Privacy policy
Last updated: 14 August 2026
Courtesy translation
This English version is provided for convenience. The German version at /datenschutz is the authoritative one.
Controller
Mango Ventures GmbH, Trottenstrasse 20, 8037 Zurich, Switzerland.
Principle
This website uses no advertising cookies and no tracking for advertising purposes. The revised Swiss Data Protection Act (FADP) applies; for visitors from the EU, additionally the GDPR.
Cookies
This website sets two first-party cookies: one for showing prices in your currency and one holding a random, anonymous visitor ID used for reach measurement — each with a lifetime of 13 months, and never shared with third parties.
Web analytics
We measure the use of this site with PostHog (PostHog EU, hosted in the EU), without cross-device profiles. We record technical details (e.g. browser, approximate origin at country level) and interactions with the page. Nothing is linked to you as a person. In the application we additionally record individual usage events; only internal identifiers (user and organisation ID) are transmitted, never names or email addresses. Google user data from directory sync or Google sign-in is not used for usage measurement.
Hosting
This website is hosted by Vercel (static delivery, servers in the EU among others). Serving it generates technically required access data (IP address, time of access), processed for delivery and security.
Using the application
When your organisation uses the Mango Inventory application, we process user account and contact data (name, email address, role, profile photo where available), technically necessary security and usage logs, and support communication — for contract performance, account administration, security and support. If your organisation connects its directory (Microsoft Entra or Google Workspace), we take these details from the directory on its behalf — including for people who have not signed in yet; synced profile photos are deleted when a person is offboarded or the connection is removed. For your organisation's inventory data and other content we act as a processor on its instructions (details in the Terms of Service and the DPA). Data is stored for as long as the usage relationship exists and deleted afterwards as set out in the Terms of Service; account and contract details are retained beyond that only as long as legally required. Recipients and processing locations follow from the provider list on the Trust & security page.
Google user data from directory sync and Google sign-in
When your organisation connects its Google Workspace, we only read your directory — we never write anything back (admin.directory.group.readonly, admin.directory.group.member.readonly, admin.directory.user.readonly). We receive your Google groups so you can pick which ones to sync, the memberships of the chosen groups, and per member the name, primary email address and, where present, the profile photo; on Google sign-in the name, email address and profile picture. We use them solely for user-facing features of Mango Inventory: creating members and keeping them current, withdrawing access as soon as the directory no longer lists a person, and sign-in. Never for advertising, marketing, product analytics or AI training; we do not sell them and do not pass them to data brokers or advertising networks. Mango Inventory's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data: who we share it with
Only the providers that technically process it: Convex, Inc. (backend, database, file storage; processed in the EU — AWS Dublin, region eu-west-1) and Vercel, Inc. (delivery of the web application; stores no Google user data). Individual details may appear in error logs or transactional email; those are processed by Functional Software, Inc. (Sentry, EU), Axiom, Inc. (EU) and Resend, Inc. (EU region). No one else — unless we are legally obliged to.
Google user data: protection, disconnecting, deletion
We protect it with TLS/HTTPS on all connections, encryption at rest for the database and file storage, tenant separation per organisation, role-based access control checked server-side on every function, and production access that only the operator has — with two-factor authentication. The access token stays server-side and never reaches the browser or the app. If you disconnect, we delete the token and the synced profile photos and receive no further Google user data; members already created remain records of your organisation until you request their deletion. The same applies if the grant is revoked at myaccount.google.com: the next sync fails and the connection is marked as broken. Full deletion of your organisation is governed by our Terms of Service.
AI features in the application
A few Mango Inventory features use AI: speech recognition when dictating, column mapping on Excel import, and prefilling device details. For these we transmit the necessary content (e.g. an audio recording or column headers) to OpenAI Ireland Ltd; processing also takes place in the USA by OpenAI, L.L.C., which is certified under the Swiss–US Data Privacy Framework. Processing only happens when you use the respective feature, and OpenAI does not use your content to train AI models. Google user data from directory sync or Google sign-in is not transmitted to AI providers.
Your rights
You have the right to access, correct and delete your data. To do so, contact the address given in the Impressum.