Privacy Policy

Effective Date: 11 September 2026

1. Who We Are

This Privacy Policy applies to the Monokrew service (the “Service”) operated by:

Legal Entity: Monokrew Inc
Address: 836 McCauley Way, Saint Charles, Mo - 63303
Privacy Contact: legal@monokrew.com

In this Policy, “Monokrew,” “we,” “us,” and “our” refer to the applicable legal entity operating the Service.

2. What Monokrew Does

Monokrew provides an AI-powered software development and operations platform that enables users to create, deploy, monitor, and operate applications using AI agents and automated workflows.

Depending on the features used, Monokrew may:

• Generate application code and other software artifacts;
• Modify application code;
• Connect to source-code repositories;
• Read and write repository content when authorized by the user;
• Deploy applications;
• Execute automated workflows and agent tasks;
• Connect to third-party services;
• Perform quality assurance and testing activities;
• Assist with SEO, social media, and other operational activities;
• Maintain application databases and related infrastructure;
• Monitor deployed applications and operational activity; and
• Redirect users to or through third-party channel URLs and services.

Because many Monokrew capabilities depend on connected third-party services, the Service may process information obtained from those services according to the permissions granted by the user or organization.

3. Information We Collect

3.1 Account and Identity Information

When you create or access a Monokrew account, we may collect:

• Name;
• Email address;
• Authentication information;
• SSO identity information;

Monokrew supports authentication and SSO integrations that may include:

• Google / Google Workspace;
• Microsoft Entra ID / Azure AD;
• Apple identity services;
• GitHub;
• GitLab; and
• Discord.

The information received through these authentication providers depends on the permissions and configuration authorized by the user or organization.

3.2 Workspace and Project Information

We may collect and process information associated with your Monokrew workspace, including:

• Workspace name and configuration;
• Projects;
• Application configurations;
• Prompts and instructions;
• Generated code;
• Files and other user-provided content;
• Deployment configurations;
• Environment and application settings;
• Agent configurations;
• Workflow configurations;
• Execution records; and
• Other information necessary to provide the Service.

3.3 Payment Information

If you purchase a paid Monokrew plan, we may collect billing-related information such as:

• Billing name;
• Billing address;
• Subscription information;
• Transaction information; and
• Payment status.

Payments are processed through Stripe. Monokrew does not generally receive or store complete payment-card numbers when Stripe processes the transaction.

3.4 Connected Services and OAuth Information

Monokrew allows users to connect third-party services to enable functionality such as authentication, source-code management, cloud storage, communications, and application operations.

Depending on the integration, we may process:

• OAuth access tokens;
• OAuth refresh tokens;
• Account identifiers;
• Repository identifiers;
• Organization identifiers;
• File and folder identifiers;
• Permissions and scopes;
• Connection metadata; and
• Data retrieved through the authorized connection.

Monokrew is designed to use connected-service permissions only for the functionality authorized by the user or organization.

3.5 GitHub and GitLab Repository Access

When you connect GitHub or GitLab to Monokrew for source-code functionality, Monokrew may request and process repository read and write permissions.

Depending on the authorization granted and the features used, this may allow Monokrew's AI agents and workflows to:

• Read repository files;
• Read repository metadata;
• Create or modify files;
• Commit changes;
• Create or update branches;
• Perform other repository operations supported by the authorized integration.

These permissions are used to provide software development, deployment, automation, and related functionality.

You are responsible for ensuring that you have appropriate authority to connect a repository or organization and to grant Monokrew the requested permissions.

You may revoke GitHub or GitLab authorization through the applicable third-party service. Revocation may prevent Monokrew from performing features that require repository access.

3.6 Cloud Storage Connections

Monokrew may integrate with:

• Google Drive;
• Microsoft OneDrive;
• Microsoft SharePoint;
• Box; and
• Dropbox.

Depending on the integration and authorization granted, Monokrew may process files, folders, metadata, and other information necessary to perform requested operations.

