Legal

Subprocessors

Draft. This text is a draft. Our lawyer is still reviewing it, and it becomes final once the company is registered in the United Kingdom. This page is in English for now. A translation is coming.

Mondaily is provided by Mondaily Ltd, United Kingdom. Placeholder until the company is registered: Company number: to be added after registration in England and Wales. Registered address: to be added after registration.

Last updated: 7 November 2026. These providers process customer personal data on Mondaily's behalf.

No AI vendor processes your data for Mondaily. sōtem (AI), web scraping, transcription and embeddings are built to run only on servers Mondaily operates. Until those servers are in service, these features are not available; it never falls back to a third party. The Prospecting Agent looks businesses up in the public data sources listed below, sending them search words only.

Your own AI key: if your workspace chooses to connect its own key for a hosted AI provider, sōtem sends masked chat text and tool results to the provider you chose, under your own agreement with that provider. That provider is not a Mondaily sub-processor; only an owner or admin can turn this on, and an owner can lock it off.

Your own business tools: if an owner or admin connects your workspace's HubSpot account, Mondaily reads your contacts, companies, deals and owner names from it into your workspace. It changes a HubSpot record only when a person in your workspace approves that exact change in the Decision Queue, and then sends only the approved values for that record; it never overwrites a value someone changed in HubSpot since the last sync. If an owner or admin connects your Xero or QuickBooks Online books, Mondaily reads your invoices, payments, bills, expenses, customers and suppliers from them and never changes anything there. Each of these is your own tool, used under your own agreement with its provider; it is not a Mondaily sub-processor. Disconnecting stops the reading and gives up Mondaily's access.

Core platform: hosted in the EU (Frankfurt)

Mondaily runs the application and stores your data in the EU (Frankfurt), on infrastructure from these two providers.

  • Vercel: Hosting for the web app, the API and this website.

    Data: All data passing through the service while it is served.

    Where: EU: the API runs in Frankfurt (fra1); public web pages are cached on Vercel's global edge network.

    Used: Always.

  • Supabase: Database and file storage, including call recordings.

    Data: Account and workspace data, files and recordings, including sōtem Studio clips, voice-cloning consents and voice history.

    Where: EU: Frankfurt.

    Used: Always.

  • Amazon Web Services (machines Mondaily runs): Our operations machine (incoming mail, outgoing mail through Amazon SES, our own web search and search memory), the nightly database backup (Amazon S3) and our own AI engine.

    Data: Email Mondaily sends and receives for you; search words; a full encrypted copy of the database in the backup; chat text the engine answers from, where our own engine serves your workspace.

    Where: EU: Frankfurt, Germany (AWS eu-central-1).

    Used: Always for mail and backups; search and the engine when you use them.

  • Swiss backup storage (encrypted copy): A second, encrypted copy of the nightly database backup.

    Data: An encrypted copy of the whole database; the storage provider cannot read it without our key.

    Where: Switzerland (outside the EU, with an EU adequacy decision).

    Used: Every night; each copy is kept 35 days.

Temporary providers (planned to be replaced)

We plan to replace each of these with a service Mondaily runs itself. Until then they are in use as described here. When we switch, we run ours in parallel first, switch over, then turn theirs off.

  • Inngest (Inngest Cloud): Runs background jobs: scheduled agents, record enrichment, reminders.

    Data: Job payloads, which can include the content of workspace records.

    Where: Inngest's cloud; region set by the provider, may be outside the EU.

    Used: Always.

    Plan: Our own job runner on a Mondaily server (a configuration switch, run in parallel first).

  • Resend: Backup delivery of account and notification email, and email your workspace sends.

    Data: Sender and recipient addresses, subject and message body.

    Where: Resend's cloud; region set by the provider, may be outside the EU.

    Used: Only when our own mail server on AWS in Frankfurt (Amazon SES) cannot take a message; Mondaily sends through that server first.

    Plan: Our own mail server already sends first (since 7 November 2026); Resend stays as the fallback while its reputation builds, then is removed.

  • Amazon Web Services (AWS Lambda): Opens your proven website in a real browser for yof's website check (read-only: it loads pages, it never submits a form or signs in).

