Manus

Manus explicitly disclaims ownership of user inputs, prompts, and files, confirming the user retains all right, title, and interest in their content. This is a user-favorable position, though it is qualified by a broad license grant (see Category 3).

The user owns AI-generated outputs, which is favorable, but Manus warns outputs may not be unique across users and makes no representation that outputs are protectable by intellectual property law. Outputs may also carry a non-removable 'Made with Manus' watermark, limiting exclusivity and commercial control.

Manus grants itself a perpetual and irrevocable license to use 'Your Content' in an aggregated manner to improve the Services and create Usage Data. While framed as aggregated improvement, this perpetual/irrevocable scope and the absence of a clear opt-out from model improvement is vendor-favorable and a notable risk for proprietary data.

The Terms state Manus has no obligation to store user content and no liability for deletion, and the perpetual/irrevocable improvement license suggests aggregated data may persist after account deletion. The privacy policy references a 'Retention' section but the provided excerpt does not disclose specific retention schedules, deletion SLAs, or regulated audit-log retention obligations, leaving this topic largely unspecified.

Manus discloses sharing user inputs with third-party AI providers to generate outputs and with payment processors (Stripe, RevenueCat) — sharing that is integral to the core service. However, it warns these AI providers may not maintain confidentiality and may retain rights to use or disclose content, and the policy excerpt does not fully confirm no selling to advertisers/data brokers, warranting moderate concern.

The policy references a 'Your choices' section and provides explicit opt-out mechanisms for marketing communications, automatic subscription renewal, arbitration (within 30 days), and Local Access Features. However, there is no clear opt-out from the perpetual content-improvement license or from sharing inputs with third-party AI providers, which limits control over the most sensitive uses.

The privacy policy references GDPR/UK compliance (Notice to European Users), California (CCPA/CPRA), South Korea, Japan, and Singapore regimes, and the Terms reference a Data Processing Agreement, indicating awareness of major privacy laws. However, no third-party security certifications (SOC 2, ISO 27001, HIPAA, FedRAMP, NIST) are claimed or evidenced in the provided documents, and HIPAA data is explicitly prohibited rather than supported.

The documents provide an AI disclaimer acknowledging probabilistic limitations, bias, and inaccuracy, but offer no transparency mechanisms, enterprise audit rights, or explainability features. The policy is effectively silent on model auditability for individual users; such rights may exist only under the separate Master Services Agreement for Team/Enterprise plans.

The privacy policy includes a 'Security' section heading and a help-center article on data safety, indicating some security disclosure, but the provided excerpt does not detail specific controls (encryption at rest/in transit, penetration testing, bug bounty, incident response) or any breach history. The Terms explicitly disclaim warranties of security, and no dedicated trust center is clearly referenced.

Material differences exist between consumer and enterprise tiers: the consumer Terms of Use govern individuals, while Team Plan, APIs, and business use are governed by a separate Master Services Agreement and Data Processing Agreement that prevails. Under enterprise use, Manus may act as a data processor following customer instructions, but the favorable enterprise terms are not detailed in the provided documents, creating uncertainty for free/consumer users.

Manus reserves the right to access and use 'Your Content' to monitor compliance with the Terms, which implies potential human or automated review of inputs and outputs. Combined with sharing inputs to third-party AI providers, users should not assume confidentiality of submitted prompts.

The Terms impose binding individual arbitration with class-action and jury-trial waivers for US users (via NAM, with batch arbitration provisions) and SIAC arbitration in Singapore for other users, with Singapore governing law. The documents do not specifically address government data requests or law enforcement cooperation, but the DMCA process and broad indemnification obligations shift legal exposure substantially onto the user.

Manus collects significant PII including contact data, profile data, communications, transactional data, inputs/prompts with metadata and location info, and third-party login data. It explicitly asks users NOT to submit sensitive personal information and prohibits SPI in content, but acknowledges it may derive data from images/audio that some may consider biometric, creating residual SPI risk that is disclosed but not fully controlled.