Privacy Policy

1. Data Controller

For the purposes of applicable data protection laws, YouMonkey is the data controller (or equivalent) responsible for your personal data. You may contact us regarding any privacy matter at:

2. Information We Collect

2.1 Information You Provide Directly

• Full name and email address
• Business or company name
• Product or business idea descriptions submitted during Product Birth conversations
• Industry, target audience, and market preferences
• Branding preferences and design inputs
• Support requests and helpdesk tickets
• Communications with our team (including meeting notes and recordings)

2.2 Information Collected via Google OAuth

When you sign in using Google OAuth 2.0, we collect:

• Your Google account email address
• Your public profile information (name and profile image)
• A unique Google account identifier

We do not access or store your Google password.

2.3 Payment and Subscription Data

When you subscribe to a paid plan, we collect:

• Subscription tier selection (Free, Go, or Standard)
• Billing address and country (for tax calculation)
• PayPal Customer ID and Subscription ID (technical identifiers)
• Subscription status and billing cycle dates

All payment card details (credit card numbers, CVV, etc.) are processed and stored exclusively by PayPal, Inc. YouMonkey does not have access to, store, or process your full payment card information on its servers. PayPal is PCI DSS Level 1 certified.

2.4 Google Calendar Access

With your explicit consent, we access limited Google Calendar data to:

• Create, update, reschedule, or cancel meetings booked through YouMonkey
• Generate Google Meet links for scheduled meetings
• Invite relevant participants
• Prevent scheduling conflicts

We do not read, index, or access unrelated calendar events. Calendar access is used solely for user-initiated meeting actions.

2.5 Automatically Collected Information

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Log data, access timestamps, and usage activity
• Cookies and similar tracking technologies (see Section 6)
• Referring URL and pages visited

3. Legal Basis for Processing (GDPR/UK GDPR)

For users in the European Economic Area, United Kingdom, and other jurisdictions requiring a legal basis for processing personal data, we process your data based on the following grounds:

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing necessary to provide the Services you have subscribed to, including account management, subscription billing, and Product Birth artifact generation.
• Consent (Art. 6(1)(a) GDPR): Where you have given explicit consent, such as for Google Calendar access, marketing communications, or cookie usage.
• Legitimate Interests (Art. 6(1)(f) GDPR): Processing necessary for our legitimate interests, including platform security, fraud prevention, analytics, and service improvement, provided these interests are not overridden by your rights.
• Legal Obligation (Art. 6(1)(c) GDPR): Processing necessary to comply with applicable laws, regulations, or court orders, including tax and financial reporting obligations.

4. How We Use Your Information

• Authenticate users and manage account access
• Provide, operate, and improve the Services
• Process subscription payments and manage billing through PayPal
• Generate AI-powered product artifacts during Product Birth sessions
• Schedule and manage meetings via Google Calendar integration
• Provide customer support and respond to enquiries
• Send transactional communications (subscription confirmations, billing receipts, service notifications)
• Analyse platform usage to improve features and user experience
• Ensure platform security, prevent fraud, and detect abuse
• Comply with legal and regulatory obligations
• Enforce our Terms of Service

5. AI Usage and Data Processing

YouMonkey uses artificial intelligence systems (including large language models and generative AI) to:

• Structure and analyse user-submitted product ideas during conversational sessions
• Generate product artifacts including market analysis, branding, wireframes, and technical architecture
• Create ICP personas, monetisation models, and user journey maps
• Produce design prototypes and visual assets

AI-generated outputs are assistive only. They do not constitute professional business, legal, financial, or technical advice. All outputs should be independently verified before use in business decisions.

We do not use your personal data or proprietary business ideas to train public AI models. Your conversation data and generated artifacts are used solely to provide the Services to you.

Conversation data may be processed by third-party AI providers (such as OpenAI) under strict data processing agreements that prohibit the use of your data for model training. These providers act as data processors under applicable data protection laws.

6. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Required for authentication, session management, and security. These cannot be disabled.
• Functional Cookies: Remember your preferences (e.g., dark mode, language).
• Analytics Cookies: Help us understand how users interact with the platform to improve our Services.

We do not use advertising or behavioural tracking cookies. You may manage cookie preferences through your browser settings.

For users in the EU/UK: Non-essential cookies are only placed with your prior consent in accordance with the ePrivacy Directive (Directive 2002/58/EC) and relevant national implementing legislation.

