Privacy Policy

Effective 12 June 2025

1. Introduction

This Privacy Policy explains how monō ai Australia Pty Ltd (“monō ai”, “we”, “us” or “our”) collects, uses, discloses and protects your personal information when you use the monō ai AI platform and related services (the “Services”).

We are committed to protecting your privacy and complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as well as other applicable data protection laws.

Note for Google and Microsoft OAuth users: when you sign in with Google or Microsoft, we collect your basic profile information (name, email address and profile picture) as permitted by Google’s or Microsoft’s OAuth scopes. This information is used solely to create and manage your account and provide the Services.

2. Information We Collect

2.1 Personal information

We collect the following types of personal information:

Account information: name, email address, phone number, organisation details and billing information.
OAuth profile data: when using Google or Microsoft sign-in, we collect your basic profile information including name, email address and profile picture as authorised by you.
User content: information you input into the platform, including conversations with AI models, documents and files you upload, custom workflows and configurations, and business data you process through our Services.
Usage data: information about how you interact with our Services, including features used, queries made and time spent.
Professional information: job title, department and role within your organisation.

2.2 Technical information

We automatically collect:

Device information: IP address, browser type, operating system and device identifiers.
Log data: access times, pages viewed, app features used and system performance data.
Cookies and tracking technologies: information collected through cookies, web beacons and similar technologies.

2.3 Information from third parties

We may receive information about you from:

Your organisation’s administrators.
Third-party authentication providers (Google, Microsoft).
Integrated business systems with your authorisation.

3. How We Use Your Information

We use your information to:

Provide Services: deliver, maintain and improve our AI platform and features.
Account management: create and manage user accounts, including authentication through OAuth providers.
Personalise experience: customise the Services based on your preferences and usage patterns.
Process transactions: handle billing, payments and subscription management.
Communicate: send service updates, security alerts and respond to inquiries.
Ensure security: detect, prevent and address fraud, security threats and technical issues.
Comply with legal obligations: meet regulatory requirements and respond to legal processes.
Improve Services: analyse usage patterns to enhance functionality and develop new features.
Training and support: provide customer support and training materials.

OAuth data usage: profile information obtained through Google or Microsoft OAuth is used exclusively for account creation, authentication and providing you with a personalised experience. We do not share this information with third parties except as necessary to provide our services or as required by law.

4. Third-Party Services and Data Sharing

4.1 AI model providers

When you use AI features, your data may be processed by the following providers, each under its own privacy policy:

Anthropic
OpenAI
xAI
Cohere
Google Vertex AI
Amazon Bedrock
Azure AI
Mistral AI
Perplexity
NVIDIA NIM
Vercel
Locally hosted models (on Google Cloud infrastructure).

Important: these providers may process data in various jurisdictions, primarily the United States. By using these services, you acknowledge that your data may be transferred internationally.

4.2 Data service providers

We integrate with the following data providers:

Cotality (CoreLogic): property data and analytics.
Equifax: credit and identity verification.
LandChecker: property and planning information.
ASIC: company and business data.
Australian Business Register (ABR): business registration data.
Wolfram Alpha: computational knowledge.
WeatherAPI.com: weather data.
Data.gov.au: Australian government open data.
NSW Government API: NSW government services.
Archistar: property development data.

4.3 Search and content services

Tavily: AI-optimised search.
Exa: neural search capabilities.
Brave Search API: privacy-focused search.
Valyu.Network: AI-driven search, research paper access and financial data.
Perplexity Search: AI-powered search results.

4.4 Document processing services

Aspose: document conversion.
Adobe PDF Services: PDF processing.

4.5 Infrastructure providers

Google Cloud Platform (Sydney and Toronto regions).
Google Cloud Storage (Sydney and Toronto regions).
MongoDB (Sydney and Toronto regions).

5. Data Security

We implement comprehensive security measures including:

Encryption: all data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption.
Authentication: OAuth 2.0 authentication with multi-factor authentication support.
Access controls: role-based access control and least-privilege principles.
Infrastructure security: web application firewall (Google Cloud Armor), DDoS protection, real-time threat monitoring, and regular security audits and penetration testing.
Compliance: SOC 2 Type 1 certified, with adherence to industry security standards.

6. Data Retention and Deletion

Active data: retained while your account is active and as needed to provide Services.
Backup data: maintained in secure backups for up to 90 days after deletion.
Legal obligations: data may be retained longer if required by law or legal proceedings.
Deletion requests: you can request deletion of your personal data at any time.

7. International Data Transfers

Your data may be transferred to and processed in:

Primary: Australia (Sydney region).
Secondary: Canada (Toronto region).
AI processing: various locations based on the AI model provider selected, primarily the United States.

By using our Services, you consent to these international data transfers. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.

8. Your Rights

Under Australian privacy law, you have the right to:

Access: request a copy of your personal information.
Correction: update or correct inaccurate information.
Deletion: request deletion of your personal information.
Objection: object to certain processing activities.
Portability: receive your data in a structured, machine-readable format.
Complaint: lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

To exercise these rights, contact us at privacy@monoai.co.

9. Cookies and Tracking

We use cookies and similar technologies to:

Maintain your session and preferences.
Analyse Service usage and performance.
Provide security features.

You can manage cookie preferences through your browser settings.

10. Children’s Privacy

Our Services are not intended for children under 18. We do not knowingly collect personal information from children.

11. Third-Party Links

Our Services may contain links to third-party websites. We are not responsible for their privacy practices.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through the Services. The effective date at the top indicates when the policy was last revised.

13. Contact Information

For privacy-related questions or concerns:

Privacy Officer, monō ai Australia Pty Ltd, Level 8, 4 Martin Place, Sydney NSW 2000, Australia. Email: privacy@monoai.co.

14. Complaints

If you have a privacy complaint, please contact us first. If you’re not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner:

Phone: 1300 363 992.
Email: enquiries@oaic.gov.au.
Website: www.oaic.gov.au.

15. Marketing communications

With your consent, or where otherwise permitted by applicable law, we may use your personal information to send newsletters, product updates, event invitations, offers and other marketing communications about monō ai and its services. You can withdraw your consent or opt out of marketing communications at any time by using the unsubscribe facility in the relevant communication or contacting us at hello@monoai.co. We will process unsubscribe requests within the period required by law and maintain suppression records to ensure that we do not send further marketing communications to an opted-out address.