Privacy Policy
Last updated: July 2, 2026. We value your privacy. This policy explains exactly what data we collect, why, and how we protect it.
1. Who We Are
Montu is operated by Heracleon (Single Person LLC), a company registered in Egypt under Commercial Registry No. 194652, National Unified Registry No. 1053-06001-94652 ("Heracleon", "we", "us", "our"). This Privacy Policy explains how we collect, use, store, and protect information about you when you use our marketing automation platform at montuai.com. For privacy-related questions, contact us at contact@montuai.com.
2. Information We Collect
We collect the following information when you create an account or use the Service: • Account information — your full name, business email address, and a securely hashed version of your password. • Business information — your store or website URL, brand profile, target audience, content plan details, and performance data tied to your account. • Site data — results from the automated audits, sitemap crawls, keyword research, and competitor analysis we perform on your domain. • Connected account tokens — when you connect WordPress or Shopify, we securely store the access tokens needed to publish on your behalf. We never store your CMS account passwords. • Generated content metadata — references to articles, products, social posts, and design assets we have produced for you, kept so you can manage your library inside the dashboard. • Usage data — pages visited, dashboard interactions, and session duration, collected via server-side logs only. • Billing information — payment transactions are processed securely by Dodo Payments (dodopayments.com). We receive only a confirmation of successful payment and your subscription tier. We never see or store your card number, billing address, or other financial data.
3. How We Use Your Information
We use your information to: • Provide and operate the Service, including the dashboard, content delivery, and Montu Mind orchestration. (Legal basis: performance of contract — Article 6(1)(b) GDPR) • Run audits, build keyword strategies, and generate content, social posts, and design assets based on the data you have provided. (Legal basis: performance of contract) • Publish content to your connected CMS destinations (WordPress and Shopify) on your behalf, on the schedule you have configured; prepare and queue social posts to your Montu calendar for you to publish manually. (Legal basis: performance of contract) • Authenticate your identity and maintain your session securely. (Legal basis: performance of contract) • Send transactional communications such as billing confirmations and service updates. (Legal basis: performance of contract / legitimate interests) • Measure aggregate, anonymized platform performance to improve our automation pipelines. (Legal basis: legitimate interests — Article 6(1)(f) GDPR. We have assessed that this processing does not override your interests or rights.) • Comply with legal obligations. (Legal basis: legal obligation — Article 6(1)(c) GDPR) We do not sell, rent, or share your personal information with third parties for marketing purposes.
4. Where We Store Your Data
Your account data (name, email, hashed password, plan information, brand profile, generated content metadata, and connected account tokens) is stored in a managed PostgreSQL database (Neon), hosted in the European Union. By using the Service, you consent to the transfer of your data to this location. Access is restricted via TLS-encrypted connections and credentials held only on our deployment infrastructure.
5. Cookies and Tracking
We use a single session cookie to keep you logged in to the dashboard. This cookie is strictly necessary for the Service to function and is not used for advertising or cross-site tracking. We do not load advertising or cross-site tracking pixels. If you accept analytics cookies in the consent banner, we load Google Analytics (GA4) to understand aggregate site usage; declining keeps the site fully functional with the session cookie only. See our Cookie Policy for full details.
6. Third-Party Services
To deliver the Service, we use the following third-party providers who may process your data: • Neon (managed PostgreSQL) — database storage for account, plan, and content metadata. Hosted in the EU. • Vercel — hosting and edge infrastructure for the montuai.com platform. • Vercel Analytics & Speed Insights — privacy-focused, cookieless analytics that collects aggregated page-view counts, referrer data, and web performance metrics. No personally identifiable information is linked to individual visitors. No cross-site tracking. Governed by Vercel's privacy policy. • Dodo Payments — payment processing and Merchant of Record. Dodo Payments processes payments on our behalf and handles card data under their own privacy policy (dodopayments.com). • Connected publishing destinations — WordPress and Shopify, which you authorize Montu to publish to on your behalf. • AI model providers — used to power generation pipelines for content, design, and analysis. We send only the operational context required for each task and do not transmit your account credentials. Your data is not used to train third-party AI models. • Google Analytics (GA4) — loaded only if you accept analytics cookies in the consent banner; measures aggregate site usage. Governed by Google's privacy policy. • n8n — workflow automation engine for content pipeline processing (self-hosted). Each provider is bound by their own privacy and data security policies.
7. Data Retention
We retain your account data for as long as your account is active. If you cancel your subscription, your account data is retained for 90 days to allow for re-activation, after which it may be deleted on request. Content produced for your account is yours and is not deleted by us — it remains in the delivery location (your site, store, or social channel) unless you remove it.
8. Your Rights
If you are located in the EU/EEA or UK, you have the following rights under applicable data protection law: • Access — request a copy of the personal data we hold about you. • Rectification — request correction of inaccurate or incomplete data. • Erasure ("right to be forgotten") — request deletion of your account and associated personal data. • Restriction — request that we limit how we use your data in certain circumstances. • Data portability — receive your personal data in a structured, machine-readable format and transfer it to another controller (Article 20 GDPR). • Objection — object to processing based on legitimate interests. • Disconnect — revoke our access to any connected platform at any time from your dashboard, immediately stopping publishing to that destination. • Complaint — lodge a complaint with your local data protection supervisory authority. In the UK this is the ICO (ico.org.uk); in the EU, your national DPA. To exercise any of these rights, email contact@montuai.com. We will respond within 30 days. We will not charge a fee for reasonable requests.
9. Data Security
We take reasonable technical and organizational measures to protect your data, including: • HTTPS encryption for all data in transit. • Bcrypt hashing for stored passwords (we never store plaintext passwords). • Encrypted storage for connected account tokens. • TLS-encrypted database connections with credentials held only on our deployment infrastructure. • Vercel's enterprise-grade infrastructure security. No system is completely secure. In the event of a data breach that affects your personal information, we will notify you within 72 hours of becoming aware of it.
10. Children
The Service is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, contact us at contact@montuai.com and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email to your registered address at least 14 days before taking effect. The "last updated" date at the top of this page will always reflect the most recent revision.
12. Contact
For any privacy-related questions or requests, contact us at: Heracleon (Single Person LLC) Office 11, 4th Floor, Town Mall Tower Tanta, Gharbia Governorate, Egypt Commercial Registry No. 194652 Email: contact@montuai.com Website: montuai.com
Questions? Email us at contact@montuai.com