7. Data Sharing and Disclosure

We may share your personal data only with the following categories of recipients:

• Payment Processor: PayPal, Inc. — for processing subscription payments, managing billing, and handling refunds. PayPal acts as an independent data controller for payment data.
• AI Service Providers: Third-party AI providers (e.g., OpenAI) — for generating product artifacts. These providers act as data processors under data processing agreements.
• Cloud Infrastructure: Hosting and database providers — for storing and serving the platform. Data is encrypted at rest and in transit.
• Authentication Providers: Google — for OAuth authentication and calendar integration.
• Internal Team: Authorised YouMonkey personnel — for service delivery, customer support, and platform administration.
• Legal Authorities: Government bodies and law enforcement — when required by law, regulation, subpoena, or court order.

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

8. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence. When we transfer personal data internationally, we ensure appropriate safeguards are in place:

• EU/UK to Third Countries: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent transfer mechanisms recognised under UK GDPR, to ensure adequate protection for cross-border data transfers.
• Australia/New Zealand: We ensure that overseas recipients comply with the Australian Privacy Principles or New Zealand Information Privacy Principles, or are subject to substantially similar privacy protections.
• UAE: Cross-border transfers are conducted in compliance with the UAE PDPL and any implementing regulations issued by the UAE Data Office.
• Singapore: We ensure that recipients provide a standard of protection comparable to the PDPA, in accordance with the requirements of the Personal Data Protection Act 2012.

All data transfers are protected by industry-standard encryption (TLS 1.2+) in transit and AES-256 encryption at rest.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Account Data: Retained for the duration of your account and for up to 12 months after account deletion, unless a longer retention period is required by law.
• Product Birth Data: Retained for the duration of your account. Upon account deletion, Product Birth data (including conversation history and generated artifacts) will be permanently deleted within 90 days.
• Subscription and Billing Data: Retained for up to 7 years after the end of the subscription to comply with tax and financial reporting obligations.
• Support Tickets: Retained for up to 3 years after resolution for quality assurance and dispute resolution purposes.
• Meeting Recordings: Retained for up to 12 months after creation, then permanently deleted.
• Server Logs: Retained for up to 90 days for security and debugging purposes.

You may request deletion of your account and associated data at any time by contacting us at hello@youmonkey.dev.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at hello@youmonkey.dev. We will respond to verified requests within the timeframes required by applicable law (typically 30 days for GDPR, 45 days for CCPA).

11. Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls with principle of least privilege
• Secure cloud hosting with SOC 2 Type II compliant infrastructure
• Regular security monitoring and vulnerability assessments
• Secure authentication via OAuth 2.0 (no password storage)
• PCI DSS compliant payment processing via PayPal

Despite our best efforts, no method of electronic transmission or storage is 100% secure. If you become aware of a security vulnerability, please notify us immediately at hello@youmonkey.dev.

12. Meeting Recordings and Notes

• Meetings conducted via integrated video conferencing tools may be recorded with prior notice to all participants.
• Recordings and notes are stored securely and accessible only to the client and authorised YouMonkey personnel.
• Meeting data is used solely for project documentation, clarity, quality assurance, and dispute resolution.
• Recordings are retained for up to 12 months and then permanently deleted.

13. YouMonkey Chrome Extension

• What it reads. Only the address (URL) of the tab you are on, and only when you open the extension and choose to tear that site down. It does not read the page's content, your browsing history, other tabs, form fields, passwords or cookies.
• What it sends. That address, to youmonkey.dev, so YouMonkey can read the public website and return a short product card. Our servers fetch the public pages themselves; nothing from your browser session is sent.
• Your account. Connecting the extension gives it a sign-in token that is stored in Chrome's extension storage on your computer. "Sign out" in the extension deletes it and revokes it on our servers.
• What we keep. The sites you asked about (to list them under Teardowns in your account and to apply fair-use limits) and the public product card for each site, which anyone can open at youmonkey.dev/t/<site>. We do not sell this data or use it for advertising.
• Analytics. We count scans and unlocks in our product analytics, tied to your YouMonkey account.

14. Third-Party Links and Services

The Services may contain links to third-party websites or integrate with third-party services (such as PayPal and Google). We are not responsible for the privacy practices of these third parties. We encourage you to review their respective privacy policies before providing personal data to them.

15. Children's Privacy

The Services are not intended for individuals under 18 years of age (or the applicable age of digital consent in your jurisdiction — 16 in most EU Member States, 13 under COPPA in the United States). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate parental or guardian consent, we will take steps to delete that data promptly.

16. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Article 33) and will notify affected individuals without undue delay where required by applicable law. We maintain incident response procedures to ensure timely detection, investigation, and reporting of data breaches.

17. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. As there is no industry standard for DNT compliance, we do not currently respond to DNT signals. We do not engage in cross-site behavioural tracking or targeted advertising.

18. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via email or through a prominent notice on the platform at least 30 days before they take effect. The "Last Updated" date at the top of this policy indicates when the most recent revision was made. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

19. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices: