Privacy & Cookies

This page explains what personal data MonkStreet collects, why we collect it, how we use it, who we share it with, and what rights you have. We've tried to make it readable. The structure follows what GDPR requires, but the language is plain English.

If anything here is unclear, email us at [email protected] and we'll explain.

Who's responsible for your data

The data controller for MonkStreet is Gestoría Administrativa C.G., S.L.P., the Spanish company that operates the MonkStreet platform.

• Legal name: Gestoría Administrativa C.G., S.L.P.
• Tax ID (NIF): B87121075
• Registered address: C/ Alfonso Rodríguez Santamaría, 29, Bajo, 28002 Madrid, Spain
• Email for data protection matters: [email protected]

We have not appointed a Data Protection Officer because we're not required to under Article 37 of the GDPR. For all data protection matters, contact us at the email above.

What personal data we collect

We try to collect as little as possible. Here's the actual list:

When you create an account with email and password:

• your email address
• a check of your email address: we check the address's format, compare its domain with a list of throwaway (disposable) email domains kept on our own servers, and look up whether the domain can receive email (a DNS lookup of the domain only, the part after the @); apart from that lookup, nothing is sent to a third party for this check.
• a hashed version of your password (we never store the password itself)
• your first name and last name
• an email verification code (temporary, used only to confirm your email is real, then expires)
• a password reset code if you ask for one (temporary, it expires after 15 minutes)
• account timestamps (when you signed up, verified your email, last logged in, last changed your password and last used MonkStreet)

When you create an account with Google sign-in:

• your email address
• your first name and last name (as provided by Google)
• your profile picture URL (as provided by Google)
• a one-way hash of your Google account ID (we don't store the ID itself)
• account timestamps (when you signed up, when you last logged in, when you last used MonkStreet)

When you sign up (either way):

• your answer to "I manage money for clients", the date you gave it, and whether it gives you a personal or a professional license
• a record each time you accept our Terms of Service: the version, the date and time, where you accepted (signup, checkout, a firm invitation or a move to the Advisor plan), and your IP address and browser type (when you sign up, join a firm or move to the Advisor plan). For a checkout we keep Stripe's reference for it instead.
• whether you agreed to receive our newsletter and marketing emails, when you agreed or withdrew, where you chose (at signup or in your settings), the version of this policy you saw, and your IP address and browser type at that moment. We record this when you sign up, even if you say no, and again each time you change it in your settings.
• the pricing version in force when you signed up, for example "2026-10-v1", even if you never subscribe
• if you came to MonkStreet from a link with campaign tags or from an ad in the 90 days before you signed up, and marketing cookies are still allowed when you sign up: those tags and the ad click identifier

When you subscribe to a paid plan:

• billing information collected by Stripe on our behalf: your name and billing address. We ask for a billing address with every purchase. We don't ask for a tax ID.
• payment details Stripe shares with us: your customer ID, your subscription status, your payment history (amounts, dates, status and receipts) and your payment method: for a card, its brand, last four digits and expiry date, and the wallet if you used one (Apple Pay or Google Pay); for a bank account, its last four digits; for PayPal, your PayPal email address
• subscription state we keep on your account record: your Stripe customer and subscription IDs, your current plan and its status, your subscription and trial start and end dates, when your current billing period ends, when you cancelled, when you first paid and for which invoice, whether the first payment after a trial failed, and, on the Advisor plan, how many extra seats you pay for
• your plan, its billing term (one year or two years) and your pricing cohort — a label for the pricing version you subscribed under, for example "2026-10-v1". Stripe also holds your email address, your name and our internal ID for your account. With your subscription, we store in Stripe the cohort and, if you arrived from an ad or a link with campaign tags, the ad click identifier and those tags.
• if you arrived from a Google ad: with the first payment of each subscription you start, our server tells Google Ads the ad click identifier, the amount, the currency, the time of the payment and our invoice reference, and tells it, by our invoice reference, if that payment is later refunded. We keep a record of what we sent (see "Ad conversion records" below).
• whether your subscription is a gift from us

We keep a record of each billing email we send you (for example trial reminders, receipts and renewal notices) and of each Sunday email: its type, when we sent it, whether it went out, and the subscription, invoice or payment it was about, with the amount for billing emails. For a Sunday email we also note whether you opened MonkStreet from one of its links or answered one of its questions. We don't keep the email's text or your email address.

We don't see or store your full card number, CVV, or full bank account number. Stripe handles all of that directly. For a card, it shares with us the brand, the last four digits, the expiry date and the wallet you paid with, if any (Apple Pay or Google Pay); for a bank account, the last four digits; for PayPal, your PayPal email address.

When you use the platform:

• watchlists, screens, and other content you create
• if you share a screen: anyone signed in who opens your link gets a copy that shows your name. It stays in their Ideas until you delete the screen or your account; turning sharing off doesn't remove copies people already have.
• a log of which companies you've analyzed on MonkStreet, used to power features like recent activity and to help us improve the product
• your credit balance, the credits you buy (with Stripe's payment reference and your email address) and the research memos you unlock with them (which company and when)
• your notification preferences (what kinds of updates you want to receive from us)
• your display settings, if you change them: language (US or UK English) and light or dark mode
• your activity on the platform — which pages you visit and which features you use — measured by our analytics tools and, where analytics cookies are on, recorded by Hotjar; used to improve the service and detect issues. When you sign in, our analytics tool also receives an internal ID for your account, not your name or email address.
• your IP address, which our servers receive with every request. It appears in our server logs, which we keep for approximately 30 days for security and debugging. To stop abuse, we also count requests by IP address, and login attempts by the email address typed in (even if no account uses it). We delete these counts 30 days after the last request.
• browser type and device (stored with your signed-in devices, your terms acceptances and your email-preference record)
• for each device you sign in on: the browser and operating system, the IP address it last used, and when it signed in and was last active (and, once it is signed out, when and why). You can see the devices you're signed in on in your account settings, under "Where you're signed in", and sign any device out from there.

If you are part of a firm (Advisor plan):

• the firm's name, its members and their roles (owner or member), and its invitations
• the email address of each person the firm owner invites. We use it only to send the invitation and to manage the seat.
• which member used the firm's credits
• for each invitation and seat: who sent it, when it was sent and when it ends, when the person joined, with a record of their acceptance (IP address and browser type, as at signup), and when and why the seat ended (for example, the invitation expired or was withdrawn, or the member left or was removed). When you join a firm, we also record that you manage money for clients (the professional license), unless your own subscription is still running.

The firm owner can see each member's name and email address, and the email address of each pending invitation (a name appears only once the person joins). The owner can also see whether each person is the owner or a member, when they were invited and joined, when a pending invitation ends, and whether each member has a seat. While the firm's Advisor plan is active, the owner and every member with a seat share one credit balance: each of them can see it, and can open any memo that someone in the firm unlocked with the firm's credits. We record which member used the firm's credits, but we don't show the owner who used them, when members sign in, or what they do on the platform. Members can see the firm's name and the owner's name, but not the other members or anyone's email address.

When you import holdings from a file:

• We read your file in your browser. To find the companies in it, we send our own server the ticker, ISIN, exchange and company-name cells of each row; it matches them and doesn't keep them. We keep only the companies you confirm and, if you answer our optional question the first time you import, how many of your holdings already had an exit plan, with how many companies you imported and the date (we also copy the exit-plan number to our email tool, Kit). We do not keep the file.
• To understand how your file is laid out, we send the first 10 rows of your file to our AI provider, Anthropic. These rows usually include the column headings and any lines above them. Before we send them, we replace every number with #. Other text in those rows, such as an account name, is sent as it is. We send nothing else with them: not the file's name, and not your name or email address. This happens as soon as you choose the file, so remove anything you don't want to share before you choose it.

