Privacy policy

Who is responsible for your data

The controller of personal data processed through the monetisation.ai website and application is the administrator of the monetisation.ai service ("we", "us"). For any question about this policy or your data, write to [email protected].

This policy explains what we collect, why, how long we keep it, who receives it and what rights you have. It applies to visitors of the website, people who run the sample audit, account holders and members of their workspaces.

The data we process

Account data

When you create an account we process your email address, a hashed password, your name if you give it, your role in the workspace, your plan and billing status, sign-in times and the technical details of sign-ins (IP address, browser type). If you sign in through SSO on the Scale plan, we receive the identifiers your identity provider sends.

Workspace data

A workspace holds the settings you enter, the sources you connect, audits, opportunities, experiments, notes, AI analyst conversations, exports and the audit log on Scale. Members you invite are identified by email address and role.

Data read from connected sources

Every connector is read-only. When you connect a source such as your billing system, web analytics, search data, a CRM, a product database, an ad platform or a CSV file, we read what is needed to build your revenue model: revenue and usage aggregates, plans, prices, discounts, subscription states, traffic and conversion figures. Where a metric cannot be computed without them, we also read customer identifiers from your billing data, such as a customer ID, email address or country, to count customers, churn and expansion correctly. We do not change prices, charges, customers or subscriptions in any connected account.

For personal data of your own customers read from your sources, you are the controller and we act as your processor. The Scale plan includes a data processing agreement.

Website crawl data

To audit a website, we crawl public pages of the address you enter, such as the homepage and pricing page. We store the page content, prices and structural signals we detect. We do not log in to any site and do not read pages that are not public.

Sample audit inputs

When you run the one-time sample audit we process the website address, the business type and the other choices you make in the form, a hashed form of your IP address and a cookie identifier (see cookies). We use them to produce the result, to keep the sample audit to one per visitor and to protect the service from abuse.

Experiment snippet data

If you install our optional experiment snippet on your own website, it assigns each of your visitors a random, pseudonymous visitor ID, shows them a variant or the holdout version, and records which version they saw and the events you choose to measure. We do not receive their names or contact details through the snippet. For these visitors you are the controller and we act as your processor, under your own privacy and cookie notices.

Support and email

When you write to [email protected] we process your message and the address you wrote from. We send service emails, such as sign-in codes, billing notices and the weekly digest on paid plans.

Website usage

We measure use of our own website with aggregated analytics that do not use cookies and do not identify you. Server logs record IP address, time, requested page and browser type for security and troubleshooting.

Why we process it and on what legal basis

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not build advertising profiles.

AI and your data

Monetisation uses AI models to analyse your revenue model, write opportunity descriptions and answer questions in the AI analyst. Data is sent to an AI model provider only to produce that output, under terms that do not allow the provider to train models on it. We do not use your data, your customers' data or your connected source data to train any AI model.

Who receives data

We share data only with service providers that help us run the service, under contracts that limit them to our instructions. We describe them by category.

• A hosting provider located in the European Union, which stores and runs the application and databases.
• A payment operator, which processes subscription payments and card details. We do not store full card numbers.
• An email delivery provider, which sends service emails.
• An AI model provider, which processes prompts to return output and does not train on the data.

We may disclose data where the law requires it, for example to a court or public authority, or to protect our rights in a dispute.

International transfers

Our main storage is in the European Union. Where a provider processes data outside the European Economic Area, we rely on the European Commission's standard contractual clauses, or an adequacy decision where one applies, together with additional safeguards where needed.

How long we keep data

• Account and workspace data: for as long as the account exists. When you delete a workspace in the settings, its data, including data read from connected sources, is deleted from the live systems within 30 days and from backups within a further 30 days.
• Revoked or disconnected sources: we stop reading at once and delete the data read from that source with the workspace or when you ask us to.
• Billing records and invoices: for the period required by tax and accounting law.
• Sample audit inputs and hashed IP: up to 12 months, to keep the sample audit to one per visitor.
• Experiment snippet data: for as long as the customer's workspace keeps the experiment, or shorter where the customer sets retention controls on Scale.
• Server logs: up to 90 days, unless needed longer to investigate a specific security incident.
• Support messages: up to 24 months after the conversation ends.

Security

Data is encrypted in transit and at rest. Connector credentials are stored encrypted and used only to read data. Access inside our team is limited to people who need it to run the service. Scale workspaces have SSO SAML, roles and an audit log. More detail is on the security page.

Your rights

Under the GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work.

If you are a California resident, the CCPA gives you the right to know what personal information we collect and how we use it, to access and delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information in that sense. We do not discriminate against anyone for using these rights.

To use any right, write to [email protected] from the email address on your account. We may ask you to confirm your identity and we reply within one month, or within the time the applicable law sets. If your request concerns data that one of our customers controls, such as a visitor on a customer's site, we pass it to that customer and help them answer.

Cookies

We use only strictly necessary cookies. The full list is on the cookies page.

Children

Monetisation is a business service. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, write to [email protected] and we delete it.

Changes to this policy

We update this policy when the service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we tell account holders by email before it takes effect.

Contact

The administrator of the monetisation.ai service, [email protected].