Privacy Policy

1. The short version

• We hold what an account needs: your name, email address, plan and billing state, what you create, and counts that apply plan limits.
• When you ask us to, we read a creator's public Instagram or YouTube profile, and keep what we read with your pitch or project (section 4).
• To write your analyses, products and pitches, that public profile data and the instructions you type are sent to our AI provider, Anthropic, which deletes it within 30 days (section 6).
• We never see or store your card number. Stripe handles payment.
• We do not sell personal data, and we run no advertising, analytics or cross-site trackers.

2. Who we are and our role

MonetiseOS is run by ApeTec Ltd, a company registered in England and Wales (company number 17065917), registered office 124–128 City Road, London EC1V 2NX. We are registered with the UK Information Commissioner's Office, registration number ZC202053.

UK data protection law (the UK GDPR and the Data Protection Act 2018) is our home framework, wherever you are. For the data described here we are the data controller. You can reach us about anything in this policy at hello@monetiseos.com.

3. Data we collect about you

Account data

• Your name and email address, and a password, which is stored as a hash by our sign-in provider, Supabase. We never store your password itself.
• Whether you have chosen to receive product updates and tips by email (your choice in Settings).
• When you signed up and signed in, and the IP address and browser of each signed-in session, recorded by Supabase to keep you signed in and your account secure.

Billing data

• Your plan, your Stripe customer and subscription references, the subscription's status, when the current period ends and whether it is set to end, and whether a payment has failed. Stripe collects your card and billing details on its own checkout page. We never see or store your card number.
• The payment notices Stripe sends us about your subscription, kept for 30 days.

What you create

• Your projects and pitches, the creator links you give us, the analyses, products, marketing material and pitches generated for you, and any instructions you type to change them.

Usage data

• Counts and dates that apply plan limits: pitches, projects, free analyses and creator look-ups used. We also record each AI request's size, cost and duration, against your account, to keep spending within limits.
• A record of account and billing events (for example, a subscription starting, or an account being deleted), without your IP address.

Security data

• Counts of recent requests, keyed to your account or, where there is no account, your IP address. They stop guessing and abuse, and expire within the hour or the day they count.
• When an account is created, a one-way hash of the network address it came from, so one network cannot create accounts without limit. It is kept for two days. The email address's domain is checked against a public list of temporary-email services.
• A comparison of email addresses, ignoring any “+” part (and, for Gmail, dots), so that accounts sharing an inbox share one free allowance.
• If an account is suspended for abuse, when and why.

Messages and error reports

• If you email us, your message and the name and address it comes from. They reach our support mailbox and are not stored in our database.
• If an email we send you bounces or is reported as spam, our email provider tells us, and we record it so we stop sending to that address.
• When something goes wrong, a report of the error — from our servers or from your browser — is sent to Sentry, together with a count of page loads, performance timings from a sample of about one in ten, and the clicks, page changes, console messages and network requests that led up to the error. We do not attach your email address to these reports, we strip cookies and sign-in credentials from them before they are sent, and nothing records your screen.

4. Creators you analyse

When you give us a link to a creator's Instagram or YouTube profile, our provider Apify fetches that public profile. We store what it returns with your pitch or project: the username, display name and bio, the follower count, and up to 30 recent posts or videos (their captions or titles, engagement counts and links). We copy the profile photo into our storage so it can be shown in your account; its address is not listed anywhere, but anyone who has it can open it.

We use this to analyse the creator's audience and write a product idea and a pitch for you. Our legal basis is legitimate interests: yours in assessing a possible partnership, and ours in providing the Service. We only read profiles that are public, we never contact creators ourselves, and the data is kept only while a pitch or project of yours uses it. Delete those and it is removed within two days.

If you are a creator and want us to stop processing your public profile, or to delete what we hold about you, email hello@monetiseos.com with the profile link. Both are your rights under the UK GDPR (Articles 17 and 21).

5. How we use it, and our legal bases

• To run your account: signing you in, confirming your email, resetting your password.
• To run your subscription: taking payment through Stripe and applying plan limits.
• To send the emails the Service needs: sign-in codes, account and security notices, subscription and payment notices.
• To send product updates and tips, only if you have chosen to receive them. You can stop them at any time in Settings.
• To answer your messages, fix errors, and prevent abuse.

Our legal bases under the UK GDPR are the contract with you (running the Service you signed up for), our legitimate interests (security, preventing abuse, fixing errors, and the creator analysis in section 4), your consent (product updates by email), and legal obligations (such as keeping payment records). We make no automated decisions with legal effect about you.

6. AI: what is sent

Analyses, products, marketing material and pitches are written by a language model provided by Anthropic. Our server sends it the creator's public profile data described in section 4, the results of earlier steps for the same creator, and any instructions you type. It never sends your password or payment details. Anthropic keeps what we send for up to 30 days to run its service, then deletes it, and under its commercial terms it may not train its models on it.

7. Providers we use

We share personal data only with the providers below, each for the job stated, and never for their own advertising.

Beyond these, we disclose data only where the law requires it. If MonetiseOS is ever sold, this policy binds the new owner.

8. International transfers

We are in the UK and our database is in London, but several providers are in the United States. When personal data goes to a provider outside the UK, it is protected by the UK's adequacy regulations (which cover the EU, and US companies certified under the UK Extension to the EU–US Data Privacy Framework) or by the UK International Data Transfer Addendum in that provider's data processing terms. For Sentry, the safeguard is the Standard Contractual Clauses with the UK International Data Transfer Addendum in Sentry's data processing terms.

9. How long we keep data

Each kind of data is kept only as long as its job needs. Deleting your account deletes your data at once, including the creator data held with your pitches and projects.

10. Your rights

Wherever you are, three things need no request. In Settings, "Export your data" gives you everything we hold about your account as one file, "Delete account" deletes it, and unticking "Email me product updates and tips from MonetiseOS" stops them.

If you are in the UK or the EU, you have the right to a copy of your data, to have it corrected or deleted, to restrict how we use it, to object where we rely on our legitimate interests, to receive it in a portable form, and to withdraw consent at any time. You can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

If you are in the United States, we do not sell or share your personal information, and we do not use it for targeted advertising. You can ask us what we hold about you, and ask us to correct or delete it.

Send any request to hello@monetiseos.com. We may ask you to write from your account's email address so we know the request is yours.

11. Cookies and storage in your browser

• Sign-in cookies (Supabase) keep you signed in. The Service cannot work without them.
• The bot check (Cloudflare Turnstile) runs when you sign up, sign in or change or reset your password, to tell people from automated abuse.
• Settings, such as whether the sidebar is collapsed, how your projects are listed and your pitch filter, are kept in your browser's storage.
• While you confirm your email, your email address and when the code was sent are kept in your browser's storage, so the page can bring you back to the code box. They are removed once you are in.

We use no analytics, advertising cookies or cross-site trackers. You can clear all of this from your browser's settings.

12. Security

Everything between your browser and our servers is encrypted in transit. Passwords are hashed by Supabase. Card details go to Stripe and never touch our systems. Access to production systems is limited to the people who run MonetiseOS. If you believe your account has been compromised, contact us immediately at hello@monetiseos.com.

13. Children

MonetiseOS is not directed at children and requires you to be at least 16 years old, as the Terms of Service say. If you believe a child has created an account, contact us at hello@monetiseos.com. An account held by someone under 16 breaks the Terms and can be closed.

14. Changes and contact

We may change this policy; the date below shows when it last changed. Questions, requests or complaints: hello@monetiseos.com.

ApeTec Ltd, registered in England and Wales, company number 17065917. Registered office: 124–128 City Road, London EC1V 2NX.