When you add holdings and exit lines:

• the companies you hold
• for each one, your exit line (90 unless you change it), the action you chose for when the MonkScore drops below it (sell, review it, or keep it anyway) and any note you add
• your answers to our Sunday email ("I did", "Not yet", "I changed my mind")
• counts of how often you check a score and how many of our Sunday emails you read. A check is each time you open a company's page while signed in (opening the same company again straight after, on the same day, doesn't count again). We count a Sunday email as read only when you follow its "Open your holdings" link while signed in, or answer one of its questions. The Sunday email has no tracking pixel, so just opening it doesn't count. Your running total of Sundays read is shown in each Sunday email. We also send both counts to our email tool, Kit, with how many holdings you have, how many of them have an action chosen below your exit line, and your holding with the highest MonkScore, with that score (see the Kit entry below). When you add a company to a portfolio or remove one, Google Analytics also receives which company it was and an ID for the portfolio (see the Google Analytics entry below).

When you contact us or submit feedback:

• whatever you write to us (message content)
• your name and email address (so we can reply)
• for messages you send from inside the app: the page you were on, the kind of message (for example feedback or a problem report), your rating if you gave one, and your account ID
• for the contact form on our website: whether you came from the Institution link on our pricing page

When you answer "How likely are you to recommend MonkStreet?" in the app:

• your score (0 to 10), when you answered, at what point we asked (for example, two weeks after you joined, or a week after you subscribed), and when we last asked you
• we also tag you in our email tool, Kit, as a promoter, a passive or a detractor, based on your latest score

When you cancel, delete your account, or answer our short survey:

• your answer to "What stopped you?", any text you add (you can add text only with "Something else", and we remove email addresses from it), the date you answered, what led to the question (cancelling during the trial or after paying, a failed first payment, or a refund), where you answered (in an email, after cancelling in the app, or when deleting your account), your account type (Investor or Advisor) and your pricing cohort

When you subscribe to our newsletter:

• your email address
• if you sign up on our website, the page you signed up on
• if you choose in the app, the record of your choice described under "When you sign up" above

What we do NOT collect:

We don't collect your phone number, date of birth, gender, nationality, identification number, passport number, or home address — other than the billing address Stripe collects when you pay. If you ever see a form on MonkStreet asking for these, something has gone wrong. Please tell us.

Why we collect it (and the legal basis)

GDPR requires us to tell you not just what we collect, but why, and which legal basis under Article 6 allows us to process it. Here's the breakdown:

What we use it for	Legal basis
Creating and managing your account	Contract performance — we can't provide the service without it
Providing the features you use: watchlists, screens and sharing them (people you share with see your name), your credits and memos, and your notification settings	Contract performance
Authenticating you when you log in	Contract performance
Processing your subscription and payments	Contract performance
Issuing invoices and complying with Spanish tax law	Legal obligation
Answering your messages and feedback, and providing customer support	Contract performance for customers; legitimate interest for everyone else — answering your questions
Detecting and preventing fraud, abuse, or security incidents	Legitimate interest — keeping the platform safe for everyone
Showing you the devices signed in to your account, so you can sign one out	Legitimate interest — keeping your account safe
Improving the platform based on usage patterns	Legitimate interest — making the product better
Measuring our advertising and analytics with cookies, and telling Google Ads from our server when one of its ads led to a paid subscription	Consent in the EU, the EEA and the UK, and wherever we can't tell where you are; legitimate interest elsewhere, where you can opt out at any time. Turning marketing cookies off doesn't remove the ad click identifier and campaign tags already stored with your account; email us and we'll remove them (see "Marketing cookies")
Google's cookie-free measurement before you choose (see "What loads whatever you choose")	Legitimate interest — measuring visits and ad results without cookies
Counting page views and measuring page speed without cookies (Vercel), and receiving error reports from our sites and servers (Sentry), whatever your cookie choice	Legitimate interest — keeping the service fast and working
Sending you newsletter or marketing emails	Consent — you can withdraw it anytime
Sending every account holder emails about getting started and using MonkStreet through our email tool Kit, including trial reminders and, after a subscription ends, emails inviting you back, chosen by your plan, trial status, firm role, in-app rating and how you use MonkStreet	Legitimate interest — helping you get value from the service
Showing you your history of the companies you've analyzed, and your streak	Contract performance
Responding to your data protection requests	Legal obligation
Defending ourselves in legal disputes	Legitimate interest
Recording your plan declaration, your acceptance of our terms, and your email marketing choice (with the IP address and browser type you made it from)	Contract performance; legal obligation — showing you gave consent; and legitimate interest — proving what was agreed
Managing firm accounts, seats and invitations	Contract performance with the firm; legitimate interest for the people it invites
Keeping a record of what our team did on your account	Legitimate interest — showing what was done if a claim arises
Reading the layout of a file you import	Contract performance
Keeping your holdings and exit lines, and sending your Sunday email	Contract performance
Analysing our prices and plans by pricing cohort, and reading survey answers and recommendation scores	Legitimate interest — improving our plans, prices and product