3.7 Communication and Channel Connections

Monokrew may integrate with communication or collaboration channels including:

• Twilio - SMS;
• Twilio - WhatsApp;
• Telegram;
• Slack;
• Discord; and
• Microsoft Teams.

Where a workflow includes channel URL redirection or related channel functionality, Monokrew may process the relevant channel, workspace, message, URL, or integration metadata necessary to perform the requested action.

3.8 Generated Information and Agent Execution Data

Because Monokrew uses AI agents and automated workflows, we may collect information relating to:

• AI prompts and instructions;
• Agent inputs and outputs;
• Generated code;
• Generated application artifacts;
• Tool calls;
• Workflow execution records;
• Deployment operations;
• Repository operations;
• Connected-service operations;
• Errors and failures;
• Quality-assurance results;
• Agent activity and audit records; and
• Usage and billing-related metrics.

3.9 Technical and Usage Information

We may automatically collect:

• IP address;
• Browser and device information;
• Operating system;
• Application and browser version;
• Session information;
• Authentication events;
• Timestamps;
• Request and response metadata;
• Error logs;
• Performance information;
• Security events; and
• Service usage information.

3.10 Website Visitor and Contact Information

When you submit the contact form on monokrew.com, we collect the information you provide, which may include:

• Your name;
• Your email address;
• Your company name and approximate company size;
• The plan or topic you indicate an interest in; and
• The message you write.

We use this information solely to read, route and respond to your enquiry, and to keep a record of the correspondence.

We do not add contact form submissions to a marketing or mailing list, and we do not sell or share them with third parties for their own purposes. If you separately ask to receive marketing communications, that is a distinct choice you make and can withdraw at any time.

We do not store the IP address or browser user agent of contact form submissions.

3.11 Showcase Listings

If you choose to list an application in the Monokrew showcase, we collect the name, description and technologies you provide, the application's public URL, and an automatically captured screenshot of its public home page. We also record when you listed and withdrew it, and our review decisions.

4. How We Use AI and Automated Agents

Monokrew uses third-party AI technologies, including:

• Anthropic;
• OpenAI;
• Google Gemini; and
• fal.ai for applicable image, video, and audio generation.

Depending on the feature being used, information you submit or information required to execute an agent task may be transmitted to the applicable AI provider.

AI agents may process information in order to:

• Generate or modify software;
• Analyze code;
• Perform testing and quality assurance;
• Generate media;
• Execute workflows;
• Interact with connected services;
• Assist with deployment;
• Analyze application information; and
• Perform other actions requested or authorized through the Service.

AI-generated results may contain errors or omissions. Users should review AI-generated code, configurations, actions, and other outputs before relying on them in production environments.

5. Autonomous Agent Actions

Some Monokrew features allow AI agents to perform actions without requiring a separate manual approval for every individual step.

Depending on the permissions granted, an agent may be able to:

• Read or modify source-code repositories;
• Generate or modify application code;
• Execute tests;
• Deploy applications;
• Modify application or database configurations;
• Access connected services;
• Execute workflows;
• Send communications through authorized channels; or
• Perform other authorized operational tasks.

The scope of an agent's actions depends on the permissions, credentials, integrations, and configuration available to the relevant workspace.

Users and organizations are responsible for ensuring that appropriate permissions are granted and that production systems are configured appropriately.

6. Infrastructure and Service Providers

Monokrew uses third-party infrastructure and service providers to operate the Service.

6.1 Google Cloud Platform

Monokrew uses Google Cloud Platform (GCP) for cloud hosting and infrastructure.

The primary Monokrew hosting region is:

GCP Region: us-central1, United States

GCP infrastructure may support compute, application hosting, networking, storage, monitoring, and related infrastructure functions.

6.2 AlloyDB

Monokrew uses Google Cloud AlloyDB for applicable database infrastructure.

Primary Region: US Central / us-central1, where applicable.

