Privacy Policy

1The short version

The rest of this policy is the detail behind those six lines. It applies to mamba.app, to any agency-branded version of the dashboard on a custom domain, and to everything the Mamba service does with data.

2Two different roles, and why the difference matters

Privacy law treats you differently depending on who decides what happens to a piece of data. Mamba sits in two roles at once, and it is worth being precise about which is which.

The practical consequence: if you are a shopper who bought something from a TikTok Shop and you want your data deleted, the business to ask is the seller you bought from, not Mamba. Section 12 explains how that works and what we do when a seller asks us.

3Information we collect about you

3.1 Information you give us

• Account: name, work email address, password (stored hashed, never in readable form), company name, role and seat type, time zone and display preferences.
• Billing: billing name, address and the last four digits and brand of your card, plus your subscription and invoice history. Full card numbers go to Stripe and never reach our servers.
• Business inputs: cost of goods per SKU, shipping assumptions, agency retainers, custom cost lines, supplier terms, notes and report configurations.
• Support and sales: what you send us in a support ticket, a bug report, a demo request or a contact form, including any attachments.

3.2 Information we collect automatically

• Authentication and security logs: sign-in times, IP address, user agent, and the actions taken in your workspace. We keep these to secure accounts, to investigate incidents, and to answer the question “who changed this?” when you ask it.
• Product usage: pages viewed, features used, reports generated and exports taken, so we can see what works and fix what does not.
• Diagnostics: error traces and performance data.
• Data pipeline logs: records of each sync with TikTok — when it ran, what it fetched, and whether it failed — which is how we notice a broken shop before you do.

3.3 Information from third parties

TikTok, when you authorize a shop (Section 4). Stripe, for payment status. And, if you were introduced to us by an agency or a partner, the contact details that agency provided — who warrants it was entitled to give them to us.

4What we receive from TikTok Shop

Mamba is an approved TikTok Shop Partner application in the Analytics & Reporting category. When you authorize a shop, TikTok gives us a token limited to the permissions you approved. We never receive your TikTok password.

Below is what those permissions actually give us. We publish it in full rather than saying “shop data” because you cannot consent to something described that vaguely.

4.1 What we do not take

We do not request permissions we do not use. We do not receive your TikTok login, your bank credentials, or the contents of your TikTok inbox beyond affiliate messaging. Where a permission gives access to a field the Service does not need, we do not store that field.

5Your customers’ personal information

This is the section that matters most, so it stands alone.

To calculate what an order earned, Mamba has to read the order. TikTok’s order records include information about the person who placed it. That makes Mamba a processor of consumer personal data, and we hold ourselves to the following:

5.1 Who can see it inside Mamba

Access is limited to Authorized Users of the workspace the shop belongs to, and to the small number of Mamba personnel who need it to run and support the Service. Staff access is role-based, logged, and granted on a need-to-know basis. We require confidentiality obligations of everyone who has it.

5.2 TikTok’s own rules

Our handling of this data is also governed by our agreements with TikTok, which require us to use it only for the authorized purpose, to keep it no longer than necessary, to protect it with appropriate technical and organizational measures, and to be able to demonstrate that we do. Where TikTok’s requirements are stricter than this policy, the stricter rule applies.

6How we use information

We do not use your data for any purpose that is not on this list. If that changes we will update this policy and tell you before the new use starts.

7Artificial intelligence features

Mamba includes features that generate written insights, summaries and alerts from your numbers.

• They run on your data, to produce output for you. Output is scoped to your workspace.
• Your data is never used to train a third party’s general-purpose models. Section 8 describes the only model training we do at all, on aggregated and de-identified figures. Where we use a third-party model provider, it is contractually a sub-processor, bound not to train on your data and to delete it after processing. Our current model provider is Anthropic, listed in Section 9.2.
• We do not send consumer personal data to a model provider. Where an insight needs order information, we send aggregates and de-identified figures, never buyer names or addresses.
• AI output is generated text and can be wrong. Check it before acting on it.

8Aggregated and de-identified data

We produce aggregated statistics from data across the Service — how features are used, how the platform performs, and category-level benchmarks — and we use them to train and improve Mamba’s own models: the models behind our forecasts, benchmarks and written insights. This section says exactly what goes into that and what never does.

