Legal
Data Processing Agreement
Company number and registered address will be added when registration in England and Wales completes. This page is in English for now. A translation is coming.
Mondaily is provided by Mondaily Ltd, a company being registered in England and Wales. Its company number and registered address will be shown here once registration is complete.
Last updated: 9 November 2026. When Mondaily processes personal data on behalf of a business, this agreement applies, under GDPR and UK GDPR Article 28: the business is the controller and we are the processor. It covers what we process, our commitments, sub-processors (listed below), deletion, breach notices and transfers.
To request a DPA, email privacy@mondaily.com with your workspace name; we'll send a copy for signature within one business day.
What is processed
- Subject matter and nature: hosting and running Mondaily for the business: storing its workspace records, files and connected mail and calendars, running the agents it sets up and sending what a person approves.
- Duration: as long as your account or contract runs, then until the data is deleted as described below.
- Types of personal data: contact details, messages, meeting notes, files, notes about people and companies, deal and invoice records, and usage data.
- People the data is about: the business's own people, its customers, suppliers, leads, investors and other contacts.
What we commit to
- We process the data only on your documented instructions, which are these terms and the settings you choose in Mondaily, including for any transfer outside the UK or the EU. If we think an instruction breaks data protection law, we tell you.
- Everyone at Mondaily who can reach the data is bound to confidentiality.
- We keep the data secure: encryption in transit, encrypted tokens, isolation per workspace, approval before anything is sent outside, logged access, and encrypted backups in the EU and Switzerland.
- You give general written permission for the subprocessors on the Subprocessors page. We tell you at least 30 days before adding or replacing one, so you can object; if we cannot meet a reasonable objection, you can end the affected service and get a refund of any prepaid period. Each subprocessor is bound by written terms that protect the data at least as much as these, and we remain responsible for it.
- We help you answer requests from the people the data is about, and with security, breach notices, impact assessments and consultations with an authority.
- We tell you without undue delay, and aim to within 48 hours, after we learn of a personal data breach that affects your data, with what we know and what we are doing about it.
- When the contract ends, you can export the data, and we then delete it within 30 days of the account being erased, and from backups as they expire (35 days at most), unless the law requires us to keep it. We confirm this on request.
- We give you the information you need to check we keep these commitments, and allow audits by you or an auditor you choose, with reasonable notice, at most once a year unless there was a breach or an authority asks.
Transfers
Mondaily's database and the machines we run are in Frankfurt, Germany, with an encrypted backup copy in Switzerland. Where a subprocessor may process data outside the UK or the EU, the transfer relies on an adequacy decision (such as the EU and US Data Privacy Framework and its UK Extension for a provider that has joined it) or on the European Commission's standard contractual clauses (Decision (EU) 2021/914), with the UK International Data Transfer Addendum for UK data. Those clauses are part of this agreement where they are needed.
For data from the DIFC, ADGM, the United Arab Emirates, Saudi Arabia or Qatar, the same safeguards are used under the transfer rules of those laws, and we follow their processor rules as well.
If terms conflict
If this agreement and the standard contractual clauses conflict, the clauses win. If this agreement and the Terms of service conflict on personal data, this agreement wins.
Sub-processors
These third parties process customer personal data on Mondaily's behalf. Some are used for every workspace; others only when you use the feature named. Where a provider may process data outside the EU, the entry says so.
No AI vendor processes your data for Mondaily. sōtem (AI), web scraping, transcription and embeddings are built to run only on servers Mondaily operates. Until those servers are in service, these features are not available; it never falls back to a third party. The Prospecting Agent looks businesses up in the public data sources listed below, sending them search words only.
Your own AI key: if your workspace chooses to connect its own key for a hosted AI provider, sōtem sends masked chat text and tool results to the provider you chose, under your own agreement with that provider. That provider is not a Mondaily sub-processor; only an owner or admin can turn this on, and an owner can lock it off.
Your own business tools: if an owner or admin connects your workspace's HubSpot account, Mondaily reads your contacts, companies, deals and owner names from it into your workspace. It changes a HubSpot record only when a person in your workspace approves that exact change in the Decision Queue, and then sends only the approved values for that record; it never overwrites a value someone changed in HubSpot since the last sync. If an owner or admin connects your Xero or QuickBooks Online books, Mondaily reads your invoices, payments, bills, expenses, customers and suppliers from them and never changes anything there. Each of these is your own tool, used under your own agreement with its provider; it is not a Mondaily sub-processor. Disconnecting stops the reading and gives up Mondaily's access.
Core platform: hosted in the EU (Frankfurt)
Mondaily runs the application and stores your data in the EU (Frankfurt), on infrastructure from these two providers.
Vercel: Hosting for the web app, the API and this website.
Data: All data passing through the service while it is served.
Where: EU: the API runs in Frankfurt (fra1); public web pages are cached on Vercel's global edge network.
Used: Always.
