protected by row-level security so each client sees only their own organization’s data. Google Drive refresh tokens are encrypted at rest (AES-256-GCM); access tokens are held only in memory and refreshed per request. The application is hosted on Netlify.
Sharing
We share data only with the service providers that run Manifest (Supabase for the database and authentication, Google for sign-in and Drive access, and Netlify for hosting), and only as needed to operate the service. We do not sell personal information.
Your choices
You can disconnect a connected Google Drive at any time from the portal, which revokes our stored access. You may request access to, correction of, or deletion of your personal information by contacting us.
Retention
We retain your information while your account is active and delete it on request or when it is no longer needed to provide the service.
Contact
Questions about this policy? Email letstalk@seismicdigital.com.
Changes
We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.