Privacy Policy

Last updated: 2026-10-29

This Privacy Policy describes how Monitelia ("we", "us") collects, uses, and shares personal data when you use our service.

1. Data we collect

1.1 Account data

When you sign up we collect your email address and password (stored hashed, never in plaintext). We use these to authenticate your account and send transactional emails (invoices, security alerts, password resets).

1.2 Usage data

• Projects and websites you choose to monitor
• Crawl results, keyword rankings, mentions, and other module data you generate through the service
• Audit log of sensitive actions (member changes, API token creation, subscription changes) with IP and user-agent
• Token usage counters for rate limiting

1.3 Billing data

Payments are handled by our payment processor, whose checkout page you see when you pay. We store only the processor's customer reference and subscription metadata; full payment details are held by the processor under its own privacy policy.

1.4 Cookies

See our Cookie Policy.

2. How we use your data

• To provide the service (crawling, monitoring, alerting)
• To send transactional emails you need to operate your account
• To bill you and handle disputes
• To detect abuse and prevent fraud
• To improve the service (aggregate usage analytics only — never your raw project data)

3. Legal basis (GDPR Art. 6)

• Contract: account, usage, billing data — needed to deliver the service you signed up for.
• Legitimate interest: abuse detection, security logging, and the monitoring of public content described in section 10.
• Consent: optional analytics cookies (see cookie banner).

4. Recipients (sub-processors)

We share the data each task needs with service providers in the following categories, each bound by its own data-processing terms. None of them may use it to train its models. What each category receives and the transfer bases are at /legal/subprocessors; the named list is provided to our customers under our DPA, and to any person exercising their right of access (GDPR Art. 15).

• Hosting and database providers (EEA and United States) — the web application, its database and authentication, and our collection and analysis service
• A payment processor (United States) — payment processing
• An e-mail delivery provider (United States) — transactional email and alerts
• Search-data providers (location being verified) — search-engine results and news search for the keywords and brand terms you track
• Social-data providers (EEA or outside it, per provider) — retrieval of public posts, comments and public pages
• Platform APIs (United States) — public videos; your own site and business data only from accounts you connect with your OAuth consent
• AI-model providers (United States) — automated analysis of mention text (tone, topics, summaries) and of images in public posts (logos, objects). Not used for content from sources whose terms forbid it, such as Telegram
• The AI assistants AI Visibility checks (United States and other countries, per provider) — only when you enable AI Visibility; we send the prompts you configure

5. International transfers

Where a recipient is outside the EEA we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or the EU Standard Contractual Clauses; askinfo@monitelia.com for a copy.

6. Retention

• Active account: indefinitely while you use the service
• Closed account: deleted within 30 days of your request, except for invoices and audit log retained for 7 years (legal requirement)
• Audit log: 2 years
• Backups: 12 weeks application-level + 7 days point-in-time recovery
• Public content we monitor (section 10): in full for at most 24 months from collection; then without the author for up to 5 years; after that only as anonymous statistics. All of it is deleted with the project that collected it

7. Your rights (GDPR Art. 15-22)

• Access — request a JSON export of your data: Account → Export my data
• Erasure — delete your account and all associated data: Account → Delete account
• Rectification — correct data via the dashboard or contact us
• Portability — the JSON export is in a portable format
• Objection / restriction — email us
• Withdraw consent — for analytics cookies, in the banner
• Complaint — to your national data-protection authority

8. Security

HTTPS everywhere, TLS 1.2+. Passwords and API tokens are stored only as one-way hashes. Each customer's data is isolated from every other customer's at the database level. We use OAuth refresh tokens for third-party integrations (you can revoke them anytime).

9. Children

The service is not directed at children under 16.

10. Public content we monitor

This section is for people whose public posts we collect, not for our customers.

10.1 Who we are

Monitelia collects publicly available content to provide its customers with brand and reputation monitoring. For this collection Monitelia is the data controller. Contact: info@monitelia.com.

10.2 What we collect

Public posts, comments, reviews and articles that mention a brand, product or topic our customers follow. With each: the author's public name or handle, a link to the public profile and to the avatar (a link only — we do not store the image), the text, the date, the link and public metrics such as views, reactions and shares.

10.3 What we do not collect

Private messages, closed groups, or anything visible only after signing in to someone else's account. E-mail addresses or phone numbers of private individuals. Follower lists. We do not recognise faces or identify people from photographs, and we do not determine ethnicity, income or other sensitive characteristics.

10.4 Aggregate estimates

For audience statistics we may estimate a gender or age group from a name or a public profile description, and a likely profession or interest from public posts. These estimates are used only in aggregate: we do not show them as facts about a specific person, and we do not use them to target, rate or exclude anyone.

10.5 Sources

Public pages of social networks, news sites, forums and review sites; search engines; the public web preview of Telegram channels; and data providers that supply only publicly available content.

10.6 Why

To tell our customers what is being said publicly about their brand, to detect fraud and impersonation of a brand, and for market analytics. Content may be analysed automatically (tone, topics, logos in images); for sources whose terms forbid automated AI analysis we use statistics and fixed rules only. It is never used to train artificial intelligence models.

10.7 Legal basis

Legitimate interest: Article 6(1)(f) GDPR and Article 11 of the Law of Ukraine “On Personal Data Protection”. We have assessed the balance of interests and will provide the assessment on request.

10.8 Who sees the data

The customer that monitors the relevant brand or topic, and the categories of processors described in section 4, under data-processing agreements. Where a recipient is outside the EEA we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or the EU Standard Contractual Clauses; askinfo@monitelia.com for a copy.

10.9 How long we keep it

In three steps, counted from when we collected the post:

• Up to 24 months — as collected.
• From 24 months to 5 years — without the author: we remove your name, handle, profile link and avatar, and keep the text and the link to the post so a brand can compare one year with the next. We keep a one-way code of your handle so that an objection from you still reaches these posts.
• After 5 years — only anonymous statistics: date, platform, website, the brand it mentioned, its tone and topic. The text, the link and any quotes are deleted, and nothing left relates to you.

Everything is deleted earlier if the customer's project is deleted. If a post has been deleted from the platform we may not know; you can ask us to delete our copy.

10.10 Your rights

You may ask for access to, correction or deletion of your data, and you may object to its processing. When you object, we delete what we hold from your public account and exclude that account from further collection. Write to info@monitelia.com with the platform and your public handle. You may also complain to the Ukrainian Parliament Commissioner for Human Rights or to the data-protection authority of your country.

11. Contact

Data controller / DPO contact: info@monitelia.com