Monica

GDPR overview

Implementation is partial but real. The privacy policy, last updated on 14 June 2024 and effective since 28 February 2023, carries a dedicated GDPR Privacy section listing the six legal bases and the rights of access, rectification, objection, erasure, portability and withdrawal of consent, exercised through contact@monica.im or account settings. A separate CCPA section covers California residents. The user safety policy claims compliance with the EU Digital Services Act and the EU AI Act. Three gaps matter: no Article 27 EU representative is designated, no data protection officer is named, and the Data Processing Agreement referenced in the terms is nowhere published. Data is declared to be transferred to and stored in the United States, under United States law.

Who owns the data?

The terms state that the company claims no ownership of inputs or outputs: as between you and the publisher, you own your content. Two reservations follow. Section 5.3 grants the company a non-exclusive, worldwide, royalty-free, transferable and sub-licensable licence to use that content while you use the service, plus a perpetual and irrevocable licence to use it in aggregated form to improve the services and create usage data, which the company owns outright. Section 5.4 warns that inputs are passed to third-party AI providers who are not required to keep them confidential and may retain rights to use or disclose them. Customer data is also named as a transferable asset in a sale or bankruptcy.

Reuse rights

Outputs are yours to reuse without asking permission: the publisher claims no ownership and imposes no attribution. Two limits apply. First, the terms warn that an output may not be unique between users and that the company does not warrant it is protectable by any intellectual property right, so exclusivity cannot be assumed for commercial work. Second, reuse must stay within the Usage Policy, which forbids unlawful content, and within the terms of the underlying third-party AI services. On its own side, the publisher uses the data to run and improve the service, to analyse usage and to deliver targeted advertising with third-party vendors, while stating it neither rents nor sells personally identifiable information for advertising monetisation.

Data retention & training

Hosting summary

The privacy policy places the servers and central databases in the United States, and states that information from users outside the country may be transferred, stored and processed there. It adds an explicit warning that the publisher is governed by United States privacy and data protection law, described as very different from the law of the user's own country. No European hosting region, data residency option or standard contractual clauses are offered. DNS resolution points to an Amazon CloudFront node, whose Zurich point of presence is a distribution edge rather than a storage location. Two processors are named in the policy: Amazon SES for email and FastSpring for payments, the latter described as PCI-DSS compliant; no full subprocessor list is published. Declared safeguards are generic — firewalls, encryption, intrusion detection and access restricted to authorised staff. No security certification such as SOC 2 or ISO 27001 is claimed anywhere on the site.