Privacy Policy

On this website (www.mondaily.com) analytics is opt-in. Nothing is measured until you press Accept in the privacy banner. If you press Decline, close the banner, or have not chosen yet, nothing is sent. Your choice is kept in your own browser's local storage on this site (not a cookie, and never sent to us), and you can change it at any time with Privacy choices; the same link is at the bottom of every page. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded even if you accepted.

If you accept, the site sends small first-party measurements to Mondaily itself. No third-party analytics or advertising service is involved, and no analytics cookie is used. We record the page path (never the query string; ids and links in paths are masked), the referring website's domain, the country, region and city that our hosting provider infers from the request (we never derive them from your IP address ourselves), the general type of device (phone, tablet or computer, worked out from your browser's description, which itself is not stored), a short heartbeat every 30 seconds while the tab is visible so we can see how many people are online, and how you move through a page: the text and link of what you click, how far you scroll, when you start or send one of our forms (the form's name only, never what you typed), and how long you stayed on a page.

Your IP address is kept for 7 days, for security (to recognise abuse and attacks), and then deleted automatically. It is visible only to Mondaily's own platform administrators. Visitors are otherwise counted with a one-way hash of the IP address and browser that is mixed with a random value which changes every day and is then deleted, so you cannot be recognised from one day to the next from that hash alone.

Visitor id. When you accept, your browser creates a random visitor id (it contains nothing about you) and keeps it in local storage on this site, so we can tell that a visit is a return visit. Declining removes it. Identity is linked only when you give it to us: in the app your page views are linked to your account once you sign in. We never buy or look up identity from anywhere else.

In the Mondaily app (app.mondaily.com), which you use with an account, the same measurement runs as part of operating the service you signed up for, and page views in the app are linked to your account. Do Not Track or Global Privacy Control switch it off there too, and so does “Do not measure my use of the app” under Privacy in your account settings. Individual page views and moves are deleted after 90 days; only daily totals are kept.

Individual page views and moves are deleted after 90 days. If you accepted measurement on our websites, we also keep a visitor record: when you first and last visited, how many visits and page views, and your country, region and city. It is deleted 400 days after your last visit. While your page views exist we work out an interest score from them to decide whom to follow up with; the score is saved only if we file you as a lead. If you create an account, the id of your visitor record is stored with the account, so we know which visit led to the sign-up.

Mondaily is provided by Mondaily Ltd, a company being registered in England and Wales. Its company number and registered address will be shown here once registration is complete.

For your account, billing and our own contact with you, we are the controller. For the records your workspace keeps about other people (contacts, companies, deals, messages), your business is the controller and we act as its processor under the Data processing agreement. Privacy questions and requests: privacy@mondaily.com. We have not appointed a data protection officer; privacy@mondaily.com reaches the person responsible for privacy.

• To provide Mondaily: your account, workspace, agents, connections and support: needed for our contract with you (GDPR and UK GDPR Art. 6(1)(b)).
• To bill a paid plan and keep tax records: a legal duty (Art. 6(1)(c)).
• To keep Mondaily secure and stop abuse: rate limits, sign-in protection, logs, the sign-up checks: our legitimate interest, which we have weighed against your rights (Art. 6(1)(f)); you can object.
• To measure the app so it works and stays fast (page views and a heartbeat, switched off by Do Not Track, Global Privacy Control or the switch in your account settings): our legitimate interest, which we have weighed against your rights (Art. 6(1)(f)); you can object.
• To write to businesses and investors about Mondaily, using business contact details they published (see Business outreach): our legitimate interest, which we have weighed against your rights (Art. 6(1)(f)); you can object.
• Website analytics on www.mondaily.com, training on your data and product news by email: your consent (Art. 6(1)(a)), which you can withdraw at any time.

We sometimes email people at businesses and investment firms about Mondaily. We use only business contact details published by the business itself or listed in public, official or openly licensed sources, and we keep your name, work email, company, role, where we found them and the messages we exchanged.

Every such email names the sender, the company and its postal address, and has a one-click unsubscribe link. If you unsubscribe or object, we stop at once and keep only a one-way hash of your email address so you are not cold emailed through Mondaily again.

We keep these records for 2 years after our last contact, unless you become a customer. To see, correct or erase them, write to privacy@mondaily.com.

This part covers what Mondaily receives from Google when you sign in with Google or connect your Gmail and Google Calendar. You choose to connect them, Google shows you each permission before you agree, and you can disconnect at any time.

