Legal

Data Processing Agreement

Last updated: 13 October 2026. Business and Enterprise customers can request a signed Data Processing Agreement (DPA) covering how Mondaily processes personal data on your behalf, in line with GDPR Article 28. This includes sub-processor disclosure (listed below), data deletion timelines, and breach notification commitments.

To request a DPA, email privacy@mondaily.com with your workspace name; we'll send a copy for signature within one business day.

Sub-processors

These third parties process customer personal data on Mondaily's behalf. Some are used for every workspace; others only when you use the feature named. Where a provider may process data outside the EU, the entry says so.

No AI vendor processes your data. sōtem (AI), web scraping, transcription and embeddings are built to run only on servers Mondaily operates. Until those servers are in service, these features are not available; it never falls back to a third party. sōtem Radar looks businesses up in the public data sources listed below, sending them search words only.

Core platform: hosted in the EU (Frankfurt)

Mondaily runs the application and stores your data in the EU (Frankfurt), on infrastructure from these two providers.

  • Vercel: Hosting for the web app, the API and this website.

    Data: All data passing through the service while it is served.

    Where: EU: the API runs in Frankfurt (fra1); public web pages are cached on Vercel's global edge network.

    Used: Always.

  • Supabase: Database and file storage, including call recordings.

    Data: Account and workspace data, files and recordings, including sōtem Voice clips, voice-cloning consents and voice history.

    Where: EU: Frankfurt.

    Used: Always.

Temporary providers (planned to be replaced)

We plan to replace each of these with a service Mondaily runs itself. Until then they are in use as described here. When we switch, we run ours in parallel first, switch over, then turn theirs off.

  • Inngest (Inngest Cloud): Runs background jobs: scheduled agents, record enrichment, reminders.

    Data: Job payloads, which can include the content of workspace records.

    Where: Inngest's cloud; region set by the provider, may be outside the EU.

    Used: Always.

    Plan: Our own job runner on a Mondaily server (a configuration switch, run in parallel first).

  • Resend: Delivers account and notification email, and email your workspace sends.

    Data: Sender and recipient addresses, subject and message body.

    Where: Resend's cloud; region set by the provider, may be outside the EU.

    Used: Whenever Mondaily sends email.

    Plan: A mail server Mondaily runs itself; Resend stays as a fallback while its reputation warms up (2–4 weeks), then is removed.

  • LiveKit (LiveKit Cloud): Real-time audio and video for calls; records a call when someone in it starts recording.

    Data: Call audio and video, participant display names; recordings are written to our storage at Supabase (EU).

    Where: LiveKit's cloud; calls connect through servers near the participants, which may be outside the EU.

    Used: Only when you use calls.

    Plan: Our own LiveKit and TURN servers, after a test week.

  • Google Maps Platform (Places API): Business lookups for sōtem Radar and record enrichment.

    Data: Search terms and company names.

    Where: Google's cloud; region set by the provider, may be outside the EU.

    Used: Only when you use sōtem Radar or enrichment.

    Plan: OpenStreetMap and our own search, once match rates are compared.

  • OpenStreetMap Nominatim (public service): Open-data business and address lookups for sōtem Radar.

    Data: Search terms.

    Where: The OpenStreetMap Foundation's public servers.

    Used: Only when you use sōtem Radar.

    Plan: Our own Nominatim server.

Optional: only when you choose it

Nothing is sent unless you sign in with or connect the account yourself; you can disconnect at any time.

  • sōtem Voice engine (run by Mondaily, not a third party): Text to speech, speech to text and the other sōtem Voice models, run by Mondaily, no outside AI provider.

    Data: Text to be spoken, audio to be transcribed, and consented voice references.

    Where: Not in use yet: no voice data is processed here today. Its location is listed here before any is.

    Used: Only when you use sōtem Voice.

  • Google (Sign in with Google, Gmail, Google Calendar): Optional sign-in with Google, and the optional Gmail and Google Calendar connector.

    Data: Sign-in: your name, email address and Google account ID. Connector: the email and calendar data you authorize.

    Where: Google's cloud; region set by the provider.

    Used: Only if you sign in with Google or connect a Google account.

  • LinkedIn: Optional LinkedIn connection: sign in with your own LinkedIn account and publish posts you approve.

    Data: Only for users who connect their own LinkedIn account: we receive your LinkedIn name, profile picture link, email address and member ID, and we send only the posts you approve; the exact text and visibility you confirmed.

