Privacy Policy

Last updated: 18 August 2026

1. Who we are

ManufacturERP is a manufacturing ERP platform (CRM, sales orders, manufacturing scheduling, inventory, purchasing, shipping, accounts, and staff management) provided as software-as-a-service to manufacturing businesses ("tenants," "you," or "your company").

ManufacturERP is operated by ManufacturERP Ltd, a company registered in England and Wales under company number 17391200, registered office at 3 West Lane, Baildon, Shipley BD17 5HD ("we," "us"). You can contact us at hello@manufacturerp.co.uk.

2. Two different roles we play with your data

Because ManufacturERP is business software that your own company uses to manage your own customers, this policy covers two quite different relationships. Which one applies to you depends on who you are:

You're a subscriber, or a member of staff at one

If your company has a ManufacturERP account, or you're one of its staff logging into it, we are the data controller for your own account, billing, and login information. Section 3 covers this.

You're a customer of a company that uses ManufacturERP

If a manufacturer you buy from happens to run their CRM, quotes, orders, and invoicing on ManufacturERP, your details (name, email, phone, address, order history) may be stored in their account. That company is the data controller for your data — we are only ever their data processor, storing and processing it on their instructions. For any request about your own data, contact that company directly; their own privacy policy governs how they use it. Section 4 covers how we process it on their behalf.

3. Data we collect and control ourselves

As the operator of the platform, we collect and control:

Account & staff data — company name, staff names, work email addresses, login credentials, assigned role (Management, Finance, HR, Sales, Workshop, or Buyer), and which parts of the system each person has used.
Billing data — your subscription plan, seat counts, VAT number, and invoicing address. Bank account details are collected and stored by GoCardless, our payment processor, to set up your Direct Debit mandate — we never see or store your full account number or sort code.
Support & communications — anything you send us directly, e.g. by emailing hello@manufacturerp.co.uk.
Technical data — session/authentication tokens needed to keep you signed in, and basic server logs (timestamps, error traces) needed to operate and secure the service.

4. Data we process on a tenant's behalf

When a business runs ManufacturERP, the software stores whatever business data that company chooses to put into it, scoped so that one tenant can never see another's. Depending on how a tenant uses the product, this can include:

Their customers' company name, contact name, email, phone number, billing and shipping address, and credit limit.
Quotes, sales orders, invoices, payments, and a log of calls/emails/meetings/notes and follow-up reminders logged against each customer.
Their own staff, suppliers, products, inventory levels, and manufacturing/production records.

We only ever process this data as instructed by the tenant — to run the software, not for our own purposes, and never to sell it or use it for our own marketing. A tenant can export any customer's data, or erase their personal details on request, directly from the CRM at any time (see Section 8).

Public order tracking: a tenant can optionally give one of their customers a unique, unguessable link to check an order's progress without logging in. This only ever shows that one order's status and, once dispatched, its courier tracking — nothing else — and only exists if the tenant has switched this feature on.

5. Optional third-party integrations

A tenant, or one of their individual staff members, can choose to connect ManufacturERP to other services. These are always opt-in — nothing is connected unless a tenant or staff member actively sets it up — and each one only ever pushes data outward, never reads anything back:

Bookkeeping software (Xero, QuickBooks Online, or Sage) — if a tenant connects one, their invoices and payments push across automatically the moment they're issued or recorded.
Calendar sync (Google Calendar or Outlook) — an individual staff member can connect their own personal calendar so their own follow-up reminders appear as events on it.

These connections are made directly between the tenant/staff member's own account with that provider and our servers — your use of the connected service is also governed by that provider's own terms and privacy policy.

6. Who else processes data on our behalf (sub-processors)

We use the following sub-processors to run ManufacturERP. None of them can use your data for their own purposes.

Supabase — database, authentication, and file storage. Our project is hosted in the EU (London, UK) region.
Vercel — hosting and content delivery for the application and this website.
Resend — sends transactional emails (quotes, order confirmations, invoices, password resets, staff invites) on a tenant's behalf, from that tenant's own verified sending domain where configured.
GoCardless — processes subscription payments via Direct Debit and stores your bank account details; we never handle your full account number or sort code ourselves.
Xero / QuickBooks Online / Sage, Google, Microsoft — only if, and to the extent, a tenant or their staff member has actively connected one (see Section 5).

7. Cookies

We use only the strictly necessary cookies/local storage needed to keep you signed in securely. We do not use advertising or third-party tracking cookies on the application. This marketing website does not set any tracking cookies either.

8. How long we keep data

We retain account and business data for as long as a tenant's subscription is active. A tenant admin can request account closure at any time from Organisation Settings; once we've confirmed that request with them directly, we permanently delete the tenant's data, typically within 30 days.

One exception: UK law requires financial records (invoices, orders) to be kept for several years for tax purposes. Where a customer within a tenant's account asks to have their personal data erased but has financial history on file, we anonymize their personal details (name, contact info, address) while keeping the underlying financial record intact, so the tenant's own accounts stay accurate. This mirrors GDPR Article 17(3)(b), which permits refusing full erasure where it conflicts with a legal retention obligation.

9. Your rights

If we are the controller of your data (Section 3), UK GDPR gives you the right to access, correct, delete, restrict, or export your data, and to object to how we use it. Contact hello@manufacturerp.co.uk to exercise any of these.

If a tenant is the controller of your data (Section 4), exercise these rights with that company directly — we'll support them in fulfilling your request, but we can't act on it ourselves without their instruction.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. International transfers

Our core database is hosted in the UK. Some sub-processors (Section 6) may process data outside the UK — where they do, we rely on their own standard contractual clauses or equivalent safeguards recognised under UK GDPR.

11. Security

Every tenant's data is isolated at the database level, so one company can never query another's records. Staff access is scoped by role, sensitive credentials (e.g. connected bookkeeping/calendar accounts) are encrypted at rest via Supabase Vault, and payment details are handled entirely by GoCardless. No system is perfectly secure, but we design for isolation and least-privilege access by default rather than as an afterthought.

12. Children

ManufacturERP is business software intended for use by adults acting on behalf of a company. It is not directed at, and we do not knowingly collect data from, children.

13. Changes to this policy

We may update this policy from time to time; the "last updated" date at the top will always reflect the latest version. Material changes will be notified to tenant admins by email.

14. Contact us

Questions about this policy, or a data request: hello@manufacturerp.co.uk.