ManualessSecurity
How Manualess separates account data, API connections, and browser sessions.
Updated November 1, 2026
Where data is stored
The website and app provide access to Manualess services. The server stores account, permission, license and commerce-context data. API/OAuth credentials and tokens needed for webhooks and continuous jobs are encrypted on the server and decrypted only by the authorized backend. Browser sessions stay in the app's encrypted vault and are never sent to the server. The demo uses fictional data. Security measures are adopted under Article 46 of Law No. 13,709/2018 (LGPD).
Platform sign-in
Session-based connections open the platform's official domain in the app WebView; check the displayed address before entering credentials. Sessions are protected on the device. The tool does not authorize access to third-party accounts or websites: use only accounts you control or are authorized to operate, and follow provider terms and applicable law.
Device protection
Local encryption reduces exposure but does not remove the risks of a compromised device. Keep the operating system and app updated, use strong unique passwords, protect device access, and do not share credentials or the app's data folder. Signing out of Manualess does not revoke platform sessions; also use each provider's official controls.
Incidents, support and reports
If you suspect unauthorized access, stop using the affected device, review sessions with the services involved and contact manualess.atendimento@gmail.com. Include the time, tool and observed behavior; do not send passwords, tokens or customer data. Vulnerability reports do not authorize intrusive testing, access to third-party data or service disruption. Personal-data incidents will be assessed and notified when required by Article 48 of the LGPD and applicable ANPD rules.
Spreadsheet storage
Sheets edited on the website are stored by Manualess and associated with the account and business. App spreadsheets are stored in the device's encrypted vault. On first open, an existing server sheet may be copied into the app; the source copy is not automatically deleted.
Incident handling
Incident reports are assessed to contain the event, preserve necessary evidence, and identify affected data and individuals. When Manualess acts as controller and an incident may cause relevant risk or harm, ANPD Resolution No. 15/2024 requires notice to the ANPD and affected individuals within 3 business days after learning that personal data was affected, unless a specific law sets another deadline. The controller must also keep incident records for at least 5 years, including incidents that are not reportable. Send reports promptly to manualess.atendimento@gmail.com; contacting support does not replace formal notices.