8.1 What we use, and what we never use

Put plainly: we may learn that a supplements shop at a certain ad spend tends to see a certain ROAS. We do not learn, and cannot learn, what you pay for your product, what you sell, or who buys it. Your costs and your catalog are excluded by design, not by promise.

8.2 How it is de-identified

Identifiers are stripped before the data leaves your workspace boundary, and figures are aggregated across enough shops that no individual shop’s numbers can be identified or inferred from the result. We will not attempt to re-identify de-identified data, and we contractually prohibit anyone we share it with from doing so. No model output will reproduce, reveal, or let a user infer another customer’s data. We will not publish a benchmark that could expose an individual shop’s numbers, and we will not use one seller’s identifiable data to advise a competitor.

8.3 Your right to opt out

Because de-identified data is outside the definition of personal information under US state privacy law, this is a commitment we are choosing to make rather than one we are required to make. We think it is the right one.

9When we disclose information, and to whom

We do not sell personal information. We do not share it for cross-context behavioral advertising. We have not done either in the preceding twelve months.

We disclose information only in these situations:

9.1 Inside your workspace

To the Authorized Users of your workspace, according to the roles and P&L visibility policy you have configured. If your shop is linked to an agency, its users see what you have permitted them to see.

9.2 To sub-processors

Vendors that help us run the Service, under written contracts that limit them to our instructions and require appropriate security. Current sub-processors:

We maintain a current list and will give 30 days’ notice before adding a sub-processor that processes consumer personal data. Email privacy@mamba.app to be notified of changes.

9.3 For legal reasons

Where we are legally required to, or where we reasonably believe disclosure is necessary to protect the rights, property or safety of Mamba, our customers or the public. If we receive a demand for a customer’s data, we will tell that customer before responding unless we are legally prohibited from doing so, and we will challenge demands that appear overbroad or unlawful.

9.4 In a corporate transaction

If Mamba is acquired or merges, information may transfer as part of the transaction. The acquirer remains bound by this policy for previously collected data until it gives you notice of a change and, where required, obtains your consent. We will notify you before your data becomes subject to a materially different policy.

9.5 With your direction

When you export a report, share a Snapshot, or send data to another system, you are the one making that disclosure. Once it leaves the Service, it is governed by whatever you sent it into.

10How long we keep things

10.1 After you leave

You can export your data at any time, and for 30 days after your account closes. After that we delete or de-identify customer data within 90 days, except what we must keep for legal or accounting reasons. You can ask us to delete sooner and we will, subject to those exceptions.

10.2 When you revoke TikTok access

Revoking in TikTok Seller Center stops all new data immediately. Data already collected is kept under this section until your account closes or you ask us to delete it.

11How we protect it

• Encryption in transit (TLS) and at rest.
• Tenant isolation so one workspace cannot read another’s data, enforced in the data layer and not only in the interface.
• Role-based access for customers, and least-privilege, logged access for Mamba staff.
• Credential hygiene: passwords hashed with a modern algorithm; TikTok access tokens stored encrypted; no plaintext secrets in logs.
• Monitoring of authentication, ingestion and API activity, with alerting on anomalies.
• Backups, encrypted, with restoration tested.
• Mamba passed TikTok’s US data security review and its data security and privacy review as part of becoming a public partner app.

Mamba is a three-person company. Everyone with production access is a principal of the business, bound by written confidentiality obligations, with access individually attributed and logged. We do not currently run formal background screening, and we would rather say so than imply a control we do not operate.

Development and testing. Production is separated from development. We do use real shop data from connected shops to verify that calculations are correct — a P&L that has never been checked against real settlement figures is not worth publishing — but consumer personal data is excluded from that use: no buyer names, addresses or contact details are used in development or testing. Access to production data for verification is limited to the same principals and logged the same way.

11.1 If something goes wrong

If we become aware of a breach affecting your data, we will notify you without undue delay and in any case within 72 hours of confirming it, with what we know: what happened, what data was involved, what we are doing, and what you may need to do. Where the data is consumer personal data, you as the controller decide what notice goes to consumers and to regulators, and we will give you the information you need to make and support that decision.