6.3 Xata

Monokrew uses Xata for application database functionality and for portions of the Monokrew administrative/fleet-management infrastructure.

Region: US Central.

6.4 Monitoring and Operations

Monokrew uses Google services and Monokrew's own systems for monitoring, operational visibility, application management, security monitoring, and fleet management.

The Monokrew administrative portal may be used to monitor deployed applications, manage hosting resources, and manage application fleets.

7. Third-Party Service Providers

Our principal service providers may include:

The applicable list of subprocessors and service providers may change as the Service evolves.

8. Email

Monokrew uses Microsoft as its email provider.

Microsoft may process information necessary to deliver transactional, operational, account, security, and other legitimate Service-related communications.

9. Analytics

Monokrew uses Google Analytics to understand how users interact with the Service and to improve performance, reliability, and usability.

Depending on configuration, Google Analytics may collect information such as:

• Device and browser information;
• Approximate geographic information;
• Pages or features accessed;
• Session information;
• Usage events; and
• Technical information.

Analytics settings should be configured to comply with applicable privacy requirements, including consent requirements where applicable.

10. How We Use Personal Information

We may use personal information to:

1. Provide and operate the Service;
2. Create and manage accounts and workspaces;
3. Authenticate users;
4. Provide SSO functionality;
5. Connect authorized third-party services;
6. Read and write authorized GitHub and GitLab repositories;
7. Execute AI-agent workflows;
8. Deploy and operate applications;
9. Monitor application and infrastructure performance;
10. Provide customer support;
11. Process payments and subscriptions;
12. Send transactional and operational communications;
13. Detect and prevent fraud, abuse, and security incidents;
14. Debug and improve the Service;
15. Maintain records and audit trails;
16. Comply with legal obligations; and
17. Enforce our agreements and protect our rights; and
18. Display applications you choose to list on monokrew.com and in Monokrew's marketing content (social media, blog posts and sales materials).

11. Legal Bases for Processing

Where GDPR, UK GDPR, or similar laws apply, we may rely on the following legal bases:

• Contract: Processing necessary to provide the Service or perform our agreement with you.
• Legitimate interests: Security, fraud prevention, service improvement, operational management, and similar legitimate business purposes.
• Consent: Where applicable and legally required. Showcase listings are processed on the basis of your consent, which you can withdraw at any time from the application's details. Withdrawal does not affect use before it.
• Legal obligation: Processing required by law or lawful governmental requests.

Where you connect a third-party service, processing may also be necessary to perform functionality you have specifically requested and authorized.

12. How We Share Information

We may disclose information to:

• Infrastructure and hosting providers;
• AI service providers;
• Payment processors;
• Email and communication providers;
• Analytics providers;
• Monitoring and security providers;
• Authentication and SSO providers;
• Connected services you authorize;
• Professional advisers;
• Government authorities where legally required;
• Successors in connection with a merger, acquisition, financing, restructuring, or sale of assets; and
• Other service providers acting on our behalf.

We do not sell personal information for monetary consideration.

We do not share personal information for cross-context behavioral advertising as that term is defined under applicable California privacy law.

13. Connected Third-Party Services

When you connect a third-party service, information may flow between Monokrew and that service based on the permissions you authorize.

Examples include:

• SSO identity providers for authentication;
• GitHub and GitLab for repository access;
• Google Drive, OneDrive, SharePoint, Box, and Dropbox for file access;
• Slack, Discord, and Teams for communication workflows; and
• Other services introduced through the Monokrew platform.

Third-party services have their own privacy policies and terms. Monokrew is not responsible for the independent privacy practices of those services.

You should review the permissions granted to each connected service and revoke access when it is no longer required.

14. Google User Data

When you connect your Google account to Monokrew, you authorize us to access certain data from Google Search Console and Google Analytics (GA4) for the properties you choose. This section describes exactly what we access, how we use it, and the limits we place on that use.