If we want to use your data for a new purpose, we'll update this policy before we start, and ask for your consent where the law requires it.

How long we keep your data

We keep your personal data only as long as we need it for the purposes above. Specifically:

• Account data: kept while your account exists, even if you stop using it. Deleted from our primary database when you delete your account, except the records listed below.
• Payment and invoice records: Spanish law requires us to keep invoices and payment records for 6 years after the transaction. Stripe holds the invoices and payments for your subscription, and the details we stored with it; we hold our own record of credit purchases (see "Credit records"). We don't currently delete these records automatically when the 6 years end.
• Ad conversion records: if one of our Google ads led to your paid subscription, we keep the ad click identifier, the subscription and invoice IDs, the amount paid and your pricing cohort, so we can correct what we told Google Ads if you get a refund. They carry no name or email address. We don't delete them when you delete your account, or after a set period.
• Server logs (including IP addresses): approximately 30 days, then auto-deleted.
• Abuse-prevention counts: the counts of requests by IP address, and of login attempts by the email address typed in, are deleted 30 days after the last request.
• Signed-in devices: kept while you're signed in on that device. Deleted automatically within 37 days after the device was last used or after you sign it out, and at once when you delete your account.
• Email records: the record of the billing and Sunday emails we sent you is kept while your account exists, and deleted with it.
• Newsletter subscription: kept until you unsubscribe. After that, Kit keeps your email address marked as unsubscribed, so we don't email you again. Ask us at [email protected] and we'll delete it.
• Database backups: our backups roll on a 30-day window. After you delete your account, residual data may persist in backups for up to 30 days before being overwritten.
• Analytics and error-tracking providers: our analytics, session-recording, error-tracking and web-analytics providers (Google Analytics, Hotjar, Sentry and Vercel) keep what they received for their own retention periods. We don't ask them to delete it automatically when you delete your account, but we will if you ask us at [email protected]. Meta and Google Ads keep what their advertising tools collected under their own terms (see note ¹ under "Who we share your data with"). Kit and Stripe keep their own entries, as described in this list.
• Email tool (Kit): when you delete your account, we unsubscribe you from Kit at once, and we remove your record from Kit within 30 days.
• Terms acceptance records, your plan declaration and your email marketing choice: kept while your account exists, and deleted with it. If you accepted the terms at checkout, Stripe also keeps that acceptance with the payment session.
• Survey answers: kept to improve our plans and prices. When you delete your account, we remove your account and subscription IDs from them and keep them without your name or email address, together with your account type, pricing cohort and the date you answered. Text you wrote stays as you wrote it, except email addresses, which we remove when you send it.
• Messages you send us: what you send through our contact form or in-app feedback, and emails to [email protected], are kept in our inbox and on our automation server for as long as we need them to answer you and follow up. Ask us at [email protected] and we'll delete them.
• Imported files: not kept. We discard the file when the import ends.
• Firm invitations and seats: an invitation that is never accepted is deleted 30 days after it ends (it ends when it expires, 14 days after it is sent, or when the firm owner withdraws it). A seat that someone accepted is kept while it is held and deleted 5 years after it ends, for example when the member leaves or is removed, or the firm closes.
• Records of what our team did on your account: when someone on our team signs in as you to help with a problem, gives you a subscription, or deletes your account, we keep a record of who did it, when, why and what they did, with your email address and your Stripe and Kit account IDs. We delete it automatically 5 years after it was made, the period in which legal claims can be brought in Spain.
• Firm records: a firm's name and owner are kept while the owner's account exists, so a closed firm reopens with its name and remaining credits if the owner subscribes to the Advisor plan again. Once the owner deletes their account, we delete the firm record 5 years after the firm closed, together with the firm's list of unlocked memos. From then on, those memos no longer appear in the former members' history. Our credit records still show which member used a firm credit on which memo (see "Credit records").
• Credit records: when you delete your account, we cancel your credits and keep a record of credit purchases and use (including which member used a firm's credits, and on which memo), without your email address, for our accounts. We don't currently delete these records after a set period.
• Shared screeners: when you delete a screener or your account, we delete the shared copies that show your name to the people you shared it with. A copy someone already saved to their own screens stays with them.