Supabase: Database and file storage, including call recordings.
Data: Account and workspace data, files and recordings, including sōtem Studio clips, voice-cloning consents and voice history.
Where: EU: Frankfurt.
Used: Always.
Amazon Web Services (machines Mondaily runs): Our operations machine (incoming mail, outgoing mail through Amazon SES, our own web search and search memory), the nightly database backup (Amazon S3) and our own AI engine.
Data: Email Mondaily sends and receives for you; search words; a full encrypted copy of the database in the backup; chat text the engine answers from, where our own engine serves your workspace.
Where: EU: Frankfurt, Germany (AWS eu-central-1).
Used: Always for mail and backups; search and the engine when you use them.
Infomaniak (Swiss Backup): A second, encrypted copy of the nightly database backup.
Data: An encrypted copy of the whole database; the storage provider cannot read it without our key.
Where: Switzerland (outside the EU, with an EU adequacy decision).
Used: Every night; each copy is kept 35 days.
Temporary providers (planned to be replaced)
We plan to replace each of these with a service Mondaily runs itself. Until then they are in use as described here. When we switch, we run ours in parallel first, switch over, then turn theirs off.
Inngest (Inngest Cloud): Runs background jobs: scheduled agents, record enrichment, reminders.
Data: Job payloads, which can include the content of workspace records.
Where: Inngest's cloud; region set by the provider, may be outside the EU.
Used: Always.
Plan: Our own job runner on a Mondaily server (a configuration switch, run in parallel first).
Resend: Backup delivery of account and notification email, and email your workspace sends.
Data: Sender and recipient addresses, subject and message body.
Where: Resend's cloud; region set by the provider, may be outside the EU.
Used: Only when our own mail server on AWS in Frankfurt (Amazon SES) cannot take a message; Mondaily sends through that server first.
Plan: Our own mail server already sends first (since 7 November 2026); Resend stays as the fallback while its reputation builds, then is removed.
Amazon Web Services (AWS Lambda): Opens your proven website in a real browser for yof's website check (read-only: it loads pages, it never submits a form or signs in).
Data: The address of your proven site and the public pages the browser loads; the findings come straight back to us. Error logs, which can include the site address, are kept for 14 days.
Where: Frankfurt, Germany (AWS region eu-central-1, where our stack is deployed).
Used: Only when a yof website check runs.
Plan: The same browser code on a server Mondaily runs itself.
LiveKit (LiveKit Cloud): Real-time audio and video for calls; records a call when someone in it starts recording.
Data: Call audio and video, participant display names; recordings are written to our storage at Supabase (EU).
Where: LiveKit's cloud: calls connect through servers near the participants, and LiveKit keeps the call records for our project in the United States.
Used: Only when you use calls.
Plan: Our own LiveKit and TURN servers in Europe, after launch.
Optional: only when you choose it
Nothing is sent unless you sign in with or connect the account yourself; you can disconnect at any time.
sōtem Studio engine (run by Mondaily, not a third party): Text to speech, speech to text and the other sōtem Studio models, run by Mondaily, no outside AI provider.
Data: Text to be spoken, audio to be transcribed, and consented voice references.
Where: Not in use yet: no voice data is processed here today. Its location is listed here before any is.
Used: Only when you use sōtem Studio.
Google (Sign in with Google, Gmail, Google Calendar): Optional sign-in with Google, and the optional Gmail and Google Calendar connector.
Data: Sign-in: your name, email address and Google account ID. Connector: the email and calendar data you authorize.
Where: Google's cloud; region set by the provider.
Used: Only if you sign in with Google or connect a Google account.
Microsoft (Sign in with Microsoft, Outlook mail and calendar): Optional sign-in with a Microsoft account, and the optional Outlook mail and calendar connector.
Data: Sign-in: your name, email address and Microsoft account ID. Connector: the email and calendar data you authorize.
Where: Microsoft's cloud; region set by the provider.
Used: Only if you sign in with Microsoft or connect a Microsoft account.
LinkedIn: Optional LinkedIn connection: sign in with your own LinkedIn account and publish posts you approve.
Data: Only for users who connect their own LinkedIn account: we receive your LinkedIn name, profile picture link, email address and member ID, and we send only the posts you approve; the exact text and visibility you confirmed.
Where: LinkedIn's cloud; region set by the provider.
Used: Only if you connect your own LinkedIn account; a post is sent only after you click Confirm.