No system is perfectly secure, and we do not claim otherwise. Report anything suspicious to security@mamba.app.

12Your rights, and your customers’ rights

12.1 If you are a Mamba customer or user

Depending on where you live, you may have the right to: know what personal information we hold about you and why; get a copy of it; correct it; delete it; limit how we use sensitive information; opt out of sale, sharing, or profiling with legal effects; and not be discriminated against for exercising any of these. Because we neither sell nor share personal information, the opt-out right has nothing to operate on — but you can still ask us to confirm that.

These rights come from state laws including the California Consumer Privacy Act as amended, and comparable laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states as they take effect. The rights differ slightly by state; we apply the most protective version we reasonably can to everyone.

12.2 How to make a request

Email privacy@mamba.app from the address on your account, or write to us at the address in Section 16. We will verify you — usually by confirming control of the account email — and respond within 45 days, extending once by a further 45 days if the request is complex, with notice to you. There is no charge unless a request is manifestly unfounded or excessive.

12.3 Authorized agents and appeals

You may use an authorized agent where your state allows it; we will ask for proof of authority. If we decline a request, we will tell you why and how to appeal. To appeal, reply to our decision with “appeal” in the subject line; a different person will review it and respond within 45 days. If we deny the appeal you may contact your state attorney general.

12.4 Sensitive information

We do not collect sensitive personal information as defined by California law, and we ask you not to put it into the Service (see the Terms, Section 7). If you do, we will treat it under the same restrictions as everything else, but the Service is not designed for it.

13If an agency manages your shop

Where a seller’s shop is linked to an agency workspace:

• the seller remains the controller of its shop data;
• the agency is a separate controller or processor depending on its engagement with the seller, and the agency’s own privacy practices are its responsibility, not ours;
• the seller decides what the agency can see. Mamba’s P&L Visibility Policy lets a seller hide cost, margin, affiliate and other lines from agency users, and hides anything that would reveal a hidden line by arithmetic;
• a seller can unlink an agency at any time, or revoke the TikTok authorization entirely, without the agency’s agreement; and
• when a link ends, the agency loses access to that shop’s data in Mamba. Reports it already exported are outside our control and remain subject to its obligations to the seller.

If an agency uses white labeling, the dashboard may carry the agency’s brand and sit on its domain. Mamba is still the operator underneath, and this policy still governs what we do with the data.

14Cookies and tracking

14.1 In the application

We use strictly necessary cookies and similar storage to keep you signed in, to keep your session secure, and to remember interface preferences such as which metrics you pinned. These cannot be switched off without breaking the Service.

14.2 On the marketing site

Mamba does not currently use a third-party analytics provider on the mamba.app marketing site. We do not run advertising or retargeting pixels on mamba.app. There is no Meta pixel, no TikTok pixel and no advertising tag, which is why the statement in Section 9 that we do not share personal information for cross-context behavioral advertising is accurate rather than aspirational.

14.3 Your choices

Browsers let you block or delete cookies; blocking necessary cookies will stop you signing in. We honor Global Privacy Control signals as an opt-out of sale or sharing where state law requires it. We do not track you across other companies’ websites.

15Other things you should know

15.1 Where data is processed

Mamba is operated from the United States and your data is processed there. Customer data is hosted on Amazon Web Services in the United States, and we do not replicate it outside the United States. Mamba is offered to sellers operating in the United States and is not directed at the EU or UK; if that changes, we will publish transfer terms and a data processing addendum with standard contractual clauses before it does.

15.2 Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child’s information has reached us through the Service, tell us and we will delete it.

15.3 Automated decisions

Mamba produces forecasts, alerts, reorder suggestions and AI-written insights. None of them makes a decision that has a legal or similarly significant effect on an individual. They are inputs to decisions you make.

15.4 Changes to this policy

We will post the updated policy here with a new effective date. For material changes — a new category of data, a new purpose, a new category of recipient — we will give at least 30 days’ notice by email before it takes effect, so you have time to object or leave. Previous versions are available on request.

16Contact us

Questions, requests and complaints about privacy all go to the same place, and a person reads them.

If you are not satisfied with our response, you may complain to your state attorney general or, in California, to the California Privacy Protection Agency.