Last updated September 5, 2026

Privacy Policy

This policy explains how Monky AI, operated by Rafael Haimov, handles personal information in this application. It describes the current codebase and should be updated whenever data practices change.

Information we collect

• Account information: name, invited email address, company membership, role, account status, and authentication data.
• Workspace content: conversations, files you upload, project membership, governed documents, and memory entries you choose to save.
• Security and operational data: session identifiers, login timestamps, IP addresses recorded with audit events, invitation records, and service-health or error information.
• Web-search queries: when you deliberately enable web search, the relevant query is sent to the configured external search provider so results can be returned.

Why we use it

We use this information to authenticate users, provide the requested workspace features, enforce company permissions, retrieve user-requested information, maintain audit records, troubleshoot the service, and protect accounts and tenant boundaries.

Data minimization

The application is designed to collect information needed for account access and the workspace functions you choose to use. Do not upload personal, confidential, regulated, or sensitive information unless your organization has authorized that use and it is necessary for the task.

Sharing and third parties

This build contains no advertising network, analytics tracker, social-media embed, or third-party iframe. Browser requests for the application are same-origin. If you enable web search, query data is sent server-side to the configured search provider. A deployment may also use infrastructure, email, database, or model providers configured by the operator; those providers should be added to this policy before production use.

Sale, sharing, and targeted advertising

The current application code does not sell personal information or share it for cross-context behavioral advertising. It does not use personal information for targeted advertising.

Cookies and tracking signals

The application uses a strictly necessary session cookie named monky_session for authentication. It does not currently set analytics or advertising cookies. Because no sale or cross-context behavioral advertising is performed by this build, Global Privacy Control and browser Do Not Track signals do not change advertising or sale behavior here. See the Cookie Policy.

Retention

Authenticated sessions are configured to expire after 14 days. Other account, workspace, document, audit, and conversation data may remain until deleted, removed under an applicable workspace process, or no longer needed for the service or legal obligations. Production deployments should define and enforce a documented retention schedule.

Your choices and rights

Depending on where you live and which laws apply to the operator, you may have rights to request access, correction, or deletion of personal information, and to receive information about how it is used. California residents may have additional rights when the California Consumer Privacy Act applies to a business. Exercise requests through your workspace administrator or the legal contact listed below.

Children

Monky AI is a business workspace and is not directed to children under 13. The operator should not knowingly collect personal information from a child under 13 without meeting any applicable parental-consent requirements.

Security

The code includes authenticated sessions, role-based access controls, password hashing, login-rate limiting, audit events, and same-origin browser requests. No security measure is absolute, and this policy does not promise that unauthorized access or data loss can never occur.

Operator and contact

Service: Monky AI
Operator: Rafael Haimov
Privacy contact: use the administrator for the workspace that provided your account. A public contact email must be configured before a public commercial launch.

Changes

When this policy changes, the updated date at the top of the page should also change. Material changes should be communicated to affected users when required.