X: Optional X connection for Social: publish posts you approve.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: X's cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
Meta (Facebook, Instagram, Threads): Optional Facebook Page, Instagram and Threads connections for Social: publish posts you approve.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: Meta (Facebook, Instagram, Threads)'s cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
TikTok: Optional TikTok connection for Social: publish videos and photos you approve.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: TikTok's cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
Google (YouTube, Business Profile): Optional YouTube and Google Business Profile connections for Social: publish uploads and updates you approve.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: Google (YouTube, Business Profile)'s cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
Pinterest: Optional Pinterest connection for Social: publish pins you approve.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: Pinterest's cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
Telegram: Optional Telegram channel connection for Social: publish posts you approve through Mondaily's bot.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: Telegram's cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
Bluesky: Optional Bluesky connection for Social: publish posts you approve.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: Bluesky's cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
Mastodon (your chosen server): Optional Mastodon connection for Social: publish posts you approve on the server you choose.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: Mastodon (your chosen server)'s cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
Snapchat: Optional Snapchat connection for Social (only after Snap grants partner access): publish stories you approve.
Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.
Where: Snapchat's cloud; region set by the provider.
Used: Only if you connect your own account; a post is sent only after you confirm that exact post.
PayPal: sōtem Data Lab: paying contributors for approved work.
Data: Only for Data Lab contributors who request a payout: the PayPal email address they gave us and the amount. No customer workspace data is sent.
Where: PayPal's cloud; region set by the provider.
Used: Only when a Mondaily administrator sends a contributor's requested payout.
Payments: Stripe, we never see or store card numbers
Used only when you buy something.
Stripe: Payment processing.
Data: Billing name, email address and payment details. Card numbers are entered into Stripe's own form and go straight to Stripe. Mondaily never sees or stores them.
Where: Stripe's cloud; region set by the provider.
Used: Only when you buy a plan or credits.
Public data sources (the Prospecting Agent)
The Prospecting Agent in sōtem Team finds companies in public, openly licensed data and checks each one in official registers. These services are not sub-processors: they receive only search words (an industry, a city or country, a date range, a company's public job board name) or a found company's public name, legal number or website domain, never your records, contacts or any personal data. We show each source's credit next to the results it gave.
The companies' own websites
Receives: A request for a public page of a company that our web search found (its robots.txt is read first, and a site that says no is not read).
We take: Only what the company publishes about itself: its name, industry, address, phone and business email, each with the page it came from.
Licence: Public pages, read under each site's robots.txt (RFC 9309); the content stays the company's own. Terms
TED, the EU's public tenders journal
Receives: A procurement category code, a country and a date range.
We take: Open calls for tender: buyer, title, dates and the notice link.
Licence: EU open data, free reuse with credit (Commission Decision 2011/833/EU); credit: Source: TED. Terms
GDELT news index
Receives: Industry and place words.
We take: Links, headlines and dates of public news about funding or expansion.
Licence: Free reuse with citation; credit: News index: The GDELT Project. Terms
Wikidata
Receives: A country, or an industry and a city.
We take: Organisation names and their official websites.
Licence: CC0 1.0 (public domain); credit: Data from Wikidata. Terms
Greenhouse and Lever public job boards
Receives: The public job board name a company links from its own careers page.
We take: Open role titles, locations and links the company published.
Licence: Public job-board APIs, no account needed; the company's own published postings. Terms
Official company registers (UK, France, Norway, Denmark, Poland, US) and GLEIF
Receives: A found company's public name and town, or the legal number it publishes on its own site (company number, SIREN, org number, CVR, KRS, NIP, LEI).
We take: Whether it is active, its legal form, registered address, industry code and named officers. Companies that opted out of marketing in their register (France, Denmark) are never used.
Licence: Companies House and Contracts Finder: Open Government Licence v3.0; SIRENE: Licence Ouverte 2.0; Brønnøysund: NLOD 2.0; CVR and KRS / CEIDG: their public register terms; SEC EDGAR: US public domain; GLEIF: CC0 1.0. Terms
Public contract awards and certificate logs
Receives: A found company's public name (TED, UK Contracts Finder, SAM.gov) or its website domain (crt.sh).
We take: Public contracts the company won, and the date its domain got its first certificate (a new website), each with its link and date.
Licence: TED: EU open data with credit; Contracts Finder: Open Government Licence v3.0; SAM.gov: US public domain; Certificate Transparency: public log data. Terms
Common Crawl
Receives: A found company's own website domain.
We take: A few archived pages of that company's own site, read only for the contact details it published itself, dated by the crawl.
Licence: Common Crawl Terms of Use; the page content stays the company's own. Terms
Brave Search (only if switched on)
Receives: Search words, with private details (emails, phone numbers, ids, bank and card numbers) removed first; when enriching a company record, that company's name. Never people's names. Used as the backup for the Prospecting Agent, sōtem chat web search and research, and record enrichment, only while Mondaily's own web search is not available and the workspace allows it.
We take: Links to public web pages; we keep none of its results. Brave keeps query logs for up to 90 days (its API privacy notice: https://api-dashboard.search.brave.com/privacy-policy).
Licence: Brave Search API terms. Terms
This page is the current list. We add a provider here before it receives any customer data, and the "Last updated" date changes with every change. Customers with a signed DPA can ask privacy@mondaily.com for the list at any time.