Privacy Policy

Effective date: July 2, 2026. This Privacy Policy explains how Vanka Inc. collects, uses, shares, retains, and protects information for Monocrat websites, waitlist flows, private beta, and v1 service.

1. Overview

Monocrat is a business operations service for owner-led businesses. We process business records, account information, provider metadata, source refs, and related personal information to provide source-backed follow-up, billing, cash, document, support, review, and trust workflows.

Monocrat is not directed to children and is not intended for personal, family, household, consumer, or child-directed use.

2. Contact

Vanka Inc.
501 Silverside Rd, Ste 105 #5573
Wilmington, DE 19809

Privacy contact: privacy@monocrat.ai

3. Information We Collect

Website And Waitlist

We collect information you provide through the website and waitlist, including email address, name, company, domain, referral source, communications, Google identity information for identity-only OAuth, waitlist status, approval metadata, device/browser metadata, and cookie or similar technology data described in the Cookie & Session Notice.

Account And Product Use

For approved users, we collect account identity, tenant and owner authority records, session metadata, product settings, feature activity, review packages, approval decisions, audit events, support requests, billing and usage metadata, source health, and security logs.

Connected Business Sources

With your authorization, Monocrat may process information from business systems such as Google Workspace, Stripe, Square, Shopify/Shopify Payments, Plaid, manual or POS exports, Moov, uploaded records, invoices, contracts, receipts, calendars, email threads, support conversations, customer records, vendor records, payroll or contractor readiness records, and other business evidence. Connected-source handling is described in the Connected Sources Policy.

Billing And Payments

Monocrat uses Stripe for our own subscription billing, payment methods, invoices, receipts, direct charges, failed-payment recovery, refunds, disputes, and Customer Portal sessions. Monocrat stores Stripe object references, invoice/receipt snapshots, webhook event IDs, reconciliation state, and billing support records. Stripe stores payment instruments.

AI Inputs And Outputs

We may process prompts, source excerpts, structured records, retrieval context, generated drafts, summaries, classifications, embeddings, citations, review notes, and model outputs to provide the service. See AI & Provider Processing.

4. Cookies And Sessions

Monocrat uses required cookies, OAuth state records, product session identifiers, local browser storage, and similar technologies to operate the website, protect Google sign-in and OAuth flows, bind approved owner sessions to the correct tenant, prevent unauthorized access, maintain security, and support product functionality. See the Cookie & Session Notice.

5. Google API Data

Public waitlist sign-in uses identity-only Google OAuth scopes such as OpenID, email, and profile. Product onboarding for approved users may request Google Workspace scopes for Gmail, Drive, and Calendar only when needed to provide user-facing product functionality and after a separate permission flow.

Monocrat uses Google API data to provide and improve user-requested product functionality, secure accounts, maintain source health, prepare owner-reviewed workflows, and comply with legal or security obligations. We access, use, store, and share Google API data only as described in this Privacy Policy, in-product disclosures, and the permission request shown during the Google OAuth flow. Monocrat may store Google OAuth tokens in encrypted form, source-health metadata, provider identifiers, source refs, selected message/file/calendar content needed for enabled workflows, derived records, audit logs, and support/security records. We share Google API data only with subprocessors needed to provide, secure, support, or audit the service, or as required by law or your direction. We do not sell Google API data, use it for advertising, or use it for generalized AI model training. Monocrat's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How We Use Information

operate the public website, private beta waitlist, approval flow, and product onboarding;
authenticate users, bind owner authority, protect sessions, and prevent unauthorized access;
connect authorized business sources and build source-backed product context;
provide, debug, secure, monitor, and improve Monocrat features;
draft, classify, summarize, route, and explain business information with source refs;
run billing, usage-credit, invoice, receipt, direct-charge, refund, dispute, and support workflows;
send service, billing, approval, security, support, source-health, and product notices;
comply with law, provider requirements, accounting, tax, security, legal, and audit obligations.

7. How We Share Information

We share information with service providers and subprocessors that help us operate Monocrat, including hosting, database, cloud infrastructure, security, authentication, email, AI processing, billing, payment processing, support, analytics, and observability providers. See Subprocessors.

We also share information with connected services you authorize, with professional advisers, in corporate transactions, to comply with law or legal process, to protect rights and safety, to investigate abuse or security issues, and with your direction or consent.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

8. Public Trust Claims

Monocrat's Trust Graph features are designed to publish only scoped, record-backed, consent-appropriate business claims. Internal business evidence is not automatically public. Public claims require source refs, freshness, claim verification, consent or publication authority, and review checks. Account deletion may handle public-derived and tenant-derived claims differently as described in Account & Data Controls. Public claim publication, correction, takedown, revocation, counterparty consent, and provenance handling are described in the Trust Graph Publication Policy.

9. Security

We use administrative, technical, and organizational safeguards designed to protect information, including tenant isolation, access controls, encryption, secret management, security monitoring, audit logs, source health checks, and action gates for high-stakes surfaces. No system is perfectly secure. See Security.

10. Retention, Deletion, And Export

We retain information for as long as reasonably needed for the service, billing, support, security, legal, tax, accounting, dispute, audit, incident, abuse-prevention, and product purposes, unless a different retention period is required or permitted by law.

Confirmed account deletion, legally valid erasure requests, and supported provider privacy redaction requests delete in-scope tenant-private Monocrat data from live serving systems within 30 days, subject to retained categories such as backups, logs, payment/tax records, dispute records, fraud/abuse records, legal holds, and provider records. v1 does not offer arbitrary bulk self-serve export. See Account & Data Controls.

11. Your Choices And Rights

You may request access, correction, deletion, export support, source disconnect, or other privacy assistance by contacting us or using available product settings. Approved users may revoke connected-service access through Monocrat settings where supported or directly through the provider. Some information may be retained where required or permitted for legal, billing, tax, accounting, security, audit, dispute, abuse-prevention, or operational reasons.

Depending on your location, you may have rights to know, access, correct, delete, port, restrict, or object to certain processing, and to appeal a decision. We will not discriminate against you for exercising applicable privacy rights. To submit a request, email privacy@monocrat.ai.

12. Sensitive Data And Regulated Data

Monocrat is designed for business operations data. Do not provide protected health information, consumer credit reports, government identification numbers, card numbers, special-category data, children's data, or other highly regulated data unless we have expressly agreed in writing and the product surface supports that use.

13. International Processing

Monocrat is operated from the United States. If you use the service from another jurisdiction, your information may be processed in the United States and other countries where Monocrat, subprocessors, or connected providers operate.

14. Changes

We may update this Privacy Policy by posting an updated version or notifying you through another reasonable channel. The effective date will identify the latest version.