What we access

With your explicit consent, and only for the properties you select, we access:

• Google Search Console (https://www.googleapis.com/auth/webmasters.readonly) — read-only: your search-analytics performance (clicks, impressions, average position, queries, and page performance) and URL index/inspection status.
• Google Analytics / GA4 (https://www.googleapis.com/auth/analytics.readonly) — read-only: reporting metrics for your website traffic, including both organic-search traffic and marketing-campaign traffic — such as sessions, users, traffic source/medium and campaign dimensions (including the UTM parameters Monokrew adds to links it generates on your behalf), and conversions, including conversions attributed to the marketing campaigns and advertising you run through the Service.

For Search Console and Analytics we request read-only access only, and we never create, modify, or delete anything in those accounts. If you separately connect YouTube to publish video content, that connection requires permission to upload to your own channel; see Section 15.

How we use it

We use this data solely to provide the Monokrew SEO and marketing services to you: to show your search and traffic performance in your Monokrew dashboard, to identify SEO optimization opportunities, to measure the before-and-after impact of SEO changes you apply to your own site, and to measure the performance of your marketing campaigns and attribute results and conversions to the campaigns and advertising spend you run through the Service. We use it only to operate the features you have enabled, for the account that authorized it.

What we never do with it

Monokrew's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• sell this data, or transfer it to data brokers or information resellers;
• use or transfer it for serving advertising, including retargeting, personalized, or interest-based advertising;
• use it to train or improve generalized or non-personalized artificial-intelligence or machine-learning models;
• allow humans to read it, except (a) with your affirmative consent for specific data, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized and is used for internal operations.

Sharing

We do not share your Google data with third parties except as needed to provide the service at your direction, to comply with the law, or as required for security. We do not share it for any other party's independent use.

Storage and retention

We store the Google access credentials only while your account is connected; on disconnection we revoke them with Google and delete them immediately. Performance data we retrieve is retained on a rolling 13-month basis while connected, and is deleted within 30 days of disconnection (or immediately on account deletion). You can disconnect your Google account at any time from your Monokrew settings, and you may also revoke Monokrew's access directly at https://myaccount.google.com/permissions.

Contact

Questions about how we handle Google data: legal@monokrew.com.

15. Use of YouTube API Services

Monokrew uses YouTube API Services to let you publish video content to your own YouTube channel through our platform. By connecting your YouTube account and using these features, you agree to be bound by the YouTube Terms of Service.

Our access to and use of information received from YouTube API Services is governed by the Google Privacy Policy.

What we access and why

When you connect your YouTube (Google) account via OAuth, we access only the YouTube data needed to provide our service:

• your channel information, to confirm the destination for uploads;
• the ability to upload videos you have reviewed and approved to your own channel;
• the status and basic statistics of videos we uploaded on your behalf, to confirm processing and show you how your content performs.

We upload only to your own connected channel, and only after you explicitly approve each video. We never access channels you have not connected, and we do not share your YouTube data with third parties.

Limited Use

Our use of information received from YouTube API Services adheres to the Google API Services User Data Policy, including the Limited Use requirements described in Section 14.

Storage and retention

We store your YouTube authorization tokens securely only while your account remains connected, and we keep temporary copies of media we upload on your behalf only until publishing completes, after which they are deleted in line with our data-retention practices in Section 17.

Revoking access and deleting your data

You can revoke Monokrew’s access to your Google/YouTube account at any time via the Google security settings page, or by disconnecting the account in Monokrew at Agent Library → Marketing → Social Agent → CMO Projects → Channels → YouTube → Disconnect. On revocation or disconnection, we stop accessing your YouTube data and delete your stored YouTube tokens. You may request deletion of your stored data as described in Section 18.

16. International Data Transfers

Monokrew's primary infrastructure is hosted in the United States, including GCP infrastructure in us-central1 and Xata infrastructure in the United States.

Personal information may therefore be processed in countries other than the country in which you reside.

