AI Data Handling

    A plain-language disclosure of what data enters our AI pipeline, how it is processed, retained, and destroyed.

    TL;DR — Your content is never used to train AI models without your explicit written permission. We use zero-retention agreements with providers wherever available. You own your inputs and outputs.

    What Data Enters the AI Pipeline

    • Brand profile data: company name, website URL, industry, target audience descriptions, and messaging preferences you provide.
    • Recording transcripts: text extracted from your founder interviews or uploaded video/audio files.
    • Chat messages: prompts and context you provide to the AI Agent for content generation.
    • Website crawl results: public page content scraped from your domain during onboarding or audits.
    • Competitor and market references: URLs, names, or descriptions you manually enter for benchmarking.

    We do not collect or send to AI systems: payment card numbers, government IDs, health records, or any data you have not explicitly provided for content/marketing purposes.

    How AI Processes Your Data

    We route requests to third-party Large Language Models (LLMs) via API. The models act as processors under our instruction.

    Primary providers

    OpenAI (GPT-4o), Google (Gemini), Anthropic (Claude). We use the latest enterprise API tiers with zero-retention or data-protection agreements where available.

    Processing model

    Your data is sent as ephemeral API requests. It is processed in memory and returned as output. We do not store prompts or outputs in the LLM provider's training corpora.

    No-training policy

    We have opted out of data-use-for-improvement programs with OpenAI and Google. Anthropic does not train on API inputs by default. We will not change this without notifying you 30 days in advance.

    Data Retention & Deletion

    • Transcripts & recordings: Retained for the life of your active subscription plus 30 days, then permanently deleted unless you export them first.
    • Generated content (drafts, posts, pages): Retained as long as your account is active. You can delete individual assets at any time.
    • Chat history: Retained to power long-term memory and context recall. You may request a full chat export or deletion.
    • Analytics & scan logs: Aggregated and anonymized after 90 days. Raw logs deleted after 30 days.
    • Account cancellation: Upon full account deletion, all personal data and content are purged within 30 days. Backups expire per the provider's automated rotation (typically 7–30 days).

    Subprocessors & Data Location

    We use the following categories of subprocessors for AI and data processing:

    • Cloud infrastructure & database: US-East and US-West regions.
    • AI model APIs: OpenAI (US), Google Cloud (US), Anthropic (US). Data may transit through their secure endpoints.
    • Storage & CDN: Encrypted object storage for media and generated assets.
    • Email / transactional: For alerts and notifications only.

    We do not transfer personal data to subprocessors for purposes unrelated to delivering the service.

    Your Controls

    • Export: You can request a full data export (JSON/CSV) of your profile, transcripts, and generated content at any time.
    • Opt-out of memory: If you do not want past chat history to inform future AI responses, contact support to disable long-term memory for your account.
    • Deletion: You may delete individual recordings, drafts, or your entire account. Deletion is irreversible.

    What Happens When You Leave

    If you cancel or do not renew, your account enters a 30-day grace period during which you can still export data. After that:

    • All personal identifiers are removed or anonymized.
    • Transcripts, recordings, and generated content are permanently deleted.
    • Aggregated, non-identifiable analytics may be retained for service-improvement purposes.

    Related Policies

    Questions?

    Contact monica.tomasso@monicaisystems.com for data-handling inquiries, subprocessors list updates, or a signed Data Processing Addendum (DPA).