Cue by Manus Privacy Review: Safe for Freelancer Client Work?

Short answer: Cue by Manus gives each AI agent its own email address, phone number, wallet, and cloud computer, and lets incoming emails or Slack messages trigger those agents with no human check in between. Our verdict is AVOID FOR CLIENT WORK until Manus publishes Cue-specific data controls and approval settings. Policy reviewed October 2026, six days after launch. Cue arrived on September 28, 2026 alongside Manus 2.0, as an invite-only app for web, desktop, and mobile. It plugs into Gmail, Slack, Notion, Dropbox, GitHub, and your calendar. For a solo consultant, that is a helper that can answer calls, send messages, and pay for things while you work. It is also a new identity that speaks for you to people your clients trust. Here is how we vet privacy claims before any tool gets a verdict.

What Cue by Manus does with your data

Privacy at a glance

Privacy dimension	Cue by Manus’ answer
Trains on your data?	De-identified data may improve Manus models
Training opt-out	Email request, only in some jurisdictions
Data retention	Until you delete; erased within 30 days after
Third-party sharing	AI providers, merchants, ad and analytics vendors
Storage region	Singapore company; transfers to US and elsewhere
Enterprise-team tier	Team plan from $20 per seat, processor role
Connector disconnect	Stops new access, keeps already-retained content

Cue does not have its own privacy policy. It runs under the main Manus policy, which was last updated on September 28, 2026, the same day Cue launched. The controller is Butterfly Effect Pte. Ltd., a company incorporated in Singapore (per Manus’ privacy policy, retrieved 2026-10-04). The page renders only through JavaScript, so we captured it with a full browser rather than a plain download.

What gets collected is broad. Beyond account and device details, Manus lists everything you type or upload, files, voice clips, and saved logins for third-party accounts. When an agent calls or messages someone for you, the policy covers that person’s contact details plus the message content, call audio, recordings, transcripts, and summaries. Purchases add merchant, delivery, and payment-method details.

Where it goes: your prompts are passed to third-party AI providers that generate the answers, and those providers may infer things about you. Manus also shares data with hosting, support, and analytics vendors, with merchants when an agent buys something, and with marketing partners for ad measurement. A California notice even mentions sharing identifiers to promote Meta products, a leftover from the period before Beijing blocked Meta’s $2 billion acquisition.

Retention depends on the feature. Cloud sandbox files expire after 7 days of inactivity on free plans and 21 days on paid plans. Task logs are kept so runs can be replayed. Memory, when switched on, is shared with other agents acting for you. Account deletion is requested by email, and Manus says it erases data within 30 days, except for legal holds, abuse cases, and payment records.

On training, Manus says it may turn your data into de-identified or aggregated form and use it to develop its models. The opt-out is an email request, offered only where local law requires it.

What this means for solo freelancers

Cue’s own coverage notes that the launch announcement skips the details that matter most: how individual payments get approved, how you limit what an agent does with its phone and email identity, and how you review its actions afterward (per Runtime Wire and The Next Web, both published 2026-09-28). Here is what could go wrong if you bring client work into it.

If you let a client inbox trigger an agent, any sender can try to steer it. Manus 2.0 added automations that fire on new emails, Slack messages, Notion updates, and calendar events, with no approval step between the message arriving and the agent acting (per Beri, published 2026-10-02). Days earlier, Salt Labs showed that a single crafted email could make a Manus agent run code and expose stored tokens for connected Gmail, Dropbox, and GitHub accounts. Meta’s bug bounty team patched it; Manus itself did not respond to the researchers (per Dark Reading’s report on the Salt Labs findings, September 2026).

If your agent calls or emails a client, you create records about them. Call audio, transcripts, and the client’s contact details go onto Manus servers under the policy. Your client never agreed to that, and some US states require all-party consent before a call is recorded.

If an EU client asks you to erase their data, you may not be able to prove it happened. Disconnecting a connector stops new reads but does not delete content already sitting in conversations, task files, or memory. Based on the policy as written, Manus is the controller for personal plans and may move data to the US or Singapore, neither of which has an EU adequacy decision. That leaves you with a hard question about who is responsible for what, and no data processing agreement on a personal account to settle it.

If an agent pays a vendor, the trail lives with Manus. Merchant details, order data, and transaction results are kept for accounting and dispute purposes even after you delete your account.

How to use it safely

If you still want to test Cue, keep it in a sandbox that cannot touch client material.

1. Use a separate Manus account for personal errands. Do not sign in with the Google account that holds client mail. Register with a fresh address, such as a Proton Pass alias, so the agent’s world has no link to your business identity.
2. Leave work connectors off. In Settings, open Connectors and leave Gmail, Slack, Notion, Dropbox, and GitHub off for any workspace that contains client files. If you already connected them, revoke access there and then ask the agent to delete the related task files and memory.
3. Turn off email-triggered automations. Under Automations, delete any trigger that fires on new email or Slack messages. Run tasks by hand only, so you review the input before the agent reads it.
4. Set the smallest possible wallet budget. Set the payment budget to a figure you would not mind losing, and never attach a business card.
5. Keep the agent’s phone number away from clients. Do not hand it out or let it place calls to client contacts.
6. Disable memory for test tasks. With memory on, details carry across agents and tasks.
7. Opt out of ad sharing. Open “Ads About Manus” in Settings and switch it off; turn on Global Privacy Control in your browser.
8. Request deletion in writing when you stop. Email privacy@manus.im and keep the reply as your record.