Where required by applicable law, Monokrew will use an appropriate legal mechanism for international data transfers, which may include:

• Standard Contractual Clauses;
• UK International Data Transfer Agreements or Addendum;
• Adequacy decisions; or
• Another legally recognized transfer mechanism.

17. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required by law.

Our general retention practices are:

• Account and workspace information: While the account/workspace remains active and for a reasonable period afterward.
• Customer projects, content, and application data: While active and generally for up to 30 days following deletion or account termination, subject to applicable requirements.
• Connected-service credentials/tokens: Until the connection is disconnected, the workspace is closed, or deletion is otherwise required, subject to backup and security requirements.
• Media uploaded to connected video channels: Temporary copies of media we publish on your behalf are deleted once publishing completes.
• Application database information: Generally up to 30 days following deletion, subject to backups and legal requirements.
• Agent execution and audit records: Generally up to 12 months.
• Technical and security logs: Generally up to 90 days, unless longer retention is required for security, legal, or investigative purposes.
• Billing and transaction records: Typically retained for up to 7 years where necessary for accounting, tax, legal, or regulatory purposes.
• Contact form submissions: Generally up to 24 months (730 days) from the last activity on the enquiry, after which they are deleted.
• Showcase listings: The screenshot is deleted when you withdraw the listing (cached copies may remain accessible for up to 24 hours). The listing text and review history are kept until the application is deleted, and are deleted with it.
• Analytics information: According to the applicable Google Analytics configuration and retention settings.

Deletion may take additional time from backups and disaster-recovery systems. See Section 18 for how to delete your data and what happens when you do.

18. Data Deletion

This section explains how to delete the information Monokrew holds about you, what we delete automatically, and how long each step takes. It applies to all data we process, including data obtained from connected services.

How to delete your data

You can delete your data in any of the following ways:

• Disconnect a connected service. Disconnecting an integration from your Monokrew account settings immediately revokes and deletes the stored authorization tokens for that service and stops all further access to it.
• Delete a project or application. Deleting a project, application, or workspace removes its content, configuration, generated code, and associated application data.
• Delete your account. Deleting your Monokrew account removes your account, your workspaces, and their contents.
• Ask us to delete it. Email legal@monokrew.com from the address associated with your account. We may need to verify your identity before acting. We respond to verified deletion requests within 30 days.

What we delete, and when

Once you delete data or we accept a deletion request, our targets are:

• Connected-service authorization tokens: deleted immediately, and revoked with the provider where the provider supports revocation.
• Data retrieved from a connected service: deleted within 30 days.
• Projects, content, generated code, and application data: deleted within 30 days.
• Application databases: deleted within 30 days.
• Agent execution and audit records: deleted within 30 days, except where we must retain them for security, fraud-prevention, or legal reasons.
• Contact form submissions: deleted within 30 days of a verified request.
• Showcase listings: the screenshot is deleted when you withdraw the listing; cached copies may remain accessible for up to 24 hours.
• Backups and disaster-recovery copies: deleted data is never restored into production and is overwritten on our normal backup rotation, within 90 days.

Deleting YouTube data

Because the YouTube integration is covered by additional requirements, we state its deletion behaviour explicitly:

• Your YouTube authorization tokens are deleted immediately when you disconnect the account in Monokrew at Agent Library → Marketing → Social Agent → CMO Projects → Channels → YouTube → Disconnect, or when you revoke access through the Google security settings page.
• Data we obtain from YouTube API Services — channel information, and the status and basic statistics of videos we uploaded on your behalf — is deleted within 30 days of disconnection, revocation, or account deletion. We do not retain that data for longer than 30 days without refreshing it from the YouTube API, except for aggregated and anonymized information used for internal operations.
• Temporary copies of media we upload on your behalf are deleted once publishing completes.
• Videos already published to your channel remain on your YouTube channel. They belong to you and are managed by you — deleting your Monokrew data does not remove them, and you should delete them in YouTube if you no longer want them there.

