Privacy policy

English translation for convenience. The German version (Datenschutzerklärung) is the binding one.

Last updated: October 23, 2026

1. Controller

Manning Labs LLC, represented by Nicholas Manning, 155 Federal Street, Boston, MA 02110, USA, email: [email protected]. More details are in the legal notice.

Manning Labs LLC is based in the USA. Because we offer our service to people in the EU, the GDPR applies to how we process your data (Art. 3(2) GDPR). We store your data on servers in Germany (see Hosting). For questions about data protection and to use your rights, reach us at the email address above or through the contact form.

2. Hosting

This website runs on servers in Germany at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. When you visit the website, the server processes technically necessary data (IP address, time, page visited, browser). The legal basis is Art. 6(1)(f) GDPR (secure and stable operation). We have a data processing agreement with Hetzner.

3. Cookies

We don't use cookies for analytics or advertising. Only when you sign in do we store a technically necessary cookie for your session (§ 25(2) no. 2 TDDDG). No consent is needed for this.

4. Analytics

We use PostHog (PostHog Inc., data processed in the EU) without cookies and without storing anything in your browser, to count which pages are visited. When you are signed in, we also count which features are used (for example "export opened"). We send these events with a pseudonymous ID calculated from your email address with a secret key; PostHog never receives your email address itself or anything you type in. The legal basis is Art. 6(1)(f) GDPR (we want to understand which features help).

5. Newsletter and emails

When you sign up for the newsletter (via the "Newsletter" link at the bottom of every page or in your account), we store your email address, the wording of your consent, the time and your IP address. We then send you an email in which you confirm your signup (double opt-in); we also store the time and IP address of the confirmation. This lets us prove that you consented. If you don't confirm within 30 days, we delete your signup.

Only after you confirm do we pass your email address to Sender (UAB "Sender.net", Lithuania), which we use to send our emails. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time, for example with the unsubscribe link in every email.

We send confirmation and sign-in links and system messages through Postmark (ActiveCampaign, LLC, USA). The transfer to the USA is based on the EU-U.S. Data Privacy Framework or standard contractual clauses.

6. The app (test phase)

FirstSix is currently a test version. Please enter only made-up data and no data about real employees. We grant access one person at a time.

For your account we store your email address and, if you provide them, your name and your settings (language, reminders, whether you have read the probation guide). For each organization you create or belong to, we store its name if you give one and its settings: federal state, works council, competencies, schedules and texts for hires. On top of that comes what you create in the app: hires, roles, goals, check-ins and their revisions. For traceability we log actions such as sign-in, export or deletion with the time, without any content. The legal basis is Art. 6(1)(b) GDPR (providing the app).

We send sign-in links and reminders by email through Postmark (see above). Reminders contain no content from your entries.

AI check (beta). If we switch on the AI check for your account, it checks the wording of a check-in or the final review when you save it, never the person. For this we send the text, the goals and earlier check-ins of that hire to Mistral AI SAS (Paris, France) as a processor. Before that we remove the person's name, email addresses, phone numbers and dates of birth. Mistral processes the data on Microsoft and Google servers in the EU; under Mistral's terms a transfer to third countries is possible and is then covered by standard contractual clauses. Mistral doesn't use the data for training. We store the result with the entry and delete it with the entry. The legal basis is Art. 6(1)(b) GDPR. The check makes no decisions about people (Art. 22 GDPR); you decide.

Wins (for invited employees). If your manager invites you to write down your wins, we create an account for you and, at your manager's request, send you an invitation by email. We store your email address (entered by your manager), your language, your name if you give it, and your wins (text and links). Your wins are private: your manager sees only the ones you share, never drafts, unshared wins or how many there are. You can stop sharing at any time. If your manager has the AI check, you can have the writing of a win checked; for that we send only the text, without your name, email addresses and phone numbers, to Mistral AI as described above. The check never rates you or your work. Under "Account" you can export your wins and delete your account with all your wins at once, shared ones too. If your manager removes your access, your wins stay with you and your manager no longer sees any. The legal basis is Art. 6(1)(b) GDPR, and for the invitation Art. 6(1)(f) GDPR (legitimate interest in telling you about the feature).

You can export all your data at any time under "Account" and delete your account there; we delete it 14 days after your request. We delete the entries for a hire automatically after the retention period you set under "Account" (6 to 36 months after the end of probation).

7. Contact

When you write to us through the contact form or by email, we process your email address, your name (if given) and your message in order to reply. Messages from the form are sent to our inbox through Postmark and are not stored in FirstSix. The legal basis is Art. 6(1)(f) GDPR, or (b) for enquiries about a contract. We delete the message once your request is dealt with and no retention obligation applies.

8. Payments

We handle payments through Stripe (Stripe Payments Europe Ltd., Ireland). Stripe processes the data needed for this as an independent controller or as a processor. The legal basis is Art. 6(1)(b) GDPR.

9. Error monitoring

To find errors, we use Sentry (Functional Software, Inc., USA). When an error occurs, technical data is sent (for example browser, page visited). The legal basis is Art. 6(1)(f) GDPR; the transfer is based on standard contractual clauses.

10. Video

The video on our home page is hosted by Vimeo (Vimeo.com, Inc., USA). It only loads when you click "Play". Only then is a connection made to Vimeo and your IP address sent to Vimeo. We embed the video with the "Do Not Track" setting. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR).

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to withdraw any consent you have given. You can also lodge a complaint with a data protection supervisory authority.

12. Storage period

We keep your data only as long as needed for the purpose in question or as required by legal retention obligations.