    Data: The address of your proven site and the public pages the browser loads; the findings come straight back to us. Error logs, which can include the site address, are kept for 14 days.

    Where: Frankfurt, Germany (AWS region eu-central-1, where our stack is deployed).

    Used: Only when a yof website check runs.

    Plan: The same browser code on a server Mondaily runs itself.

  • LiveKit (LiveKit Cloud): Real-time audio and video for calls; records a call when someone in it starts recording.

    Data: Call audio and video, participant display names; recordings are written to our storage at Supabase (EU).

    Where: LiveKit's cloud; calls connect through servers near the participants, which may be outside the EU.

    Used: Only when you use calls.

    Plan: Our own LiveKit and TURN servers, after a test week.

  • Google Maps Platform (Places API): Business lookups for the Prospecting Agent (sōtem Team) and record enrichment.

    Data: Search terms and company names.

    Where: Google's cloud; region set by the provider, may be outside the EU.

    Used: Only when you use the Prospecting Agent or enrichment.

    Plan: OpenStreetMap and our own search, once match rates are compared.

  • OpenStreetMap Nominatim (public service): Open-data business and address lookups for the Prospecting Agent (sōtem Team).

    Data: Search terms.

    Where: The OpenStreetMap Foundation's public servers.

    Used: Only when you use the Prospecting Agent.

    Plan: Our own Nominatim server.

Optional: only when you choose it

Nothing is sent unless you sign in with or connect the account yourself; you can disconnect at any time.

  • sōtem Studio engine (run by Mondaily, not a third party): Text to speech, speech to text and the other sōtem Studio models, run by Mondaily, no outside AI provider.

    Data: Text to be spoken, audio to be transcribed, and consented voice references.

    Where: Not in use yet: no voice data is processed here today. Its location is listed here before any is.

    Used: Only when you use sōtem Studio.

  • Google (Sign in with Google, Gmail, Google Calendar): Optional sign-in with Google, and the optional Gmail and Google Calendar connector.

    Data: Sign-in: your name, email address and Google account ID. Connector: the email and calendar data you authorize.

    Where: Google's cloud; region set by the provider.

    Used: Only if you sign in with Google or connect a Google account.

  • LinkedIn: Optional LinkedIn connection: sign in with your own LinkedIn account and publish posts you approve.

    Data: Only for users who connect their own LinkedIn account: we receive your LinkedIn name, profile picture link, email address and member ID, and we send only the posts you approve; the exact text and visibility you confirmed.

    Where: LinkedIn's cloud; region set by the provider.

    Used: Only if you connect your own LinkedIn account; a post is sent only after you click Confirm.

  • X: Optional X connection for sōtem Social: publish posts you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: X's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Meta (Facebook, Instagram, Threads): Optional Facebook Page, Instagram and Threads connections for sōtem Social: publish posts you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Meta (Facebook, Instagram, Threads)'s cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • TikTok: Optional TikTok connection for sōtem Social: publish videos and photos you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: TikTok's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Google (YouTube, Business Profile): Optional YouTube and Google Business Profile connections for sōtem Social: publish uploads and updates you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Google (YouTube, Business Profile)'s cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Pinterest: Optional Pinterest connection for sōtem Social: publish pins you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Pinterest's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Telegram: Optional Telegram channel connection for sōtem Social: publish posts you approve through Mondaily's bot.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Telegram's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Bluesky: Optional Bluesky connection for sōtem Social: publish posts you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Bluesky's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Mastodon (your chosen server): Optional Mastodon connection for sōtem Social: publish posts you approve on the server you choose.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Mastodon (your chosen server)'s cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Snapchat: Optional Snapchat connection for sōtem Social (only after Snap grants partner access): publish stories you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Snapchat's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • PayPal: sōtem Data Lab: paying contributors for approved work.

    Data: Only for Data Lab contributors who request a payout: the PayPal email address they gave us and the amount. No customer workspace data is sent.

    Where: PayPal's cloud; region set by the provider.

    Used: Only when a Mondaily administrator sends a contributor's requested payout.

Payments: Stripe, we never see or store card numbers

Used only when you buy something.

  • Stripe: Payment processing.

