1. Scope and our role
Monk serves business customers. In the course of providing the Services, we handle personal information in two distinct roles:
- As a controller. When we collect information about our website visitors, prospective customers, and the individual users who administer customer accounts, we determine how and why that information is processed. This Privacy Policy governs that processing.
- As a processor (service provider). When our business customers upload or connect their own data to the platform, including information about their customers (the parties they invoice and collect from), we process that information on our customer's behalf and under their instructions. That processing is governed by our agreement with the customer and our Data Processing Addendum, not by this Privacy Policy.
If you are an end customer of a business that uses Monk and you have questions about how your information is handled, please contact that business directly, as they control that data.
2. Information We Collect
Information you provide to us:
- Contact and identification details (name, business email, phone number, job title, company name) when you request a demo, create an account, contact support, or communicate with us.
- Account credentials and profile information for authorized users of the platform.
- Billing and payment details necessary to administer your subscription.
- The content of communications you send us, including support requests and feedback.
Information we collect automatically:
- Usage and device data (pages viewed, features used, browser type, device identifiers, IP address, and similar telemetry) collected through cookies and analytics tools when you use our website or platform.
- Authentication and access logs generated when users sign in to and interact with the Services.
Information from third parties and integrations:
- When a customer connects third-party systems to Monk (such as accounting, payment, CRM, or banking platforms), we receive data from those systems as needed to provide the Services. Where this includes personal information processed on a customer's behalf, we act as a processor as described in Section 1.
- We may receive contact and company information from business data providers and our partners for sales and marketing purposes.
3. How We Use Information
We use personal information to:
- Provide, operate, maintain, and improve the Services;
- Create and administer accounts and authenticate users;
- Process transactions and manage billing;
- Respond to inquiries, provide customer support, and communicate with you about the Services, including transactional messages and important service updates;
- Send marketing communications about our products and services (subject to your right to opt out);
- Monitor, secure, and troubleshoot the Services, and detect and prevent fraud or abuse;
- Analyze usage to understand and improve performance and develop new features; and
- Comply with legal obligations and enforce our agreements.
We do not sell personal information.
4. Legal Bases for Processing (EEA/UK)
Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases: performance of a contract (to provide the Services you request); our legitimate interests (to operate, secure, and improve our business, and for direct marketing to business contacts); your consent (where required, such as for certain cookies or marketing); and compliance with legal obligations.
5. How We Share Information
We share personal information only as described below:
- Service providers and subprocessors. We use trusted third parties to host and operate the Services. These include, among others, Supabase and Amazon Web Services (hosting and database), Vercel (application hosting), WorkOS (authentication), Plaid (bank connectivity), Stripe (payment processing), Google Workspace (business operations), and Slack (communications). Each is contractually bound to protect personal information and to use it only to provide services to us.
- Customer-directed sharing. Where you connect integrations or direct us to share data with third-party systems, we do so according to your instructions.
- Legal and safety. We may disclose information where required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of Monk, our customers, or others.
- Business transfers. If Monk is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.
A current list of subprocessors is available on request at team@monk.com.
6. Data Retention
We retain personal information only as long as necessary for the purposes for which it was collected, including to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods depend on the category of data and the nature of our relationship with you. When a customer relationship ends, we delete or de-identify associated personal data in accordance with our internal Data Deletion Policy, except where longer retention is required by applicable law, regulation, or legitimate business necessity.
7. Your Privacy Rights
Depending on where you live, you may have rights to:
- Access the personal information we hold about you;
- Correct inaccurate or incomplete information;
- Delete your personal information;
- Port your information to another provider;
- Object to or restrict certain processing, including direct marketing; and
- Withdraw consent where processing is based on consent.
To exercise any of these rights, email team@monk.com. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights.
If you are an individual whose data was provided to Monk by one of our business customers, we will refer your request to that customer, who controls the data, and will assist them in responding.
California residents: Under the CCPA/CPRA, you have the rights described above, including the right to know what personal information we collect and how we use it, and the right to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law.
EEA/UK residents: You have the right to lodge a complaint with your local data protection authority.
8. Cookies and Tracking
We use cookies and similar technologies to operate our website, remember your preferences, authenticate users, and analyze usage. You can control cookies through your browser settings; disabling some cookies may affect site functionality.
9. Data Security
Security is central to how we operate. We employ industry-standard administrative, technical, and physical safeguards to protect personal information, including encryption, role-based access controls, single sign-on and multi-factor authentication, logging and monitoring, and regular security testing. Monk maintains a SOC 2 program. More detail is available on our Security page.
No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security, and transmitting data over networks we do not control carries inherent risk
10. International Data Transfers
Monk is based in the United States and processes information there. If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States or other countries. Where required, we implement appropriate safeguards (such as Standard Contractual Clauses) for international transfers.
11. Children's Privacy
The Services are intended for businesses and are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Services after an update constitutes acceptance of the revised policy.
13. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal information, contact:
Email: team@monk.com
Address: Monk, 19 W 24th Street, Floor 8, New York, New York 10010, USA
.avif)