    Where: LinkedIn's cloud; region set by the provider.

    Used: Only if you connect your own LinkedIn account; a post is sent only after you click Confirm.

  • X: Optional X connection for sōtem Social: publish posts you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: X's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Meta (Facebook, Instagram, Threads): Optional Facebook Page, Instagram and Threads connections for sōtem Social: publish posts you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Meta (Facebook, Instagram, Threads)'s cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • TikTok: Optional TikTok connection for sōtem Social: publish videos and photos you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: TikTok's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Google (YouTube, Business Profile): Optional YouTube and Google Business Profile connections for sōtem Social: publish uploads and updates you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Google (YouTube, Business Profile)'s cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Pinterest: Optional Pinterest connection for sōtem Social: publish pins you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Pinterest's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Telegram: Optional Telegram channel connection for sōtem Social: publish posts you approve through Mondaily's bot.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Telegram's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Bluesky: Optional Bluesky connection for sōtem Social: publish posts you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Bluesky's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Mastodon (your chosen server): Optional Mastodon connection for sōtem Social: publish posts you approve on the server you choose.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Mastodon (your chosen server)'s cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • Snapchat: Optional Snapchat connection for sōtem Social (only after Snap grants partner access): publish stories you approve.

    Data: Only for users who connect their own account: the account's name, picture and id from the platform, and only the posts (text, images or video) you approve.

    Where: Snapchat's cloud; region set by the provider.

    Used: Only if you connect your own account; a post is sent only after you confirm that exact post.

  • PayPal: sōtem Data Lab: paying contributors for approved work.

    Data: Only for Data Lab contributors who request a payout: the PayPal email address they gave us and the amount. No customer workspace data is sent.

    Where: PayPal's cloud; region set by the provider.

    Used: Only when a Mondaily administrator sends a contributor's requested payout.

Payments: Stripe, we never see or store card numbers

Used only when you buy something.

  • Stripe: Payment processing.

    Data: Billing name, email address and payment details. Card numbers are entered into Stripe's own form and go straight to Stripe. Mondaily never sees or stores them.

    Where: Stripe's cloud; region set by the provider.

    Used: Only when you buy a plan or credits.

Public data sources (sōtem Radar)

sōtem Radar finds companies in public, openly licensed data. These services are not sub-processors: they receive only search words (an industry, a city or country, a date range, or a company's public job board name), never your records, contacts or any personal data. We show each source's credit next to the results it gave.

  • OpenStreetMap (Overpass and Nominatim)

    Receives: An industry category and a city area or place name.

    We take: Business names, addresses and website links from the open map.

    Licence: Open Database License (ODbL 1.0); credit: © OpenStreetMap contributors. Terms

  • TED, the EU's public tenders journal

    Receives: A procurement category code, a country and a date range.

    We take: Open calls for tender: buyer, title, dates and the notice link.

    Licence: EU open data, free reuse with credit (Commission Decision 2011/833/EU); credit: Source: TED. Terms

  • GDELT news index

    Receives: Industry and place words.

    We take: Links, headlines and dates of public news about funding or expansion.

    Licence: Free reuse with citation; credit: News index: The GDELT Project. Terms

  • Wikidata

    Receives: A country.

    We take: Organisation names and their official websites.

    Licence: CC0 1.0 (public domain); credit: Data from Wikidata. Terms

  • Greenhouse and Lever public job boards

    Receives: The public job board name a company links from its own careers page.

    We take: Open role titles, locations and links the company published.

    Licence: Public job-board APIs, no account needed; the company's own published postings. Terms

  • Google Places (optional paid extra)

    Receives: Search words (an industry and a place). Google is a vendor and receives these words; it never receives your records.

    We take: Optional and never required: only after the free sources, while our own search is offline, within a daily budget, and only while Google answers. The place ID (the only part we keep) and a business's website link.

    Licence: Google Maps Platform terms; credit: Google Maps. Terms

  • Brave Search (only if switched on)

    Receives: Search words only, with private details (emails, phone numbers, ids, bank and card numbers) removed first: backup for sōtem Radar and for sōtem chat web search and research, only while Mondaily's own web search is not available and the workspace allows it.

    We take: Links to public web pages; no results are kept.

    Licence: Brave Search API terms. Terms

This page is the current list. We add a provider here before it receives any customer data, and the "Last updated" date changes with every change. Customers with a signed DPA can ask privacy@mondaily.com for the list at any time.