Privacy Policy

Effective: August 22, 2026

This Privacy Policy describes how MoNA Gallery, Inc. ("MONA," "we," "us") handles personal information in connection with monaverse.com and our related applications and services (the "Service").

A note for designers' clients. If a design studio using MONA has entered your information (for example, you are a designer's client), the studio is responsible for that data and we process it on the studio's behalf. Contact the studio directly with privacy requests about that data; we will support the studio in fulfilling them. See "Client Data we process for studios" below.

Personal information we collect

Information you provide:

Account data: email address, name, username, and optional referral code. Sign-in is by one-time email code; we do not store passwords.
Profile data: bio, profile and header images, social links.
Content you upload or create: photos, floorplans, project files, spreadsheets (for example, FF&E schedules), prompts, presentations, and AI-generated results.
Client Data you enter about your own clients: names, emails, phone numbers, company, notes, bookings, projects, and invoices.
Audio, transcripts, and voice: if you use meeting recording, the audio you record, the transcript produced from it, and the notes and summaries generated from that transcript. If you use voice features, the speech you record while talking to the agent. You are the recording party and are responsible for obtaining any consent the law requires from other participants before recording.
Signature records: if you send or sign a document electronically, the document, the signer's name and email, and an audit record of the signing that includes the time, IP address, and browser user agent.
Financial account data: if you connect a bank or card account for bookkeeping, we import transaction records through Plaid. We request transaction data only, not balances, identity, or account and routing numbers. Access credentials are stored encrypted and you can disconnect at any time.
Credentials and property access information: trade account logins and, where you choose to store them, property access details such as gate, keypad, lockbox, and alarm codes. These are encrypted at rest and every access is written to an audit log.
Payment data: processed by Stripe; we store subscription identifiers, not full card numbers.
Communications: messages you send us, support requests, survey responses, and SMS messages if you use text features.

Information from connected accounts. If you connect third-party accounts (Google, Microsoft Outlook, Instagram, Canva, QuickBooks, Trello, and similar), we receive the data needed to provide the feature you enabled, for example email content you ask the agent to work with, calendar events, documents, and social account handles and messages. Access tokens are stored encrypted, and you can disconnect an account at any time. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: we use Google user data only to provide features you request, we do not use it for advertising, and we do not sell it or transfer it except as necessary to provide those features, for security, or to comply with law.

Automatic collection: device and browser type, IP address, pages viewed, feature usage events, and similar interaction data, collected via cookies and SDKs (see Cookies below). Our emails may contain an open-tracking pixel that records when a message is opened, along with device and IP information.

How we use personal information

Provide the Service: authenticate you, generate AI output from your inputs, store and display your content per your settings, process payments, provide support.
Operate agent features you direct: send email, post to social accounts, manage calendars and documents through accounts you connected.
Improve and secure the Service: analytics, debugging, fraud and abuse prevention, enforcing usage limits.
Communicate: transactional messages, and marketing you can opt out of.
Comply with law and enforce our terms.

AI model training. We do not use your content to train AI models. Your inputs are sent to third-party AI providers solely to generate your outputs, and we select providers whose service terms restrict training on customer content.

SMS consent and mobile information: no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding the SMS delivery providers we use to send messages you have requested. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for help at any time.
Service providers (subprocessors): hosting and storage, AI model providers (including speech-to-text and text-to-speech providers), payments, bank data connectivity, email delivery, SMS, analytics, and error monitoring. A current list is available on request at hello@monaverse.com.
Financial connectivity and payments: we use Plaid to connect a financial account you choose to link, and your use of Plaid is also subject to Plaid's own end user privacy policy. If you collect payment from your own clients, those payments are processed by Stripe on a connected account in your name, under Stripe's terms and privacy policy.
Third-party platforms you connect: when you direct the agent to act, the relevant content is shared with that platform (for example, Instagram or Gmail).
Advertising partners: we use the Meta pixel and Meta Conversions API on our marketing pages to measure ad performance, which may constitute "sharing" for cross-context behavioral advertising under California law. You can opt out (see Your privacy choices). We do not sell personal information for money.
Public content: new uploads and renders are private by default. Content you set to public, publish to a site, or share by link is visible to others.
Legal and corporate: to comply with law, protect rights and safety, or in connection with a merger, financing, or sale of assets.

SMS / text messaging

If you use MONA's text messaging features, we collect your phone number, the messages and media you send, and delivery metadata, and we use them solely to provide the conversational service you requested (answering design questions, delivering renders you ask for, and responding within your conversation). No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding the SMS delivery providers we use to send the messages you have requested. Message frequency varies; message and data rates may apply. You can opt out at any time by replying STOP, and get help by replying HELP or emailing hello@monaverse.com.

Cookies and similar technologies

We use cookies and SDKs for authentication and security (strictly necessary), product analytics, and advertising measurement on marketing pages. You can control cookies through your browser settings, opt out of advertising cookies as described in Your privacy choices, and opt out of interest-based advertising through the tools offered by our advertising partners (for example, Meta's ad preferences).

Client Data we process for studios

Studios and designers use MONA to manage their own client relationships. For that Client Data, the studio is the controller and MONA processes it only on the studio's instructions under our Data Processing Addendum. We do not use Client Data for our own marketing and we do not sell or share it for advertising.

Retention

We keep personal information for as long as your account is active and as needed for the purposes above, then delete or de-identify it, except where longer retention is required for legal, billing, security, or dispute purposes. You can delete individual content, delete a meeting recording along with its transcript and notes, disconnect integrations (which deletes stored tokens), remove stored credentials and access codes, and delete your account. Deletion removes the data from our active systems within a commercially reasonable period, subject to routine backup cycles and any legal hold.

Security

We use safeguards appropriate to the data, including encryption in transit, encrypted storage of integration tokens, encrypted storage of stored credentials and access codes with an audit log on every reveal, private storage with expiring links for your private uploads, and access controls. No system is perfectly secure.

Your privacy choices and rights

Access, correction, deletion, portability: you can delete your account in settings, or email hello@monaverse.com to request access to, correction of, deletion of, or a copy of your personal information. We respond to verified requests within the time required by applicable law.
Opt out of marketing: use the unsubscribe link in any marketing email; reply STOP to end SMS.
Opt out of "sharing" for advertising (California): email hello@monaverse.com with the subject "Do Not Share" and we will disable advertising pixels for your logged-in account, or use browser-level controls such as ad blockers and Meta's ad preferences. We honor Global Privacy Control signals where technically feasible.
No discrimination: we will not discriminate against you for exercising privacy rights.
California residents: the categories of personal information we collect, our purposes, and the recipients are described in the sections above. We do not sell personal information for money and we do not knowingly collect information from anyone under 16. Authorized agents may submit requests at hello@monaverse.com.
EEA/UK residents: our legal bases are contract (providing the Service), legitimate interests (security, improvement, and marketing to business contacts), consent (where required), and legal obligation. International transfers rely on Standard Contractual Clauses or other lawful mechanisms. You may lodge a complaint with your supervisory authority.

Children

The Service is intended for professional use by adults. We do not knowingly collect personal information from anyone under 18, and no one under 18 may use the Service. If you believe a minor has provided us data, contact hello@monaverse.com and we will delete it.

Changes to this policy

We will post updates here with a new effective date. For material changes we will notify you by email or in the Service.

Contact

MoNA Gallery, Inc. 221 W 9th St Ste 929, Wilmington, DE 19801 hello@monaverse.com