Who we share your data with

We share your data with the providers below, who help us run MonkStreet, and only for the purposes listed. Most of them act only on our instructions (as sub-processors), under a data protection agreement. Meta and Google also use what their advertising tools collect for their own purposes, under their own terms (see note ¹). Other people see your data only where this policy says so, for example the owner of a firm you join, or someone you share a screener with.

Sub-processor	What they do	Where they're located	Transfer safeguard
MongoDB Atlas	Database hosting	Ireland (EU)	EU-hosted, no international transfer required
Vercel	Web hosting and serverless functions	United States	EU Standard Contractual Clauses (SCCs) + EU-US Data Privacy Framework
Cloudflare	Network and security layer in front of our websites and automation server. Every page of www.monk.st and app.monk.st that you open, every form you send on www.monk.st, and the in-app feedback our server passes to our automation server go through it.	United States	EU SCCs + EU-US Data Privacy Framework
Heroku (Salesforce)	Backend application hosting	United States	EU SCCs + EU-US Data Privacy Framework
Stripe	Payment processing	Stripe Payments Europe Ltd., Ireland (EU); Stripe also processes data in the United States	EU SCCs + EU-US Data Privacy Framework
Hetzner	Hosts our automation server (n8n). It runs our data, scoring and AI research jobs, and it receives what you send through our contact form, in-app feedback form and newsletter sign-up: your name, email address and message; for in-app feedback also its type, your rating, the page you sent it from and our ID for your account; for the newsletter, only your email address and the page you signed up on, which it passes on to Kit.	Nuremberg, Germany (EU)	EU-hosted, no international transfer required
Google (Workspace and Sign-in)	Sign-in with Google, and our email inbox: what you email us at [email protected] is kept in Gmail	United States	EU SCCs + EU-US Data Privacy Framework
Amazon SES (Amazon Web Services)	Transactional email delivery: your email address and the emails we send you, such as verification codes, billing emails and the Sunday email	London, United Kingdom	UK adequacy decision (the European Commission recognises the UK as protecting personal data adequately)
Google Analytics ¹	Usage analytics: which pages you open and what you do on them, for example the companies you look at, search for or add to a watchlist or portfolio, what you type in the company search, the names you give your watchlists, portfolios and screeners, the plans you look at and buy, and, when you sign up, whether you said you manage money for clients. When you sign in, we also send it our internal ID for your account and how old your account is. We don't send Google your name, email address or phone number. On app.monk.st, Google Ads receives the same events.	United States	EU SCCs + EU-US Data Privacy Framework
Vercel Web Analytics and Speed Insights	Page-view counts and page-speed measurements for app.monk.st, without cookies. They run for every visitor, whatever your cookie choice.	United States	EU SCCs + EU-US Data Privacy Framework
Hotjar (part of Contentsquare) ¹	Session recordings and heatmaps of how visitors use our sites: where you click and scroll, and what the page shows, including app pages you see while signed in, such as the companies on your watchlists and in your holdings. Parts we hide from recording, such as the preview of a file you import, don't appear.	Ireland (EU)	EU-hosted
Sentry	Error tracking and debugging. An error report can include our internal ID for your account and, rarely, your email address.	United States	EU SCCs + EU-US Data Privacy Framework
Kit (formerly ConvertKit)	Email platform: we keep the first name and email address of every account holder who has confirmed their email address, with tags about your account (your plan, trial and subscription status, your pricing cohort, whether you said you manage money for clients, your role in a firm, and, if you answered our "How likely are you to recommend MonkStreet?" question, whether your score was high, middle or low) and a few fields about how you use MonkStreet (how many scores you checked, how many holdings you have and how many of them have an action chosen below your exit line, how many Sunday emails you read, how many of your holdings already had an exit plan when you imported them, and your holding with the highest MonkScore, with that score). We use them to send onboarding and account emails, including trial reminders and, after a subscription ends, emails inviting you back. Kit also keeps the email address of everyone who signs up for our newsletter, and the page they signed up on. Newsletters and other offers go only to people who opted in. Kit can record whether you open its emails and which links you click, and it tells us when an email to you bounces or is marked as spam, so we stop sending you newsletters and offers. When you delete your account, we unsubscribe you from Kit at once and remove your record from Kit within 30 days.	United States	EU SCCs + EU-US Data Privacy Framework
Meta (Facebook) Pixel ¹	Advertising measurement and retargeting on Facebook and Instagram: it tells Meta which of our pages you open, with your IP address and browser type (no email address or other form data)	United States	EU SCCs + EU-US Data Privacy Framework — see note ¹
Google Tag Manager, Google Ads ¹	Loading our analytics and advertising tools (Tag Manager); advertising and conversion tracking (Google Ads). If you came to us from one of our Google ads and later pay for a plan, our server tells Google Ads the ad click identifier, the amount, the currency and the date of the first payment of each subscription you start, and later any refund of that payment.	United States	EU SCCs + EU-US Data Privacy Framework — see note ¹
Anthropic	AI features: research memos (we send only which company to research and public information about it, never anything about you) and the layout of files you import (we send the first 10 rows of the file with every number replaced by #; other text in those rows, such as an account name, is sent as it is). We don't attach your name, email or account to these requests.	United States	EU SCCs, in Anthropic's Data Processing Addendum
AI providers for earnings-call summaries (today xAI and Anthropic; this can change)	Summaries of companies' earnings calls. We send only the company, the quarter and public information about it, never anything about you.	United States	No personal data is sent

