Privacy Policy

1. Who we are

Monody Platform Inc. ("Monody", "we", "us", "our") provides multi-tenant membership and member-management software to gyms and fitness clubs, studios, schools and learning centres, childcare and enrichment centres, clubs, and other membership-based businesses ("Operators"). Monody is operated from Vancouver, British Columbia, Canada.

If you are a member, customer, lead, parent or guardian, or other end-user of an Operator that uses Monody ("End User"), your relationship is primarily with that Operator. Monody acts as a service provider (under PIPEDA) and a data processor (under GDPR) on behalf of the Operator. The Operator is the controller of End-User data.

If you are an Operator, Monody is the controller of your account, billing, and platform-usage data, and a processor of any End-User data you bring into Monody.

2. Information we collect

2.1 Information you give us

• Account details — name, business name, email address, phone number, physical address.
• Authentication data — password (hashed with Argon2id), TOTP or passkey multi-factor enrolment, recovery codes (hashed).
• Payment information — billing address and last-four card digits stored by Stripe; we never store full card numbers.
• Operational content — member records, lead records, bookings, contracts and waivers, scheduled communications, settings, files uploaded by you.
• Support correspondence — emails and messages you send to support.

2.2 Information we collect automatically

• Device + connection — IP address, browser type, OS, language, referrer.
• Usage events — pages visited, actions taken, timestamps, request IDs.
• Cookies and similar — see Section 8.
• Security events — failed login attempts, MFA prompts, session changes.

2.3 Information from third parties

• Stripe — payment status, dispute notifications, payout reports for Operators using Stripe Connect.
• Email and SMS providers (Postmark, Resend, Twilio): delivery, bounce, complaint, unsubscribe and STOP events.
• Bot-protection (Cloudflare Turnstile): challenge results on Operators' public lead forms and check-in endpoints.
• Marketing partners — limited UTM and click data when you arrive from a campaign.

2.4 Children's data

Some Operators serve children (for example coding education, dance, martial arts, childcare). A child's record is created by the Operator together with the child's parent or guardian, who holds the account, gives the consents and signs the documents on the child's behalf; children do not receive their own login. Monody applies data minimisation to these records. Parents and guardians may review, correct, or ask to delete their child's record by contacting the Operator or privacy@monody.app.

3. How we use information

• Deliver the service — authenticate you, run bookings, process payments, send transactional messages, generate reports.
• Operator-directed processing — execute the workflows your Operator configures (campaigns, automations, exports).
• Improve the service — analyze usage to fix bugs, improve performance, and prioritize features. Aggregated and de-identified where possible.
• Security and fraud prevention — detect abuse, enforce rate limits, investigate incidents.
• Compliance — meet legal obligations (tax, anti-spam, e-signature, audit retention).
• Communications — send service notices, security alerts, and (where you have opted in) marketing.
• AI assistance, only when an Operator turns it on — an Operator may enable an assistant that reads the records its staff ask about to answer their questions. Those prompts and records are sent to the AI provider named in Section 5.1 for that purpose only; they are not used to train models.

We do not use End-User data to train machine-learning models, sell it, or share it with advertisers. We do not engage in "sale" of personal information as defined under US state privacy laws.

4. Legal bases (GDPR / UK GDPR)

Where GDPR applies, we rely on:

• Contract — to provide the service to Operators and End Users.
• Legitimate interests — security, fraud prevention, product improvement, and direct B2B communications to Operators.
• Consent — for marketing email/SMS to End Users (CASL also requires express opt-in in Canada), for non-essential cookies, and for processing of children's data.
• Legal obligation — recordkeeping for tax, e-signature and audit retention.

5. Sharing your information

We share information only with the following categories of recipients:

5.1 Sub-processors (vendors that help run Monody)

This table is the current sub-processor list; it is also Schedule 6 of our Data Processing Agreement, available to Operators on request. Operators are notified at least 30 days before we add a sub-processor that materially changes data handling.

5.2 Operators

End-User data you submit to an Operator's Monody instance is shared with that Operator and its authorized staff. The Operator's privacy practices govern how they use that data outside Monody.

5.3 Legal and safety

We may disclose information when required by law, valid legal process, or to investigate fraud, security incidents, or violations of our terms. Where lawful and reasonable, we notify the affected Operator first.

5.4 Business transfers

If Monody is involved in a merger, acquisition, or sale of assets, your information may transfer to the successor entity, subject to a privacy notice consistent with this one.

