Privacy

Privacy notice

Draft, last updated 16 October 2026. This notice is pending legal review.

This notice explains what information Mandala Charts collects, why we collect it, who helps us process it, and what you can ask us to do with it. We have tried to write it in plain English and to describe only what the app actually does.

Who runs Mandala Charts

Mandala Charts is run by HAILO Ops Ltd, [company address to be confirmed]. We are the controller of the personal information described here. You can contact us about anything in this notice at [contact email to be confirmed].

Using the app without an account

You can build a chart without signing in. In that case your charts, board and check-ins are saved only in your own browser's local storage, and we do not receive them. If you clear your browser data, those charts are gone.

The waitlist

If you join the Teams and Agents waitlist, we store your email address and whether you chose solo founder or small team. We use this to email you when Teams and Agents opens and to understand who is interested. To stop abuse, we rate-limit sign-ups by IP address, but we only keep a one-way hash of the address, not the address itself. You can ask to be removed from the list at any time.

Accounts and sign-in

If you sign in, we use Supabase to run your account. You can sign in with an email and password or with Google. We store your email address, a user ID, and the charts, board slots, check-ins and activity history you save, so they can follow you across devices. When you sign in with Google, Google shares your basic profile and email address with us.

If you create a share link for a chart, anyone who has that link can view the chart, and edit links also let them change action cells. Edits made through a share link are recorded in the chart's activity history. You can revoke a share link at any time.

AI suggestions

When you ask the app to suggest drivers, actions or a weekly plan, the text of your goal and chart is sent through Lovable's AI gateway to an AI model to generate the suggestion. We rate-limit these requests using a one-way hash of your IP address.

Connecting an AI agent

You can connect an AI agent, such as Claude, Grok or another MCP client, to your account through our MCP server. When you connect, you sign in to Mandala Charts and approve the connection using OAuth. The agent never sees your password.

Once you approve it, the agent can do the following on your behalf:

• List your charts and read a full chart, including the goal, drivers, action cells, board slots and check-ins.
• Read progress for each driver and each board slot.
• Update the text of a cell. On a sealed chart this is recorded as a queued amendment instead of a direct edit.
• Tick off an action as done for today.

Changes an agent makes are recorded in the chart's activity history so you can see what it did. The agent provider (for example Anthropic or xAI) handles the data it reads under its own privacy policy. You can revoke access at any time by removing the connector in your agent's settings, or by emailing us and asking us to revoke it.

Analytics

We use PostHog to understand how the site is used. PostHog only loads if you click Accept on the cookie banner. If you click Decline, or never choose, PostHog is not loaded, sets no cookies and receives nothing.

If you accept, we record page views, the referring site and any campaign tags in the link, and a handful of named events: joining the waitlist, signing in, sealing a chart and using an AI suggestion. If you are signed in, these events are linked to your account ID. We have turned off autocapture, session recording, heatmaps and surveys, so PostHog does not record your screen, your clicks or what you type.

Cookies and browser storage

Before you make a choice on the banner, we set no analytics cookies. The only cookie set before then is a strictly necessary one from Cloudflare, which is described below. Here is what we do use.

• Your browser's local storage holds your charts if you are not signed in, your weekly plan, whether you have seen the tutorial, and your cookie choice.
• If you sign in, Supabase keeps your sign-in session in local storage, not in a cookie.
• Cloudflare, which hosts the site, sets a strictly necessary cookie called __cf_bm to tell real visitors apart from automated bots. It lasts about 30 minutes and is not used for analytics or advertising.
• During a connection approval we briefly keep the page to return to in session storage, which is cleared when the tab closes.
• If you accept analytics, PostHog sets a cookie and a local storage entry whose names start with ph_ so it can recognise repeat visits. These are removed if you later decline.

The site also loads fonts from Google Fonts, which means Google receives your IP address when the fonts load.

Who processes your data for us

• Supabase stores the database and runs sign-in. This includes waitlist emails, accounts and saved charts.
• PostHog provides analytics, in its EU region, using the host https://eu.i.posthog.com. It only receives data if you accept analytics.
• Lovable hosts the app and provides the AI gateway used for suggestions.
• Google provides Google sign-in, if you choose it, and the web fonts.
• Stripe processes payment if you buy founding access. We do not see or store your card details.

Some of these providers may process data outside the UK. Where they do, they rely on the legal safeguards the UK recognises for international transfers.

How long we keep it

We keep waitlist emails until Teams and Agents opens or until you ask us to remove them. We keep account data and saved charts for as long as your account exists. When you delete a chart it is marked as deleted and is no longer shown or shared.

Your rights and deleting your data

Under UK data protection law you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. To make any of these requests, including deleting your account and charts or removing your email from the waitlist, email us at [contact email to be confirmed]. We will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this notice

If we change how we use your data, we will update this page and the date at the top.