¹ In the EU, the EEA and the UK, and wherever we can't tell where you are, the Meta pixel loads only if you accept marketing cookies, and Hotjar only if you accept analytics cookies. Google Tag Manager, which loads these tools, runs for everyone. Google Analytics and Google Ads share one Google tag that follows Google's Consent Mode. On www.monk.st it loads only once you accept analytics cookies. On app.monk.st it loads for every visitor: until you accept, it sets no cookies, but it still sends Google cookie-free measurements of what you do in the app, such as that a page was viewed, which company you opened, what you searched for, the name you gave a new watchlist or portfolio, or that someone signed up, together with your IP address and browser type. Everywhere else these tools are on by default. If your browser sends a Global Privacy Control signal, or you use "Do Not Sell or Share My Personal Information", the Meta pixel doesn't load, Google sets no advertising cookies, and we delete our own ad click and campaign cookies. See "What loads whatever you choose" in our Cookies Policy.

We don't sell your personal data for money. Some US state laws, such as California's, may treat our advertising tools (the Meta pixel and Google Ads) as "selling" or "sharing" personal data. You can turn them off at any time with the "Do Not Sell or Share My Personal Information" link at the bottom of www.monk.st, and of the app once you're signed in, or with a Global Privacy Control signal. One exception: if you had already signed up while marketing cookies were allowed, the ad click identifier and campaign tags already stored with your account stay, and the click identifier is sent to Google Ads with the first payment of each subscription you start, and Google Ads is told if that payment is later refunded; email [email protected] and we'll remove them (see "Marketing cookies" in our Cookies Policy).

