Privacy Policy
Last updated: 8 November 2026
This policy explains how Mona AI handles personal data for businesses that use Mona AI and for the customers who message them.
1. Who we are
Mona AI (“Mona AI”, “we”) provides an AI receptionist platform for businesses. For account and billing data of our business users, Mona AI is the controller. For the conversations, contact details, leads, appointments and reservations that a business processes through Mona AI, that business is the controller and Mona AI processes the data on its behalf and only on its instructions.
2. Data we process
Business users: name, work email, password (stored only as a secure hash by our authentication provider), company details, team roles, usage and billing records. Business customers: messages sent on WhatsApp or website chat, phone number or a website visitor identifier, and any name, email, preferences or booking details they share. Technical data: IP address and security logs used to protect the service.
3. How we use it
To provide and secure the service; to generate replies with AI from the business's own knowledge base; to route conversations to staff; to send verification, security and service emails; to calculate usage and invoices; and to meet legal obligations. We do not sell personal data and we do not use one business's data to serve another business.
4. AI processing
Customer messages and relevant excerpts of the business's knowledge base are sent to our AI provider (Google Gemini) to produce a reply. Replies are checked before sending; figures that are not in the business's data are withheld and the conversation is passed to staff. API credentials are kept only on our servers.
5. Service providers
We use carefully selected providers to run Mona AI: Supabase (database and authentication, hosted in the Asia Pacific (Mumbai) region), Vercel (application hosting), Google (Gemini AI), Meta (WhatsApp Business Platform), Stripe (payments — we never store card numbers) and an email delivery provider. Each processes data only to provide its service to us.
6. International transfers
Some providers process data outside the Kingdom of Saudi Arabia. Where personal data is transferred, we do so in line with the Personal Data Protection Law (PDPL) and its implementing regulations, using providers with appropriate security and contractual safeguards.
7. Isolation and security
Each business has a private workspace isolated at the database level. Data is encrypted in transit; stored integration credentials are additionally encrypted. Access is role-based and sensitive actions are recorded in an audit log. Mona AI staff cannot read a business's conversations unless the business owner grants temporary, logged support access.
8. Retention
Each business sets how long messages are kept (365 days by default); older messages are deleted automatically. Account data is kept while the account is active and then deleted or anonymised, except where we must keep records by law (for example invoices).
9. Your rights
Depending on applicable law, you may request access to, correction of, or deletion of your personal data, and withdraw consent. Customers of a business should contact that business first. WhatsApp users can reply STOP at any time to stop messages. Business users can contact us through the contact page.
10. Cookies
We use only essential cookies: to keep you signed in, remember your selected company and your language. We do not use advertising cookies.
11. Changes and contact
We will post updates to this policy on this page and notify business owners of material changes. Questions or requests: use the contact form on our website.