Privacy Policy

1. Who we are

Mondai is an AI content agent that helps creators and small businesses run their social media across Instagram, Facebook, Threads, TikTok, YouTube, Pinterest and LinkedIn. It is operated from the Czech Republic by the controller below, who decides how and why your personal data is processed. This policy explains what we collect, why, who else sees it, how long we keep it, and what you can do about it.

We have not appointed a Data Protection Officer, as we are not required to have one. Privacy questions go to the address above and we answer within one month.

2. Data we collect

• Account info: the email and name you provide at signup, and a hashed version of your password.
• Onboarding answers: your niche, voice, visual style, and content pillar preferences.
• Connected social accounts: when you connect a platform (Instagram, Facebook, Threads, TikTok, YouTube, Pinterest or LinkedIn), we store an OAuth access/refresh token plus basic account metadata — your username or channel name, profile details, and follower or subscriber counts.
• Posts, videos and engagement: we fetch your recent posts and videos and their metadata (captions, media URLs, engagement metrics, comments and channel analytics) from the platforms you connect, so Mondai can learn your style, show you analytics, and help you reply to comments.
• Photos and videos you upload: the media you put into the content library, plus AI-generated descriptions of it.
• Drafts and published posts: the content Mondai creates with you, including confidence and reasoning metadata.
• Voice recordings: if you talk to Mondai in voice mode, your recording is sent to OpenAI to be transcribed and to ElevenLabs to produce the spoken reply. We do not store the recording or the transcript on our servers.
• Device and notifications: your push token, device type and app version, so we can deliver notifications to your phone and watch.
• Technical data: IP address, browser and app version appear in server logs and error reports. We use them to keep the service running and secure, not to profile you.

3. How we use your data

• To run the Mondai service — generate recommendations, publish the posts you approve, show you analytics.
• To send your content to our AI providers (Anthropic, OpenAI and Google) so they can analyse your photos and video, transcribe audio, and write captions, titles and descriptions in your style.
• To send your data to the official platform APIs (Meta, TikTok, Google/YouTube, Pinterest, LinkedIn) so we can read your history, show analytics, manage comments, and publish the drafts you approve.
• To improve Mondai — understand which features work and where users get stuck.

We do not sell your data. We do not use your photos, captions, or any data obtained through connected-platform APIs to develop, improve, or train any generalized AI/ML model — we use it only to provide the features you asked for.

Mondai does not make automated decisions that produce legal effects for you. It suggests and drafts; every publication follows a decision you control, and you are always notified before or when something goes out.

4. Why we are allowed to process it

Each thing we do with your data rests on one of these legal bases under the GDPR:

• Performance of a contract (Art. 6(1)(b)): running your account, generating and publishing what you approve, and billing you for a paid plan.
• Legitimate interest (Art. 6(1)(f)): keeping the service secure and working, preventing abuse, understanding which features are used, and collecting public information about the accounts you ask Mondai to analyse. You can object to any of this.
• Consent (Art. 6(1)(a)): connecting each social account, using voice mode, and receiving product emails. You can withdraw consent at any time without affecting what happened before.
• Legal obligation (Art. 6(1)(c)): keeping invoices and accounting records for as long as Czech tax law requires.

5. Platforms and third parties we work with

We share personal data only with the providers below, and only for the purpose listed next to each. They act as our processors under a data processing agreement, or as independent controllers where you authorised them yourself.

• Anthropic — our primary AI provider. Analyses your photos and writes captions, titles and descriptions in your style. Your data is not used to train Anthropic's models.
• OpenAI — image generation, and speech-to-text for voice mode and automatic subtitles. Receives your prompts, reference images and voice recordings.
• Google (Gemini, Cloud Video Intelligence, YouTube) — analyses your video to find clip moments and to reframe it, and provides the YouTube API when you connect your channel.
• ElevenLabs — turns Mondai's replies into speech when you use voice mode.
• Cloudinary — optional image enhancement. Receives the photos you choose to enhance.
• Meta (Instagram, Facebook, Threads) — reading your posts and publishing on your behalf, only after you authorize.
• TikTok — reading your profile and videos and publishing on your behalf, only after you authorize.
• LinkedIn — reading your profile and publishing on your behalf, only after you authorize.
• Pinterest — reading your boards and publishing pins on your behalf, only after you authorize.
• Microsoft (OneDrive) — only if you choose to import media from your OneDrive.
• Apify — collects public profile, post and comment data from social platforms for competitor insights and comment context. See the next section.
• Stripe — payment processing when you upgrade to a paid plan. Receives your email and billing details.
• Resend — delivers our emails: verification, password resets, weekly letters and support replies. Receives your email address and the message content.
• Cloudflare (R2, Stream, Email Routing) — stores the photos and videos you upload, hosts long-form video playback, and receives the support emails you send us.
• Expo — delivers push notifications to your phone and watch. Receives your device push token and the notification text, which can include a preview of a draft.
• Railway — hosts the Mondai backend and database. All application data lives there.
• Vercel — hosts the Mondai website. Receives request metadata such as your IP address.
• Sentry — error monitoring. Receives crash reports and stack traces. We have switched off the sending of personal data with them.

