Version
Version 1.0 · Draft for legal review · Effective date to be confirmed
About this policy
This policy covers personal information we collect and decide how to use (as a “controller”), about:
- visitors to our website and people who contact us or book a demo;
- people who use the Monty app for a business, such as owners, managers and staff (“users”);
- staff members added to a venue’s Monty account;
- partners and agents, and the business contacts they tell us about.
If you are a guest who left feedback or a review through a Monty page, the Guest Privacy Notice explains what happens to your information.
Who we are
Monty is provided by [company name], a company registered in England and Wales under company number [company number], whose registered office is at [registered office address] (“Monty”, “we”, “us”). We are registered with the Information Commissioner’s Office under registration number [ICO registration number]. For anything about this policy or your personal information, contact us at help@monty.reviews.
Controller and processor
Data protection law gives organisations different roles:
- We are the controller for the information described in this policy: we decide why and how it is used.
- We are a processor for the information a venue collects about its guests and staff through Monty, such as feedback and contact details. The venue is the controller and decides how that information is used; we handle it on the venue’s instructions under our Data Processing Agreement.
What we collect
When you visit our website
Our website runs no advertising. If you accept analytics cookies in the cookie banner, it uses Google Analytics to count visits and see which pages are used; if you don’t, nothing is sent to Google Analytics (see our Cookie Policy). Our hosting provider records technical information such as your IP address, browser and the pages requested, to deliver the site and keep it secure. Fonts are loaded from Google, which receives your IP address when they load. See the Cookie Policy.
When you contact us or book a demo
If you use our contact form, we collect your name, email address, and anything else you choose to give us: phone number, business or venue name, type and number of venues, the topic and your message. If you book a demo, Calendly collects your booking details on our behalf. If you subscribe to our newsletter, we collect your email address.
When you use the Monty app
- Account details: your name, email address, job role, time zone and profile photo, and the business and venue details you add.
- Sign-in and security: sign-in links and codes, password (stored in a scrambled form we can’t read), and records of sessions and sign-ins.
- How you use the app: pages you view, what you click, links you follow and which features you use, linked to your account when you are signed in. See Product analytics.
- Support: messages you send to our support team or ask our help centre assistant.
- Billing: your billing contact details, plan and payment history. Card and bank details are collected and held by Stripe; we don’t see or store full card numbers.
About staff members
When a venue adds you as a staff member, we hold your name, email address, phone number and photo if given, your role and the areas you look after. Monty also records your activity in the service, such as feedback collected through your touchpoints and alerts you handle. If you have a staff wallet pass, it is created through PassKit. The venue decides how this information is used (see Controller and processor); we also use it to run and secure the service.
About partners and agents
If you are a partner or agent, we hold your name, contact and business details, the clients and leads you manage, your commission and payout records, and your Telegram details if you choose to receive alerts there. Payouts are made through Stripe, which collects your identity and bank details. Leads you add, including from your own sign-up sheets, contain business contact details, which we hold for you in your portal.
Public business information
To set up venues, design touchpoints and provide local search insights, we use public information about businesses, such as details from Google Maps and a venue’s own website. This is about businesses, but can include the names of people who run them.
How we use it, and our lawful bases
| What we use it for | Lawful basis |
|---|---|
| Providing the Monty app and your account, including alerts, reports and integrations | Contract |
| Answering enquiries, demos and support requests | Legitimate interests (responding to you), or contract |
| Billing, payments, payouts and keeping financial records | Contract and legal obligation |
| Keeping Monty secure, and preventing fraud and misuse | Legitimate interests |
| Understanding how the app is used, and improving it | Legitimate interests |
| Sending service messages, such as sign-in links, alerts and changes to our terms | Contract |
| Sending our newsletter and marketing to business contacts | Consent, or legitimate interests where the law allows; you can opt out at any time |
| Running the partner programme, including commission and payouts | Contract |
| Complying with the law, and establishing or defending legal claims | Legal obligation and legitimate interests |
Product analytics
The Monty app uses FeaturePulse to understand how it is used: which pages people view, what they click, which links they follow and which features they use. For signed-in users this is linked to their account, email address, name and company, so we can see which features are useful and where people get stuck. We use this to improve Monty, and don’t sell it or use it for advertising. You can ask us to stop analytics for your account at any time by emailing help@monty.reviews.
Artificial intelligence
Some Monty features use AI provided by third parties, currently OpenAI: drafting replies to reviews, summarising feedback and guest issues, suggesting actions, generating reports and designs, and our help centre assistant. To do this we send the provider the text the feature needs, such as a review or a message. The provider’s terms do not allow it to use this data to train its models. A reply drafted by AI is only published if someone at the venue chooses to publish it.
Who we share it with
- Service providers that host and run Monty for us, such as our database, email, messaging, payments, analytics and AI providers. They may only use the information to provide their service to us. The full list is on our Sub-processors page.
- Integrations you connect, such as review platforms, WhatsApp, Mailchimp or MailerLite, which receive what the integration needs.
- The business you work with: a venue’s account holders can see their users and staff, and a partner who manages an account can see that account.
- Professional advisers, such as lawyers and accountants, where needed.
- Authorities, where the law requires it or to protect people’s safety.
- A buyer or successor, if our business is sold or reorganised, under the same protections.
We do not sell personal information.
International transfers
Our main database is hosted in the European Union, in Sweden, which the UK recognises as providing adequate protection. Some of our providers, including those for AI, payments, email and hosting, are based in or process data in the United States and other countries. Where information leaves the UK, we rely on UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum, together with any further safeguards needed. You can ask us for details.
How long we keep it
| Information | How long |
|---|---|
| Account and user details | While the account is open, then 30 days for you to request a copy, then deleted |
| Billing and financial records | 6 years after the end of the financial year they relate to, as UK tax law requires |
| Enquiries and contact form messages | 2 years from our last contact |
| Support conversations | While the account is open, then 2 years |
| Product analytics | [FeaturePulse retention period] |
| Newsletter subscriptions | Until you unsubscribe |
| Backups | Deleted on a rolling basis, within 30 days |
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use it, or object to our using it, including for direct marketing;
- ask for information you gave us in a portable format;
- withdraw consent where we rely on it.
To use any of these rights, email help@monty.reviews. We will reply within one month. If your request is about information a venue collected through Monty, we will pass it to the venue, as the controller, and help it respond.
Security
We protect personal information with measures that include encryption in transit, encryption at rest by our hosting providers, role-based permissions in the Monty app, and limiting our own staff’s access to what their work requires. No system is completely secure, but we work to keep Monty protected and will tell you and the regulator about a breach where the law requires it.
Children
Monty is a service for businesses and is not aimed at children.
Cookies
Our Cookie Policy explains the cookies and browser storage used by our website, the Monty app and the pages guests see.
Changes to this policy
We may update this policy. If we make significant changes, we will tell account holders by email or in the app. The date of the latest version is shown at the top of this page.
Questions and complaints
If you have a question or concern, contact us at help@monty.reviews and we will do our best to help. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.