Deletion we perform without a request

We also delete information automatically when its retention period in Section 17 expires, when a connection is revoked at the provider, and when data is no longer needed for the purpose it was collected for.

What we cannot delete on request

Some records are retained despite a deletion request, and only for as long as the relevant obligation lasts:

• Billing and transaction records, retained for up to 7 years where necessary for accounting, tax, legal, or regulatory purposes;
• Records subject to a legal hold, lawful request, or active dispute;
• Records needed to investigate or prevent fraud, abuse, or security incidents; and
• Aggregated or anonymized information that can no longer be associated with you.

Confirmation

We confirm by email when a verified deletion request has been completed. Questions about deletion: legal@monokrew.com.

19. Security

Monokrew uses reasonable technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction.

These measures may include:

• Encryption in transit;
• Encryption at rest where supported;
• Authentication and access controls;
• Role-based access controls;
• Tenant and workspace isolation;
• Security logging;
• Monitoring and alerting;
• Backup and disaster-recovery procedures;
• Infrastructure security controls; and
• Administrative safeguards.

No security system can guarantee absolute security.

20. Your Privacy Rights

Depending on your jurisdiction, you may have rights including:

• Right to access personal information;
• Right to correct inaccurate information;
• Right to delete personal information;
• Right to data portability;
• Right to restrict processing;
• Right to object to certain processing;
• Right to withdraw consent where processing is based on consent; and
• Right to lodge a complaint with a supervisory authority.

To exercise applicable rights, contact:

legal@monokrew.com

We generally respond to valid privacy requests within 30 days, subject to applicable law and permitted extensions.

21. Organization-Controlled Accounts

If you access Monokrew through an organization, company, school, or other institution, that organization may control your workspace and may have administrative access to information associated with the workspace.

In such circumstances:

• Your organization may control account and workspace information;
• The organization may access, modify, or delete workspace content;
• The organization's policies may apply to your use of the Service; and
• Privacy requests relating to organization-controlled information may need to be directed to the organization.

22. California Privacy Rights

If the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to you, you may have additional rights.

Depending on the circumstances, these may include rights to:

• Know/access personal information;
• Correct personal information;
• Delete personal information;
• Obtain a portable copy of personal information;
• Opt out of certain sales or sharing;
• Limit certain uses of sensitive personal information; and
• Not receive discriminatory treatment for exercising applicable rights.

Monokrew does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising.

23. EEA and UK Privacy Rights

If you are located in the European Economic Area or United Kingdom, you may have additional rights under GDPR or UK GDPR.

These may include rights to:

• Access;
• Rectification;
• Erasure;
• Restriction;
• Data portability;
• Objection;
• Withdrawal of consent; and
• Complaint to your applicable data protection authority.

24. Cookies and Similar Technologies

Monokrew may use cookies and similar technologies for:

• Authentication;
• Session management;
• Security;
• Preferences;
• Service functionality;
• Performance monitoring; and
• Analytics.

Monokrew may use Google Analytics.

Where required by law, Monokrew will obtain consent before using non-essential cookies or similar technologies.

25. Children

The Service is not directed to children under 18.

We do not knowingly collect personal information from children under 18 without appropriate authorization where such authorization is legally required.

If you believe a child has provided personal information to Monokrew improperly, contact us at:

legal@monokrew.com

26. Data Processing Agreements

For business customers that require a Data Processing Agreement (DPA), Monokrew may enter into a DPA addressing the processing of personal data on the customer's behalf.

Where applicable, the DPA will govern processing of personal data as a processor/service provider, while this Privacy Policy generally describes Monokrew's broader privacy practices.

27. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

For material changes, we will provide reasonable notice, generally at least 30 days where practicable, before the changes take effect.

The updated Policy will identify its effective date.

28. Contact Us

For privacy questions, requests, or concerns, contact:

Legal Entity: Monokrew Inc
Address: 836 McCauley Way, Saint Charles, MO - 63303 Privacy Email: legal@monokrew.com