International data transfers

Some of our providers are outside the European Economic Area: most of them in the United States, and Amazon SES in the United Kingdom. When we transfer your personal data to them, we rely on safeguards approved under GDPR:

• Adequacy decisions — the European Commission has decided that the country protects personal data adequately. We rely on this for the United Kingdom.
• EU Standard Contractual Clauses (SCCs) — contractual protections approved by the European Commission.
• EU-US Data Privacy Framework — a transfer mechanism for US-based providers that have certified compliance with EU data protection standards.

The table above shows which safeguard applies to each provider. You can request copies of these agreements by contacting us at [email protected].

Your rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access — get a copy of the personal data we hold about you
• Right to rectification — correct anything that's wrong
• Right to erasure ("right to be forgotten") — delete your data, subject to legal retention obligations
• Right to restrict processing — pause our use of your data
• Right to data portability — get your data in a portable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — at any time, for processing that's based on consent (like newsletter emails)

To exercise any of these rights, email us at [email protected]. We'll respond within one month of receiving your request, as required by Article 12 of the GDPR. In complex cases we may extend this by up to two more months, and we'll tell you why.

You also have the right to lodge a complaint with a supervisory authority if you think we're handling your data incorrectly. In Spain, that's the Agencia Española de Protección de Datos (AEPD), www.aepd.es. If you're in another EU country, you can complain to your local data protection authority.

Children

MonkStreet is not for anyone under 18. We don't knowingly collect personal data from minors. If you're a parent or guardian and believe your child has provided personal information to us, please contact us at [email protected] and we'll delete it.

Security

We take reasonable technical and organizational measures to protect your personal data: encrypted database connections, hashed passwords, access controls, secure backups, monitored infrastructure, and regular security reviews of our stack. No system is perfectly secure, but we work hard to keep yours safe.

If we ever experience a data breach that affects your personal data, we'll notify you and the relevant supervisory authority within 72 hours of becoming aware of it, as required by Article 33 of the GDPR.

Changes to this policy

We may update this Privacy Policy as MonkStreet evolves or as the law changes. If we make material changes that affect your rights, we'll notify active users by email at least 30 days before the changes take effect. Minor edits (typos, clarifications) may be made without notice, but the "Last updated" date at the top will always reflect the most recent revision.

Cookies Policy

This section explains how MonkStreet uses cookies and similar technologies.

What is a cookie?

A cookie is a small text file that a website saves to your browser to remember things — like that you're logged in, what your preferences are, or that you've already seen a particular notice. Some cookies are essential to making the site work; others help us understand how people use it; others power things like marketing measurement.

How we use cookies

We use cookies in three categories:

Strictly necessary cookies and storage make the site work. We keep you signed in with data stored in your browser, not with a cookie: your sign-in tokens and a copy of your name, email address and plan. Our cookies remember your cookie choices (for a year, on both www.monk.st and app.monk.st); which country you're in and whether your browser sends a Global Privacy Control signal, so we know which cookie rules apply (on www.monk.st, until you close your browser); a "Do Not Sell or Share" opt-out (for a year); and, while you're signed in to the app, a flag with no account details that lets www.monk.st show you a link to the app (for up to 30 days). When you open the billing page, Stripe's payment script loads and may set its own cookies to prevent fraud. You can't turn these off, because the site needs them to work or to remember choices you made.

Analytics cookies let us see how people use MonkStreet, so we can tell what's working and what isn't. They come from Google Analytics and Hotjar. If you allow analytics cookies, the app also notes in your browser which pages you've opened before, so we can count first visits. When you sign in, we also give Google Analytics our internal ID for your account (not your name or email address), whatever you chose about cookies. Vercel Web Analytics and Speed Insights, which we use on app.monk.st, set no cookies and run whatever you choose; see "What loads whatever you choose" below.

