Privacy
Last updated 12 August 2026. MantaIQ, publisher of Cal.
Cal runs on your own computer. Your posts, your clients’ messages, your analytics and your connected accounts stay on that machine and are never transmitted to us. This is not a promise about how carefully we handle your data. It is a statement that we do not have it.
The short version. We hold your email address, and if you subscribe, a Stripe customer reference. Nothing else — unless you deliberately join the Cal Creators Club, which sends six numbers a month under a random reference and is described in full below. We cannot read your marketing data, your clients’ data, or the messages your audience sends you, because none of it reaches us.
This distinction matters legally and it is unusual, so it is worth stating plainly.
| Data | Who controls it | Do we see it? |
|---|---|---|
| Your posts, analytics, competitor data, inbox messages | You. You are the controller. It lives in a database on your machine. | No. Never. |
| Your clients’ data, if you are an agency | You, under whatever agreement you have with them. | No. Never. |
| Your account email and password hash | Us, as controller. | Yes. |
| Cal Creators Club scores, if you join | Us, as controller, under a random reference | Yes — six numbers a month, and nothing that names you. |
| Your payment details | Stripe, as an independent controller. | No. We hold a customer reference only. |
Because your operational data never reaches us, we are neither controller nor processor of it, and no data processing agreement between us is required for it. If your own clients or regulators need one covering the account data we do hold, write to privacy@mantaiq.com.
Your email address and a hash of your password. The hash is salted and cannot be reversed into your password. We use the address to identify your account, to send service messages such as a billing failure, and for nothing else.
Stripe processes the payment on its own systems. No card number ever reaches Cal or MantaIQ. We store the customer and subscription identifiers Stripe gives us so we know whether your subscription is active. Stripe’s own privacy notice governs what it holds: stripe.com/privacy.
Your copy of Cal asks our update host whether a newer version exists. That request carries what any web request carries: an IP address, a timestamp, and the version being checked. We do not use it to build a profile, and it is not linked to your account.
Whatever you choose to send us, for as long as we need it to answer.
An optional add-on. It is off unless you switch it on, and switching it on means giving Cal your own Google API key.
This is the one part of Cal that does not run on your machine. Video generation happens on Google’s servers, so what you type — your description of the clip, and any reference image you attach — goes to Google. Nothing else does: not your posts, your metrics, your messages, or anything belonging to your clients.
Generated clips are marked in your library and stay marked when you schedule them, because several platforms now require AI content to be disclosed. Cal records the model and the prompt with the clip so you can answer how something was made, and keeps both on your machine.
An optional yearly programme that invites ten established creators to mentor others. It is off unless you switch it on, and it is the only part of Cal that ever sends us anything about your work.
If you never join, this section does not apply to you. No identifier is created, nothing is sent, and nothing about you is held on the programme’s systems. Declining, or never being asked, leaves no trace at all.
Joining takes two deliberate steps: a toggle, and then accepting terms that list every field before you agree. Those terms are shown every time you switch it on, not once, so a year you take part is a year you agreed to.
Accepting creates a random reference on your own machine — a value
beginning cc_, generated locally and not derived from your name,
your email, or anything you typed. Your copy of Cal also generates a signing
key, whose private half never leaves your computer.
Once a month, to calcreators.mantaiq.io, six fields:
| Field | What it is |
|---|---|
| Reference | The random cc_ value above |
| Growth | A score from how your follower count changed since you connected your accounts |
| Engagement | A score from your median engagement rate per post |
| Consistency | A score from how regularly you publish |
| Combined score | The three above, weighted |
| Days of history | How long Cal has been measuring |
Nothing else. Not your name, your email, your posts, your images, your messages, your follower counts, or which platforms you use. Nothing your own clients could be identified from.
Your reference, your public key, those monthly scores, and a salted, one-way fingerprint of your Stripe customer — enough to stop one subscription enrolling twice, and useless for looking anyone up. It holds no email address and no way to contact you, deliberately: if you are invited and accept, the app shows you an address to write to, and you contact us.
It is a separate service on separate infrastructure from our feedback hub, and shares no identifier with it, so nobody holding both can connect a public review to a private ranking.
We treat this data as personal data under the UK and EU GDPR even though it carries no name. The lawful basis is your consent (Art. 6(1)(a)), which you may withdraw at any time by either action above, and withdrawing is as easy as giving it was.
Ten creators are invited each year. An invitation is shown in the app; you may accept, decline, or ignore it, and seven days of silence is treated as a decline. Accepting records that you accepted and shows you an address. We learn who you are only if you choose to email us.
For people in the UK, EU and EEA, the UK and EU General Data Protection Regulations require a lawful basis for each purpose:
| Purpose | Lawful basis |
|---|---|
| Running your account | Performance of a contract (Art. 6(1)(b)) |
| Taking payment | Performance of a contract (Art. 6(1)(b)) |
| Service emails about your account or billing | Performance of a contract (Art. 6(1)(b)) |
| Keeping the update service working and secure | Legitimate interests (Art. 6(1)(f)) |
| Meeting tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
Wherever you live, you may ask us to show you what we hold, correct it, or delete it. Write to privacy@mantaiq.com and we will respond within 30 days.
Under UK and EU GDPR you additionally have the right to restrict or object to processing, to receive your data in a portable format, and to complain to your national supervisory authority without contacting us first. Under the CCPA and similar US state laws you have the right to know, to delete, to correct, and to opt out of sale or sharing — the last of which is already the case for everyone, permanently, because we do not do it.
Your operational data does not need a request. Everything Cal holds about your work is exportable from inside the application at any time, subscribed or not: Settings → Workspace → Export everything. It produces a zip of open CSV files and your images that requires no software of ours to read. We could not fulfil a request for it if we tried, because it has never left your machine.
MantaIQ operates from the United States. If you are in the UK, EU or EEA, the account data we hold is processed in the United States. Where a transfer of that data is required, it is made under the European Commission’s Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum. Stripe maintains its own transfer mechanisms for the payment data it controls. The Cal Creators Club service is likewise operated from the United States, and the same clauses cover it — though what it holds carries no name, no address and no way to contact anyone.
| What | How long |
|---|---|
| Account email and password hash | Until you delete your account |
| Subscription records | Seven years, for tax and accounting law |
| Support correspondence | Two years |
| Update-check logs | 90 days |
| Cal Creators Club scores | 24 months, or until you delete your reference |
| Cal Creators Club enrolment | Until you delete your reference |
Deleting your account removes your email and password hash from our systems. It does not touch the data on your machine — that is yours, and we have no means of reaching it.
Cal is a professional tool sold to businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, write to us and we will delete it.
Passwords are stored as salted hashes. Access tokens for your connected social accounts are encrypted at rest on your machine and are never transmitted to us. Payment card details never touch our systems at any point. Our security contact details are published at /.well-known/security.txt.
If we change this notice materially we will say so on this page and, where the change affects data we hold about you, by email. The date at the top always reflects the current version.
MantaIQ — privacy@mantaiq.com. UK and EU residents may also complain directly to their national supervisory authority; in the UK that is the Information Commissioner’s Office.