What we receive and why. Sign in with Google: your name, email address, Google account id and profile picture, only to create and sign in to your account. Gmail, read: your messages and the list of addresses you send from, so you can read and answer your business email inside Mondaily, see the history with a contact, and so a follow-up stops when the person has already replied or the address bounced. Gmail, send: we send only email a person in your workspace wrote or approved, from your own address, including the steps of an email sequence a person approved. Google Calendar, read: your free and busy times and the list of your calendars, to suggest meeting times and let you pick a calendar, and copies of your own meetings for the days around today, so they can be prepared and followed up. Google Calendar, events: we add the meetings you make in Mondaily to the calendar you chose and keep both in step when one moves or is cancelled. We do not change your calendar settings or sharing, or anyone else's calendar.

Where it is kept and how it is protected. Gmail messages are read from Google when you open your inbox or ask about your mail; we do not keep a copy of your mailbox. We keep only what the features above need: the emails you send through Mondaily (subject, thread, delivery), a thread you link to a record, drafts waiting for your approval, and the copies of your meetings. All of it is stored in our database in Frankfurt, Germany (EU), encrypted at rest, and sent only over encrypted connections. The access tokens Google gives us are encrypted a second time with our own key.

Who can see it. You, and the members of your own workspace: in a Mondaily workspace the mailbox you connect is the workspace's shared inbox, so its members can read it there, and the meetings copied from your calendar show in the workspace calendar. Nobody in another workspace can. We never sell Google user data, never use it for advertising (including personalised or interest-based ads and retargeting), never use it to decide creditworthiness or for lending, and never give it to data brokers or advertising platforms.

Who it is shared with. Only the providers on our Subprocessors page that host, store, back up and run Mondaily, each under a written agreement that limits it to our instructions, and only as needed to run the features above. We would transfer it in a merger or sale of our business only after asking for your consent first. Nobody at Mondaily reads your Google data unless you ask us to and agree (for example in a support request), to investigate a security problem or abuse, or where the law requires it.

AI. When you ask sōtem or an agent about your mail or meetings, the content is processed by our own engine in Frankfurt and is never sent to an outside AI company. The one exception is your choice: if an owner of your workspace connects your own AI provider key (Settings, AI models), what you ask about, which can include mail or calendar content, goes to that provider under your own agreement with it, with names, email addresses and phone numbers masked first. We never use Google user data, or anything derived from it, to develop, improve or train artificial intelligence or machine-learning models, whether general models or models personal to you, and we never transfer it to anyone for that purpose. Training of our own engine, which happens only with a workspace's consent, always leaves out mail and calendar content, from Google or any other mailbox or calendar, and our code checks this before anything is kept or exported.

How long and how to delete it. Disconnecting (Settings, Email) deletes the tokens at once, so Mondaily can no longer read your mail or calendar, and deletes the copies of your calendar events. You can also remove our access in your Google Account at myaccount.google.com/permissions. What you chose to keep in your workspace (sent emails, linked threads, approved drafts) stays until you delete it or the workspace is deleted; to have it deleted, write to privacy@mondaily.com and we do it within one month. Deleting your account or workspace erases it after the 14-day restore window, and backups age out within 35 days.

Mondaily's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google API Services User Data Policy
• Limited Use requirements
• Google Workspace API User Data and Developer Policy

Mondaily's database and the machines we run are in Frankfurt, Germany (EU). The encrypted backup copy is in Switzerland, which the EU and the UK both recognise as giving adequate protection.

Some providers on the Subprocessors page choose their own region and may process data in the United States or another country. For those transfers we rely on one of these safeguards:

• an adequacy decision: for the United States, the EU and US Data Privacy Framework and its UK Extension, where the provider has joined it;
• otherwise the European Commission's standard contractual clauses (Decision (EU) 2021/914), with the UK's International Data Transfer Addendum for data from the UK;
• for data from Saudi Arabia, the United Arab Emirates, Qatar, the DIFC or ADGM, the transfer rules of those laws, which allow transfers to countries with adequate protection or under appropriate safeguards such as these clauses.
• You can ask for a copy of the safeguard that covers a provider: write to privacy@mondaily.com.

• Workspace records, files and messages: until you or your workspace deletes them, or the workspace is deleted.
• Call recordings, transcripts and meeting notes: 12 months after the call, and chat sent during a call 24 months, unless your workspace sets its own period.
• Deleting your account starts a 14-day window in which you can restore it; after it, your personal data is erased as the account deletion steps describe, and workspaces where you are the only owner are erased too.
• Website IP addresses are kept 7 days and individual page views 90 days; only daily totals are kept after that. If you accepted measurement on our websites, a visitor record (first and last visit, number of visits and page views, country, region and city) is kept until 400 days after your last visit.
• Invoices, payments and the records tax law needs are kept for 6 years after the end of the financial year they belong to (UK company and VAT law), then deleted. Support messages are kept for 2 years after the conversation ends.
• Database backups are kept 30 days (AWS, Frankfurt) and 35 days (encrypted copy, Switzerland).

You can ask to see your data and get a copy, correct it, erase it, restrict how we use it, take it with you in a common format, and object to how we use it. You can always object to direct marketing, and we then stop. Where we rely on your consent you can withdraw it at any time; that does not affect what was done before. Write to privacy@mondaily.com.

