Trust & security
Last updated: 6 August 2026
This page tells you, in plain language, who is behind Mango Inventory, where your data is processed, and how you get it back at any time. The details live in the privacy policy; the German version of this page is the authoritative one.
Who is behind Mango Inventory
Mango Inventory is operated by Mango Ventures GmbH (Zurich, Switzerland; UID CHE-394.800.535). You reach founder Karim Attia directly — contact details are in the Impressum. For schools and other organisations that need a data processing agreement (DPA), we provide a template for signature on request (in German).
Where your data lives
The primary application database and your uploaded files are stored in the EU: they run on Convex, hosted on AWS in Dublin, Ireland (region eu-west-1). When you use individual AI features, the content they need is additionally processed by the providers listed below at the locations stated there. The revised Swiss Data Protection Act (FADP) applies and, where applicable, the GDPR.
Backups
The production database is protected by Convex's backup facility (retained in the same EU data centre). Restore is not just configured but tested: we ran a full restore drill and verified that all records and files come back intact.
Deletion and data return
Your data is yours. As an organisation owner you can export your complete inventory as an archive directly in the app at any time (tables as CSV plus all files and photos). On request we delete your organisation and all associated data completely from active systems; backup copies are overwritten or deleted within 90 days at the latest. Write to the contact address in the Impressum.
Reporting security issues
If you suspect a security gap or an incident, please get in touch directly: karim@mangoinventory.com. You will get a personal answer from the founder.
Subprocessors (application)
We use the following service providers to run the Mango Inventory application:
| Provider | Purpose | Processing location |
|---|---|---|
| Convex, Inc. | Application backend, database and file storage | EU — AWS Dublin, Ireland (eu-west-1) |
| Vercel, Inc. | Delivery of the web application (static files) and this website — inventory and personal data are never stored on Vercel; serving generates technical access data | USA (Swiss–US Data Privacy Framework); delivery via globally distributed CDN locations |
| OpenAI Ireland Ltd | AI features (speech recognition, import column mapping, prefill) — only when you use these features; your data is not used to train AI models | Ireland; processing also in the USA by OpenAI, L.L.C. (Swiss–US Data Privacy Framework) |
| Resend, Inc. | Transactional email (e.g. invitations, notifications) — processes email addresses and message content | EU region configured; provider based in the USA |
| Functional Software, Inc. (Sentry) | Error diagnostics — technical error reports from the application, which can occasionally contain user identifiers | EU (EU data residency) |
| Axiom, Inc. | Retention of technical operations logs of the production environment (30 days) for incident and security analysis | EU |
Providers of the public website
| PostHog | Web analytics on this website only (anonymous visitor ID, no personal profiles) — no application data | EU (PostHog EU Cloud) |