Marketing cookies are used for advertising measurement and retargeting. They come from the Meta (Facebook) Pixel and Google Ads. When marketing cookies are allowed depends on where you are: in the EU, the EEA and the UK, and wherever we can't tell where you are, only after you accept them in the cookie banner; everywhere else, by default, unless you've turned them off, used "Do Not Sell or Share My Personal Information", or your browser sends a Global Privacy Control signal (see "Your cookie choices"). If you arrive from one of our ads or from a link with campaign tags while marketing cookies are allowed, we also keep the ad click identifier and the campaign tags in our own cookies for 90 days. The campaign tags can also be MonkStreet's own link tags, which we add to the links on the tools pages of www.monk.st. If you sign up while marketing cookies are still allowed, we store them with your account and use the click identifier to tell Google Ads when one of its ads led to a paid subscription, and for how much. If you turn marketing cookies off, use "Do Not Sell or Share My Personal Information", or your browser sends a Global Privacy Control signal, we delete the click and campaign cookies and stop using them at signup. But if you had already signed up while marketing cookies were allowed, the click identifier and campaign tags already stored with your account stay there: we store them in Stripe with each subscription you start, and we send the click identifier to Google Ads with the first payment of each subscription you start and tell Google Ads if that payment is later refunded. Email [email protected] and we'll remove them.

Your cookie choices

What you see depends on where you are:

• In the EU, the EEA and the UK, or if we can't tell where you are: you see a cookie banner when you first visit. You can accept all cookies, reject all non-essential cookies, or choose by category, and your choice applies on both www.monk.st and app.monk.st. You can change it at any time with the "Cookie settings" link at the bottom of our pages. Until you accept, we set only strictly necessary cookies (Google's sign-in prompt may also set one; see below), and Hotjar and the Meta Pixel don't load. Some tools still load before you choose; see "What loads whatever you choose" below.
• Everywhere else, including the United States: you see no banner. Analytics and marketing cookies are on by default. You can turn either off at any time with the "Cookie settings" link at the bottom of our pages, and we remember your choice on both sites. You can also use the "Do Not Sell or Share My Personal Information" link at the bottom of www.monk.st, and of the app once you're signed in, to turn off advertising cookies; we remember that choice for a year, and you can turn advertising back on from the cookie preferences panel. If your browser sends a Global Privacy Control signal, we honour it and turn off advertising cookies, even if you accepted them before.

You can also manage cookies directly through your browser settings. Each browser handles this differently — search "manage cookies" along with your browser name for instructions.

What loads whatever you choose

Some tools load for every visitor, before and after any cookie choice. When your browser contacts a provider, the provider sees your IP address.

• Google Tag Manager, on www.monk.st and app.monk.st. It loads no other tool until analytics or marketing cookies are allowed.
• Google Analytics and Google Ads, on app.monk.st. Until you allow analytics cookies (for Google Analytics) or marketing cookies (for Google Ads), they set no cookies, but they still send Google cookie-free signals about what you do in the app, such as that a page was opened, which company you opened, what you searched for, or that someone signed up. When you sign in, Google Analytics also receives our internal ID for your account. We remove codes and links from page addresses before they are sent; only campaign tags and Google's own ad click identifiers are kept.
• Vercel Web Analytics and Speed Insights, on app.monk.st. They count page views and measure page speed without cookies. They receive the page's address without any codes or links in it (only campaign tags are kept), the site you came from on your first page view, and, to work out your country and type of device, your IP address and browser type.
• Google's sign-in script, on app.monk.st. It can show a "Sign in with Google" prompt and may set a cookie that remembers whether you closed it.
• Sentry, on app.monk.st. It receives a report when something on the page breaks, and notes page loads to measure our error rate. We remove codes and links from page addresses before they are sent, and we don't attach your IP address or cookies to its reports.

Once you're signed in, some app pages also load images from other websites: news pictures, from our market-data provider (Financial Modeling Prep) or the publishers' sites, and, if you signed up with Google, your Google profile photo from Google. The billing page loads Stripe's payment script.

Managing your cookies

You can open the cookie preferences panel at any time with the "Cookie settings" link at the bottom of our pages, or the button below, to enable or disable each category. If you turn a category off, Hotjar and the Meta Pixel stop the next time you open or reload a page, and cookies they already set stay in your browser until they expire or you delete them. Necessary cookies cannot be turned off, because the site needs them to work or to remember choices you made.