6. International transfers and data location

Monody operates from British Columbia, Canada. Each Operator's database is hosted by Neon; today every Operator's database lives in the single region of Monody's Neon project, and per-Operator region selection (for example Canadian data residency) is not yet offered. Several sub-processors in Section 5.1 operate from the United States, so personal information is processed there. Under PIPEDA and BC's PIPA, Monody remains accountable for personal information in its custody wherever it is processed and secures comparable protection through each sub-processor's data-processing terms. For transfers from the EU/UK/Switzerland, we rely on each sub-processor's Standard Contractual Clauses, together with encryption in transit and the vendor's encryption at rest.

7. Retention

• Operational data — kept while your account is active. Records an Operator deletes go to a trash for 30 days, from which they can be restored, and are then permanently deleted; a legal hold placed on a record suspends that clock.
• Audit logs — billing and access events are kept for 7 years; other event categories are moved to cold storage after 13 months and kept there.
• Signed contracts, waivers and statements — 7 years.
• Payment records — retained per applicable tax law (typically 6–7 years).
• Backups — point-in-time recovery on the database, plus a nightly snapshot per Operator; the newest 7 nightly snapshots are kept and older ones are deleted.
• Account closure — Operator data is retained 30 days after offboarding (the export window), then the Operator's database and files are hard-deleted. After that we keep: the Operator's registry record and platform audit trail (7 years), the deletion certificate (7 years), records under legal hold for the applicable retention period, and Stripe's own records under Stripe's retention. The Operator's backup snapshots are deleted with its database.

8. Cookies and similar technologies

We use a small number of cookies and equivalent identifiers:

• Essential (always on): session ID, CSRF protection, authentication state, language and appearance preference.
• Analytics (opt-in): first-party analytics events to understand usage; nothing loads until you choose "Accept all".
• Bot protection (essential): Cloudflare Turnstile sets a short-lived token to validate humanness on Operators' public lead forms and check-in.

Non-essential cookies stay off until you accept them in the cookie notice. To change your choice at any time, use Cookie preferences in the footer of this site: it shows the notice again with your current choice, and a change takes effect on your next page load. You can also email privacy@monody.app.

9. Your rights

Depending on where you live, you may have the right to:

• Access — receive a copy of personal information we hold about you.
• Correct — fix inaccurate or incomplete data.
• Delete — ask us to delete personal information, subject to legal-retention exceptions.
• Port — receive your data in a machine-readable format (JSON or CSV).
• Restrict or object to certain processing.
• Withdraw consent — for processing based on consent (marketing, non-essential cookies).
• Lodge a complaint — with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your local data-protection authority.

To exercise these rights as an End User, contact your Operator first. In the member portal you can edit your profile and manage your communication preferences yourself; access, export and deletion requests are fulfilled by your Operator, with Monody's help, on request. For unresolved requests, email privacy@monody.app. We respond within 30 days.

10. Marketing communications and CASL

Monody and its Operators only send commercial electronic messages with your express consent or where another CASL exemption applies. Every marketing message includes an unsubscribe link, our identity, and a postal address. Unsubscribe requests are honoured within 10 business days, as required.

Consents expire after 24 months unless renewed; expired consents are automatically suppressed from marketing sends.

11. Security

• Encryption — HTTPS with HSTS on every application; AES-256-GCM envelope encryption for each Operator's database credentials and vendor tokens; our storage vendors encrypt data at rest.
• Authentication: Argon2id passwords (m=64MB, t=3, p=4); TOTP or passkey multi-factor authentication required for platform staff and for Operator administrator roles (Owner, Administrator, location administrator), optional for other staff.
• Tenant isolation — one Postgres database per Operator, resolved from the request host on every request; no shared tables hold Operator data.
• Audit logging — append-only logs for every action that touches money, access, messaging, or customer status.
• Backups — point-in-time recovery plus nightly per-Operator snapshots, with a documented restore procedure.
• Certifications — Monody holds no SOC 2 or ISO 27001 certification today and claims none; a SOC 2 programme is planned. Our security statement is available to Operators on request.

12. Breach notification

If we determine that a breach of personal information creates a real risk of significant harm, we notify affected Operators and (where required) regulators within 72 hours, and Operators notify their End Users in line with applicable law. We document every reportable breach in our incident register, regardless of materiality.

13. Changes to this policy

We will post any material changes here at least 30 days before they take effect and notify Operators by email. The "Last updated" date at the top reflects the most recent revision.

14. Contact

Monody Platform Inc.
Attn: Privacy
Vancouver, BC, Canada
privacy@monody.app
Support: support@monody.app — staffed every day from 6 pm to 1 am Pacific (Terms §12)

For data-protection authority complaints in Canada: Office of the Privacy Commissioner of Canada. In the EU/UK, contact your national supervisory authority.