Written in plain language by the team that built the product, and describing only mechanisms the product actually has. It has not yet been reviewed by outside counsel; if that matters for your procurement, say so and we will tell you where the review stands.
01What we hold
Account data: your email, workspace name, membership and role, and billing records. Payment card details are held by Stripe, not by us — we store an identifier and the last four digits.
Workspace content: the documents, spreadsheets, decks, PDFs, mail, calendar entries and meeting transcripts you put in, plus what the agent derives from them — long-term memory, the knowledge graph, and citations back to the source.
Operational records: conversations with the agent, the tools it called and their arguments, every proposal and your decision on it, and model usage for billing. The audit chain is signed, which means it can be verified and not quietly edited.
Secrets you store are encrypted and write-only: the API can return a name and the last four characters, never the value, and the model never sees one — {{secret:NAME}} is substituted at the moment a tool is dispatched and scrubbed from the result.
02Where it lives, and where it is processed
Persistent data — conversations, memory, the knowledge graph, documents, encrypted secrets — is stored in Zurich, Switzerland.
Inference is processed in the EU, and on the Swiss track it runs on open-weight models hosted in Switzerland. Which track a workspace uses is a setting you control.
That split is the honest statement of the arrangement: stored in Switzerland, processed in the EU. We do not claim a certification we have not earned.
03What model providers see — read this one
To answer a turn we send the model the material that turn needs: your message, the retrieved sources, the tool definitions and the results. That is how the agent works, and there is no version of it where the provider sees nothing.
We do not currently have a zero-retention agreement with the upstream model providers. We ask you to assume prompts may be retained by them under their own policies and retention periods. If a provider offers a no-retention arrangement we can rely on, we will say so here and name it.
Incognito mode means WE write nothing durable — no conversation, no message, no memory, no trace on our side. It does not and cannot control what happens on someone else’s infrastructure, and this page will not pretend otherwise.
Providers are not permitted by us to train on your content, and we do not train on it either — with one exception you control: if you switch on “Help improve mail sorting” for your mailbox, your sorted email and your corrections may be used to train our own mail classifier, run on our own hardware. It is off by default, it is per person, and switching it off stops it.
04Keeping workspaces apart
Every row of workspace data carries a tenant identifier and is isolated by Postgres row-level security, so a query from one workspace cannot reach another’s rows even if the application layer is wrong.
Sub-agents and connected tools inherit that boundary. A tool connection belongs to the workspace that created it.
05Your rights over it
Export: your files are downloadable in the formats you put them in, at any time, without asking us.
Deletion: you can delete a document, a conversation or the whole workspace. Deleting a document also retires the knowledge-graph facts that were sourced from it, so the agent stops asserting them.
Access: download everything your account holds about you, at any time, from /api/account/export (a JSON file; credentials are never included). Correction: ask and we will fix what is wrong.
If you are in the EU, EEA, UK or Switzerland you have the rights their data-protection law gives you, including complaining to your supervisory authority.
06Who else is involved
Always: Supabase (Postgres, Zurich) for the database. Cloudflare for the application and file storage. Fly.io for the agent runtime. Stripe for payments. Resend for email. phi-cloud, the model gateway every turn goes through, which routes it to the upstream model providers described above.
Every tool call the agent makes is also checked by mcp-guard, a safety classifier, which receives the tool name, its arguments, your latest message and a short excerpt of outside content the turn read.
If you switch on mail sorting, the sender, subject and opening of each new email go to the model gateway to be sorted (and, with “Help improve mail sorting” on, to our own mail classifier too).
Only when the agent uses them in a turn: Twin Browser to open or act on a web page; the code-anything sandbox to run a script on files you hand it; MCPDial for a live voice call.
Only when you connect them: Google or Microsoft for your mail and calendar, and Klavis for the apps you link in the Catalog. An app you bring your own key for (for example a search or voice provider) is your arrangement with that provider.
Each is used for the purpose named and nothing else.
07How long we keep it
Workspace content: until you delete it. Closing a workspace deletes its content and files at once.
Audit and billing records: kept as long as the law requires, because their point is that they cannot be quietly removed.
Contact: hello@monopea.com.
The mechanisms behind these claims are described in Security, and the agreement itself is in the Terms of Service.
Questions about a clause?
Write to hello@monopea.com — a person who built the product will answer.