    Data: Billing name, email address and payment details. Card numbers are entered into Stripe's own form and go straight to Stripe. Mondaily never sees or stores them.

    Where: Stripe's cloud; region set by the provider.

    Used: Only when you buy a plan or credits.

Public data sources (the Prospecting Agent)

The Prospecting Agent in sōtem Team finds companies in public, openly licensed data and checks each one in official registers. These services are not sub-processors: they receive only search words (an industry, a city or country, a date range, a company's public job board name) or a found company's public name, legal number or website domain, never your records, contacts or any personal data. We show each source's credit next to the results it gave.

  • OpenStreetMap (Overpass and Nominatim)

    Receives: An industry category and a city area or place name. Overpass is asked at the main instance (FOSSGIS, Germany) and, when that one is full, at Private.coffee (Austria).

    We take: Business names, addresses and website links from the open map.

    Licence: Open Database License (ODbL 1.0); credit: © OpenStreetMap contributors. Terms

  • TED, the EU's public tenders journal

    Receives: A procurement category code, a country and a date range.

    We take: Open calls for tender: buyer, title, dates and the notice link.

    Licence: EU open data, free reuse with credit (Commission Decision 2011/833/EU); credit: Source: TED. Terms

  • GDELT news index

    Receives: Industry and place words.

    We take: Links, headlines and dates of public news about funding or expansion.

    Licence: Free reuse with citation; credit: News index: The GDELT Project. Terms

  • Wikidata

    Receives: A country, or an industry and a city.

    We take: Organisation names and their official websites.

    Licence: CC0 1.0 (public domain); credit: Data from Wikidata. Terms

  • Greenhouse and Lever public job boards

    Receives: The public job board name a company links from its own careers page.

    We take: Open role titles, locations and links the company published.

    Licence: Public job-board APIs, no account needed; the company's own published postings. Terms

  • Google Places (optional paid extra)

    Receives: Search words (an industry and a place). Google is a vendor and receives these words; it never receives your records.

    We take: Optional and never required: only after the free sources, while our own search is offline, within a daily budget, and only while Google answers. The place ID (the only part we keep) and a business's website link.

    Licence: Google Maps Platform terms; credit: Google Maps. Terms

  • Official company registers (UK, France, Norway, Denmark, Poland, US) and GLEIF

    Receives: A found company's public name and town, or the legal number it publishes on its own site (company number, SIREN, org number, CVR, KRS, NIP, LEI).

    We take: Whether it is active, its legal form, registered address, industry code and named officers. Companies that opted out of marketing in their register (France, Denmark) are never used.

    Licence: Companies House and Contracts Finder: Open Government Licence v3.0; SIRENE: Licence Ouverte 2.0; Brønnøysund: NLOD 2.0; CVR and KRS / CEIDG: their public register terms; SEC EDGAR: US public domain; GLEIF: CC0 1.0. Terms

  • Public contract awards and certificate logs

    Receives: A found company's public name (TED, UK Contracts Finder, SAM.gov) or its website domain (crt.sh).

    We take: Public contracts the company won, and the date its domain got its first certificate (a new website), each with its link and date.

    Licence: TED: EU open data with credit; Contracts Finder: Open Government Licence v3.0; SAM.gov: US public domain; Certificate Transparency: public log data. Terms

  • Common Crawl

    Receives: A found company's own website domain.

    We take: A few archived pages of that company's own site, read only for the contact details it published itself, dated by the crawl.

    Licence: Common Crawl Terms of Use; the page content stays the company's own. Terms

  • Brave Search (only if switched on)

    Receives: Search words, with private details (emails, phone numbers, ids, bank and card numbers) removed first; when enriching a company record, that company's name. Never people's names. Used as the backup for the Prospecting Agent, sōtem chat web search and research, and record enrichment, only while Mondaily's own web search is not available and the workspace allows it.

    We take: Links to public web pages; we keep none of its results. Brave keeps query logs for up to 90 days (its API privacy notice: https://api-dashboard.search.brave.com/privacy-policy).

    Licence: Brave Search API terms. Terms

This page is the current list. We add a provider here before it receives any customer data, and the "Last updated" date changes with every change. Customers with a signed DPA can ask privacy@mondaily.com for the list at any time.