Several of these are only involved when you use the related feature — voice mode, subtitles, image enhancement, competitor analysis, OneDrive import or a specific connected platform. If you never use the feature, no data reaches that provider.

6. Data about people who are not our users

Some features work with public information about accounts that are not yours: the people who comment on your posts, and the competitor accounts you ask Mondai to analyse. For them we may process a public username, profile details, follower counts, and the text of their public posts or comments.

The legal basis is legitimate interest (Art. 6(1)(f)): understanding your own audience and your market is the point of the product. We collect only what is already public, we never collect special categories of data, we do not use it for advertising or profiling, and we never sell it.

If you are one of those people and you want your data removed, write to hello@heymondai.com and we will delete it. It is in any case deleted automatically after 90 days.

7. Transfers outside the EU

Mondai is operated from the Czech Republic, but several providers listed above are established in the United States — Anthropic, OpenAI, Resend, Expo, Sentry, Cloudflare, Railway and Vercel. Using Mondai therefore involves transferring personal data outside the European Economic Area.

Those transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework, as set out in each provider's data processing agreement. We do not currently pin storage or hosting to an EU-only region. If that matters for your situation, contact us before connecting an account.

8. How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for. Deleting your account removes everything in the first rows below immediately.

9. Google API Services and YouTube

When you connect YouTube, Mondai uses YouTube API Services to read your channel, your videos and their metadata, and your channel analytics, and to publish videos and manage comments on your own channel at your request.

Mondai's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is used only to provide the features described above; it is never used for advertising and is never used to develop, improve, or train AI/ML models.

Your use of YouTube through Mondai is also subject to:

• YouTube Terms of Service
• Google Privacy Policy

You can revoke Mondai's access to your Google and YouTube data at any time by disconnecting YouTube in Settings → Connected accounts, or through the Google Account security permissions page: myaccount.google.com/permissions.

10. Your rights

Under the GDPR you have the following rights, and exercising them is free:

• Ask what personal data we hold about you, and why.
• Ask for a copy of your data in a structured, commonly used, machine-readable format, so you can take it elsewhere.
• Correct anything that is wrong — most of it you can edit directly in Settings.
• Delete your account and everything in it, from Settings. Deletion is immediate and permanent: it also cancels your subscription, revokes the tokens for your connected accounts, and erases your uploaded media.
• Ask us to pause processing while a dispute or a correction is being resolved.
• Object to anything we base on legitimate interest, including the collection of public data about other accounts.
• Withdraw consent at any time — disconnect a platform, stop using voice mode, or unsubscribe from our emails. This does not affect processing that already happened.
• Complain to a supervisory authority if you believe we have handled your data badly. Ours is the Czech Data Protection Authority (Úřad pro ochranu osobních údajů).

To exercise any of these, email hello@heymondai.com and we will respond within one month. You can also contact the Czech Data Protection Authority directly at www.uoou.gov.cz.

11. Where your data lives, and how we protect it

The Mondai application and database run on Railway; the photos and videos you upload are stored on Cloudflare R2, and long videos are served through Cloudflare Stream. Neither is currently restricted to an EU-only region, so your data may be processed on infrastructure outside the EEA — see the section on transfers above.

Databases are encrypted at rest. Access tokens for connected accounts are held server-side and never exposed to the browser. Passwords are hashed with bcrypt. Two-factor authentication is available in Settings, and its setup happens entirely in your browser — the secret is never sent to anyone else.

12. Changes to this policy

We update this policy as the product changes; the date at the top always reflects the last change. If a change materially affects how we use your personal data, we will tell you by email before it takes effect.

13. Contact

Questions about this policy, or want to exercise one of your rights? Email us at hello@heymondai.com.