It costs nothing. We answer within one month, or tell you within that month if we need up to two more months for a complex request. We may ask you to confirm who you are first, and we use that only to answer you.

You can complain to a data protection authority at any time. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EU it is the authority in the country where you live or work, or where you think the problem happened. In Switzerland it is the Federal Data Protection and Information Commissioner. In the United Arab Emirates it is the UAE Data Office, in Saudi Arabia the Saudi Data and AI Authority (SDAIA), in Qatar the National Data Privacy Office, and in the DIFC or ADGM their own Commissioner. We would like the chance to help first, but you do not have to ask us before you complain.

Mondaily makes no decision about you based only on automated processing that has a legal effect on you or affects you in a similarly significant way. Lead scores, deal signals and agent suggestions help a person decide; they are not decisions about you with legal effects, and nothing is sent or changed without a person approving it. Sign-up abuse checks and rate limits can block an action, and a person reviews it if you ask.

If you think an automated step got something wrong about you, write to privacy@mondaily.com and a person will look at it.

Mondaily uses AI. When you chat with it, it is clear that you are talking to an AI, not a person. Drafts an agent writes are marked as drafts and wait for a person to approve them before anything is sent.

AI answers can be wrong. Check an answer before you rely on it, especially for anything legal, financial, medical or about safety.

We send emails you need to use Mondaily: sign-in, security, receipts, trial and renewal reminders, and changes to these terms. You cannot switch these off while you have an account.

We send news about our products only if you said yes, or, if you are a customer, about similar products of ours, with a way to say no when you signed up and in every message. Every such email names us, has our postal address once the company is registered, and has a one-click unsubscribe link that works for at least 30 days. We stop within 10 business days at the latest, usually at once.

A workspace can switch on open and click measurement for the email its members send from the inbox in Mondaily. It is off unless an owner or admin of that workspace switches it on in the email settings.

While it is on, each such email carries a small invisible image, and its links pass through our server before they open. We record the time of each opening of the email and, for each link clicked, the link's address and the time. We do not store the reader's IP address, device or location with these records.

The records are kept with the sent email in the workspace and are deleted with it or with the workspace. The business that sent the email is the controller: it decides whether to switch this on and is responsible for telling the people it writes to where the law asks for that. Emails sent by sequences and by business outreach carry no such image, and their links are not changed.

Mondaily is not meant for children. You must be at least 16, or older where the law where you live sets a higher age, to create an account. We do not knowingly collect data from children under 13, or under 16 in the EU and the UK. If we learn that we have, we delete it. If you think a child has given us data, write to privacy@mondaily.com.

This part is our notice at collection under the California Consumer Privacy Act and the similar laws of other US states.

What we collect, by the categories those laws use: identifiers (name, email address, account ids, IP address); commercial information (plan, invoices, payments); internet activity (pages viewed, sign-in sessions); approximate location (country, region and city from our hosting provider); professional information (company, role and the business records you keep in your workspace); sensitive information: account sign-in details, and the content of mail you connect, used only to provide the service. We collect it from you, from your use of Mondaily, and from the services you choose to connect. We use it only for the purposes in this policy and keep it for the periods under How long we keep it.

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the data of anyone under 16. We use sensitive data (your sign-in details, and the content of messages you keep with us) only to provide the service, so there is nothing to limit. We do not target ads or profile people for decisions with legal effects.

Your rights: to know what we collect, use and disclose, to get a copy, to correct it, to delete it, and to opt out of sale, sharing and targeted advertising (we do none of them). Your browser's Global Privacy Control signal is honoured as an opt-out. We will not treat you differently for using these rights. Write to privacy@mondaily.com; Mondaily works online only, so email is how requests come in. An authorised agent can write for you with your signed permission, and we may ask you to confirm it. We answer within 45 days.

If we turn down your request, you can appeal by replying to our answer. We decide within 60 days and explain why. If you are still not satisfied, you can contact your state attorney general.

The rights above also cover what the UAE Personal Data Protection Law, the Saudi Personal Data Protection Law and Qatar's Law No. 13 of 2016 give you: to be told how your data is used, to see and get a copy of it, to correct, complete or update it, to have it destroyed when it is no longer needed, to restrict or stop its use, and to object to decisions made only by automated processing. Write to privacy@mondaily.com.

Your data is stored outside your country (see Where your data goes), with the safeguards described there. We do not use your data for any purpose other than the ones in this policy without telling you first and, where the law asks for it, getting your consent.

If you are a business in the DIFC or ADGM and we process personal data for you, our Data processing agreement includes the processor commitments those laws require.

When we change this policy in a way that matters, we tell you by email or in Mondaily before the change applies, and the date at the top changes. If a change needs your consent, we ask for it.