Privacy policy

This policy covers this website and its forms. If your workplace uses MANA's weekly check-ins, those come with their own privacy information. For the plain-English version of who sees what, read Privacy, data and AI.

Who we are

This website is run by Vova Ltd, trading as MANA, a company registered in England and Wales (company number 09892661), with its registered office at 40 Keresley Road, Coventry CV6 2JD. We decide how the personal data described here is used, which makes us its controller. For anything about your data, contact us at hello@manacourse.com.

What we collect

Only what you type into our forms:

Pilot enquiry: your name, work email, organisation, how many people work there, whether you have mental health first aiders, whether you use Slack or Teams, and your message if you write one.
Contact form: your name, email, topic and message.
Course badge: your name, email and, if you add it, your workplace.
Bringing MANA to work: your name and workplace, and the name and email of the person you'd like us to write to. If you add a note, it goes in the email, but we don't keep it.

We also record when each form was sent. To stop spam, we keep a scrambled version of your IP address for one hour. It's scrambled with a secret key, so it can't be read as your address, and we never store the address itself.

We never ask about anyone's mental health, and this website never collects check-in answers. If you choose to tell us something about your health in a message, we use it only to reply to you. No AI or automated tool reads or sorts what you send us.

Why we use it

The law asks us to give a reason, called a legal basis, for each use:

To reply to you when you send an enquiry or a message, and to talk with you about a pilot. Our basis is our legitimate interest in answering people who get in touch.
To send you your badge. Our basis is that it's what you asked us for.
To send one email introducing MANA to the person you named. Our basis is legitimate interests: yours in passing MANA on, and ours in telling workplaces about it. We send one email, copy nobody in, and don't add them to any list.
To keep the forms free of spam and abuse. Our basis is our legitimate interest in keeping the site working and safe.
To protect life. If something you send makes us believe someone's life is at risk, we may share what's needed with the emergency services. Our basis is protecting that person's vital interests.

We don't sell your data or use it for advertising. We won't send you marketing emails unless you've asked for them. We don't make automated decisions about you.

Who else handles it

These companies handle data for us, under contracts that only let them use it to provide their service to us:

Vercel hosts this website and runs its forms.
Upstash stores form submissions, on servers in London.
Resend sends our emails.
Our email provider holds the messages in our inbox.

Vercel and Resend are based in the US, so your data may be handled there. When it is, it's protected by the UK–US data bridge or the UK's approved data transfer contracts.

We'd only share your data with anyone else if the law requires it, or to protect life as described above.

How long we keep it

Form submissions are deleted automatically after 24 months.
The scrambled IP address is deleted after one hour.
Emails we send and receive are deleted when we no longer need them, and after 24 months at the latest.

Your rights

You can ask us to:

tell you what data we hold about you and give you a copy
correct anything that's wrong
delete it
stop or limit how we use it, including objecting to a use based on legitimate interests
give you your data in a form you can take elsewhere

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd like the chance to put it right first, but you don't have to come to us before going to them.

Changes

If we change how we use your data, we'll update this page.

Last updated 15 November 2026.