Privacy-friendlier alternatives

For client work, the closest safe substitute is to split Cue’s jobs among tools with clearer data terms. If you truly need a delegated agent for a team, Manus’ own Team plan makes Manus a processor and bars model providers from training on that data (per Beri, 2026-10-02), but it still lacks a published data region. These options cover most solo setups.

• Codync: an open-source project that pitches itself as an alternative to Muse and Dots. It runs coding agents as named bots on your own machine and lets you approve their work from your phone, with end-to-end encryption. What it gives you that Cue doesn’t: the agent and its credentials stay on hardware you control. Free and MIT-licensed; you pay only for the model you plug in. Best for freelance developers.
• Lumo by Proton: Proton’s assistant keeps no chat logs and does not train on your conversations, under Swiss jurisdiction. What it gives you that Cue doesn’t: drafting and summarizing without handing over an inbox or a wallet. It will not place calls or buy things. Free tier, with Lumo Plus at roughly $10 to $13 per month. Best for writers and consultants.
• Proton Pass: unlimited hide-my-email aliases on paid plans, so any service or agent you test gets a throwaway address instead of your real one. What it gives you that Cue doesn’t: a separate identity you can switch off in one click without touching client mail. Free plan with 10 aliases; Pass Plus runs about $2 to $5 per month. Best for anyone who signs up for a lot of AI tools.
• Bitwarden or 1Password: if any agent logs in for you, keep those logins in a dedicated vault you can rotate in seconds. What they give you that Cue doesn’t: an audit trail and credential control that live outside the agent platform. Bitwarden Premium is under $20 a year; 1Password individual plans run about $36 a year. Best for freelancers who manage several client systems.

For a closer look at the same always-on agent pattern from OpenAI, see our OpenAI Dots privacy review. If browser agents are your main use case, our Airtop AI privacy review covers the risks of cloud-run browsing.

The verdict

Frequently asked questions

Does Cue by Manus train on my data?

Manus says it may turn your personal information into de-identified or aggregated data and use it to develop and improve its models. The policy offers an opt-out by email only where local law gives you that right, and there is no Cue-specific training toggle documented as of October 2026. For Team and Enterprise plans, Manus says model providers are barred from training on customer data. Personal accounts get no such promise.

Is Cue by Manus GDPR-friendly for EU client work?

Based on the policy as written, Butterfly Effect in Singapore is the controller for personal accounts, and data may move to the US or Singapore under contract safeguards or your consent. Disconnecting a connector does not delete content already retained, and full deletion requires an email request. That makes honoring an EU client’s erasure request hard to document. Only a Team plan puts Manus in a processor role.

Can I use Cue by Manus for HIPAA data?

We would not. The policy covers health data you type, upload, or reach through connected accounts, and it describes encryption and limited staff access for that data. But nothing in the policy or the launch coverage mentions a Business Associate Agreement. Based on the policy as written, patient information from a connected inbox or calendar would be processed without one. Keep any health-related client work out of Cue entirely.

Can a Cue agent spend money or call people without asking me?

Partly. You set a payment budget and the agent can spend inside it, and agents can send messages, take calls, and leave summaries. Launch coverage notes that Manus has not explained how individual transactions are approved or how to limit what an agent does with its phone and email identity. Treat the budget as the only real limit and keep it small.

What happens to client data if I disconnect Gmail or Slack from Cue?

The agent loses future access right away, but anything it already pulled in stays in conversations, task files, object storage, or memory. Those copies follow the general retention rules, which keep data until you delete it. To remove it, delete the specific tasks and memory, or email privacy@manus.im to close the account; Manus says erasure completes within 30 days.

Was the Manus prompt-injection flaw fixed?

Yes. Salt Labs showed a hidden instruction inside an email could make a Manus agent run code and reveal stored tokens for connected Gmail, Dropbox, and GitHub accounts. Meta’s bug bounty program confirmed and patched it, and reproduction attempts failed afterward. Manus did not reply to the researchers, though. Email-triggered automations launched days later, so the same class of attack still deserves caution.

Sources

• Manus Privacy Policy (last updated 2026-09-28) (retrieved 2026-10-04)
• Product Hunt, Cue by Manus (retrieved 2026-10-04)
• The Next Web, Manus 2.0 and Cue give AI agents their own email, phone and wallet (published 2026-09-28, retrieved 2026-10-04)
• Runtime Wire, Manus gives Cue agents phone numbers, wallets and computers (published 2026-09-28, retrieved 2026-10-04)
• Implicator, Manus launches Cue agents with phone numbers and wallets (published 2026-09-28, retrieved 2026-10-04)
• Beri, Manus 2.0 lets email trigger agents days after an email hijack bug (published 2026-10-02, retrieved 2026-10-04)
• Dark Reading, Prompt-injection bug hits agentic AI app Manus (retrieved 2026-10-04)

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of October 4, 2026.