Privacy Policy

We use the data described above to:

• provide the Service: answering messages, booking appointments, collecting deposits, sending reminders, and maintaining the merchant's CRM;
• operate AI features, as described in Section 4;
• bill merchants for subscriptions and metered usage;
• provide support and respond to enquiries;
• secure the Service, prevent abuse and enforce our Terms of Service;
• improve the product using aggregated, de-identified usage information; and
• comply with legal obligations.

We do not sell personal data, and we do not use end-customer data to advertise to end customers.

We share data with a limited set of service providers ("subprocessors") that help us run the Service. Each is bound by contractual obligations to protect the data and to process it only on our instructions:

We may also disclose data where required by law, to protect the rights and safety of MondayFive, our merchants or others, or as part of a merger, acquisition or asset sale (in which case this policy will continue to apply to previously collected data).

MondayFive is an AI product. Conversations handled by the Service are processed by large language models operated by our AI subprocessors (Anthropic, OpenAI and Google AI) to generate replies, qualify enquiries, extract booking details and produce summaries. Voice calls are processed through Vapi for speech recognition and synthesis.

Message content is sent to these providers only to the extent necessary to generate a response, under agreements that prohibit them from using the data to train their models. AI-generated replies operate within guardrails configured by the merchant — for example, the agent only quotes prices from the merchant's own configuration, and industry safety lanes restrict what the agent may discuss for medical, dental, therapy and wellness businesses.

AI output can be imperfect. Merchants remain responsible for the commitments made in their name, and the Service is designed to hand conversations to a human when appropriate.

We retain account and business data for as long as the merchant's account is active. Conversation transcripts, CRM records and booking history are retained while the merchant's workspace exists so the Service can function (for example, so a returning customer is recognised).

When a merchant deletes their account, we delete or irreversibly de-identify the workspace's data within 30 days, except where a longer period is required by law (for example, invoicing and tax records) or where data resides in encrypted backups, which roll off on a fixed schedule. Merchants can delete individual customers, conversations or knowledge-base items at any time from within the product, and can export their data before deletion.

Depending on where you live (including under the GDPR and UK GDPR, and similar laws elsewhere), you may have the right to:

• access the personal data we hold about you and receive a copy in a portable format;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with your local supervisory authority.

To exercise these rights, email privacy@mondayfive.com. If you are an end customer of a MondayFive merchant, we will refer your request to the relevant merchant and assist them in responding, as required by our processor role.

We use a small number of cookies and similar technologies: strictly necessary cookies for authentication and security (keeping you signed in, preventing cross-site request forgery), and preference cookies (such as your theme choice). Our marketing site uses privacy-respecting, aggregate analytics. We do not use third-party advertising cookies. You can control cookies through your browser settings; blocking strictly necessary cookies will prevent you from signing in.

We protect data with encryption in transit and at rest, role-based access controls, audit logging and least-privilege access for our staff. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify affected merchants and authorities as required by applicable law.

Our subprocessors operate in the United States and elsewhere. Where data is transferred out of the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent mechanisms.

The Service is a business tool and is not directed to children. We do not knowingly collect personal data from children under 16 as a controller. Merchants are responsible for ensuring their own use of the Service complies with laws applicable to their customers.

We may update this policy from time to time. If we make material changes we will notify merchants by email or an in-product notice before the changes take effect. The "Last updated" date at the top reflects the current version.

MondayFive, Inc.
Email: privacy@mondayfive.com (privacy) · hello@mondayfive.com (general)

See also our Terms of Service.