[ Privacy Policy ]

This Privacy Policy describes the personal data that [À COMPLÉTER : éditeur / société — voir Mentions légales] (« we », « us ») collects, uses, and discloses about individuals (« you ») who use Monarch and its related pages (the « Service »).

« Personal data » means any information relating to an identified or identifiable individual. Your use of the Service is also subject to our Terms of Service.

This product is built to minimise data: no analytics, no advertising, no third-party trackers, no behavioural profiling, and the free-tier limit is not keyed to your IP address.

• —Publisher: [À COMPLÉTER : nom / raison sociale de l'éditeur (personne physique aujourd'hui, société à venir)], [À COMPLÉTER : statut], [À COMPLÉTER : adresse de contact — pas le domicile].
• —Contact: [À COMPLÉTER : email de contact, ex. contact@…] · abuse: [À COMPLÉTER : abuse@…]
• —Publication director: [À COMPLÉTER : nom du directeur de la publication]
• —SIREN / SIRET: [À COMPLÉTER : à renseigner une fois immatriculé, sinon « activité non encore immatriculée »]
• —Application hosting: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (vercel.com).
• —Database hosting: Neon Inc. (neon.tech), on instances in the EU and the US depending on your chosen storage region.

A. Data you provide to us

• —Guest users (no account). We do not ask for any identifying detail. A session cookie keeps your guest session attached to this browser. Conversations are stored only in your browser (see « Conversations » below).
• —Account users. To create an account we collect your email address and a hashed password. A display name is derived from the local part of your email. There is no third-party (Apple / Google / Discord) or crypto-wallet login.
• —Storage region. EU or US, chosen by you, and changeable while your account has no stored data. It determines where your account record is held.
• —Payments. Pro is paid in cryptocurrency through our processor (NOWPayments). We record the plan, amount, status, and the processor's payment reference. We do not receive card numbers, wallet keys, or wallet addresses.
• —Communications. If you contact us, we receive your message, your email address, and anything you choose to include.

B. Data collected automatically when you use the Service

• —Technical / device data. IP address, browser and operating-system type, and request timestamps. Kept minimally, for security and debugging. Not used for fingerprinting and not used to enforce the free-tier limit.
• —Usage records. For each message, a timestamp and the model name — used to enforce the daily free-tier limit and to control cost. Not linked to message content.
• —Conversations. Every conversation — and the folders you organise them into — is stored only in your browser (localStorage). It is never stored on our servers. You can export an encrypted copy from Settings; that file stays on your device unless you move it yourself.

C. Prompts and outputs

To generate a reply, the content of your conversation (« prompts ») is sent to our model provider, OpenRouter, which routes it to the underlying language-model host, and the response (« output ») is streamed back to your browser. We do not store the content of your prompts or outputs on our servers — it is held only in your browser. Every model request instructs OpenRouter to route only to providers whose data policy is « does not collect user data » (« data_collection: deny »); our OpenRouter account is also set to refuse providers that train on data, and OpenRouter's own prompt-logging feature is disabled. We do not use your prompts or outputs to train models. We do not currently claim end-to-end Zero Data Retention across every upstream host.

• —To provide, maintain, and secure the Service, and authenticate you.
• —To generate AI replies to your messages.
• —To enforce the free-tier limit and to detect and prevent abuse and cost runaway.
• —To send transactional email (account and payment-related). We do not send marketing email.
• —To debug, and to keep the Service reliable.
• —To comply with legal obligations, including accounting obligations for payments.
• —To respond to your requests and communications.

We do not use your data for advertising or behavioural marketing, and we do not sell it.

• —Performance of a contract — creating and running your account, generating AI replies, processing payments.
• —Legitimate interests — security, abuse and cost-runaway prevention, minimal technical logging. We balance these against your rights.
• —Legal obligation — retaining payment/accounting records.
• —Consent — not currently relied on; if we ever add a feature that needs it, we will ask first.

Sub-processors

• —OpenRouter — AI inference routing, and the model host it forwards prompts to.
• —Neon — database hosting (EU and US regions).
• —Vercel — application hosting.
• —Resend — transactional email.
• —NOWPayments — crypto payment processing.

Each acts on our instructions for its specific function. We do not use analytics or advertising partners, and we do not disclose data to data brokers.

Other disclosures

• —Legal and safety — we may access, preserve, and disclose data where we believe it is required or appropriate to comply with law or legal process, to protect rights, property, or safety, or to investigate abuse or unlawful activity.
• —Corporate transaction — if the Service is involved in a merger, acquisition, or asset transfer, data may be transferred as part of it, subject to this policy.

If you are in the EEA, Switzerland, or the UK, you can request: access and portability, rectification, erasure, restriction, and you can object to processing based on legitimate interests, and withdraw any consent previously given.

Exercise these by contacting [À COMPLÉTER : adresse de contact]. We may ask for information to verify your identity. Exceptions and limitations apply; changes are reflected in active systems promptly, while backups cycle out over time. You may also lodge a complaint with the French authority, the CNIL (cnil.fr), or your local supervisory authority — we would appreciate the chance to address your concern first.

• —Account data — until you delete your account.
• —Conversations and folders — never held by us; they live only in your browser, for as long as you keep them there.
• —Usage records — [À COMPLÉTER : durée, ex. 90 jours].
• —Technical logs — [À COMPLÉTER : durée courte, ex. 30 jours].
• —Payment / accounting records — for the period required by law (invoices ~10 years in France).

Account and authentication data is stored in the EU. If you choose the US storage region, your account record and usage records are held on infrastructure in the United States, at your request; conversation content is never stored on our servers in either region. Some sub-processors listed above are established outside the EU. Where personal data is transferred outside Europe, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses.[À COMPLÉTER : faire valider la formulation et lister la garantie par sous-traitant / par transfert]

• —Session cookie — set by the authentication system to keep you signed in (guest or account). Strictly necessary, so no consent is required. Removed on logout or expiry.
• —Browser localStorage — not a cookie: holds your conversations and folders (which never leave your browser) and small UI preferences. Cleared when you clear your browser's site data.

No analytics, advertising, or third-party cookies, and no fingerprinting. Because there are no non-essential cookies, there is no consent banner — and that is a property we intend to keep.

Passwords are hashed. Data in transit is encrypted (HTTPS). Access to production data is limited, and we aim to keep the data we hold minimal by design. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

The Service is for adults: it can produce adult content and is 18+. We do not knowingly collect personal data from anyone under 18. In France the age of digital consent is 15; regardless, this Service is not directed to anyone under 18. If you believe a minor has provided us data, contact [À COMPLÉTER : adresse de contact].

We will post any changes on this page; the revised version is effective when posted, and the « Last updated » date above will change.

[À COMPLÉTER : éditeur / société] is responsible for processing your personal data. Questions or concerns: [À COMPLÉTER : adresse de contact].