1. Introduction
Monaro ("we," "us," or "our") operates the Monaro platform, available at https://monaro.ai (the "Service"). Monaro is operated by Torinit Technologies Inc., incorporated in Canada. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use the Service or interact with us.
We are committed to protecting your privacy in accordance with applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and US state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use the Service.
2. Information we collect
2.1 Information you provide
- Account information: name, business email address, business name, job title, phone number.
- Billing information: payment method details, processed by our payment provider. We do not store full payment card numbers.
- Customer content: project files, mechanical drawings, specifications, takeoff outputs, and other materials you upload or generate within the Service (collectively, "Customer Content").
- Communications: emails, support tickets, and messages you send to us.
2.2 Information collected automatically
- Usage data: pages visited, features used, actions taken within the Service, performance metrics.
- Device and browser information: IP address, browser type, operating system, device identifiers.
- Cookies and similar technologies: see Section 8.
3. How we use your information
We use your information to:
- provide, operate, maintain, and improve the Service;
- process payments and manage your subscription;
- send transactional communications (account confirmations, receipts, support responses, security notices);
- send product updates and marketing communications, where you have consented or where permitted by applicable law (see Section 9 for CASL);
- detect, prevent, and respond to fraud, abuse, and security incidents;
- comply with legal obligations and enforce our agreements.
3.1 Customer Content and AI models
This section is important and we want to be explicit:
- We use Customer Content to deliver the Service to you, for example to generate a takeoff from a drawing set you have uploaded.
- We do not use your drawing files, project files, or specifications to train or fine-tune any AI or machine-learning model, and your Customer Content is never disclosed to another customer.
- We do use derived signals about how the Service performs, including the corrections your estimators make to a takeoff, to improve the accuracy of our models. These signals are de-identified and are not linked back to you, your organisation, or your projects.
- If we ever wish to use your Customer Content itself for model training, we will obtain your explicit, opt-in consent first. Consent can be withdrawn at any time.
4. How we share your information
We do not sell your personal information. We do not share personal information for cross-context behavioural advertising.
We may share your information with:
- Subprocessors: third-party service providers that assist us in operating the Service. Our current subprocessors are Amazon Web Services (application hosting, storage of Customer Content, and email delivery), Stripe (payment processing), Google (Gemini) and Anthropic (Claude) as AI model providers, and Google Analytics (website usage analytics). Each subprocessor is engaged on written confidentiality and data-protection terms and processes your information only on our instructions. We will update this list when it changes, and you can request the current version by emailing privacy@monaro.ai.
- Professional advisors: lawyers, accountants, auditors, and insurers, under confidentiality.
- Regulatory authorities or law enforcement: where required by applicable law, court order, or legal process.
- A successor entity: in connection with a merger, acquisition, financing, reorganisation, or sale of assets. We will provide prior notice to affected users where reasonably practicable.
5. Data location and international transfers
Customer Content (drawings, project files, specifications, and takeoff outputs) is stored on infrastructure operated by Amazon Web Services in the United States.
To generate a takeoff, Customer Content is also processed by our AI model providers, Google (Gemini) and Anthropic (Claude), on our instructions. Both are engaged on paid commercial terms under which they do not use Customer Content to train their models. Each may retain Customer Content for a limited period in order to return a result and to meet its own security and abuse-monitoring obligations. Details of where and for how long each provider processes Customer Content are set out in its data-protection terms, which we can provide on request.
Account and billing information may be processed in the United States or Canada by our payment, email, and analytics providers.
Monaro is incorporated in Canada, and personal information we access remains subject to Canadian privacy law, including PIPEDA.
Where we transfer personal information across borders, we ensure appropriate safeguards consistent with applicable privacy laws, including contractual data-protection commitments with our subprocessors.
6. Data retention and deletion
We retain your personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.
If you cancel a subscription, your account moves to read-only access and we retain your Customer Content so that you can view and export it for twelve (12) months, after which we may close the account on thirty (30) days' notice. If you ask us to close your account, or if we close it, we will delete or de-identify your personal information and Customer Content within ninety (90) days, except where retention is required by law, regulation, or for the establishment, exercise, or defence of legal claims. You can ask us to delete your Customer Content at any time by emailing privacy@monaro.ai.
Enterprise customers may negotiate alternative retention and deletion terms in their subscription agreement, including certificates of destruction.
7. Security
We implement administrative, technical, and physical safeguards designed to protect your information, including:
- encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
- role-based access controls and the principle of least privilege;
- multi-factor authentication for administrative access;
- logging, monitoring, and regular security reviews;
- employee confidentiality obligations and security training.
We are actively pursuing SOC 2 Type II attestation. Customers may request our current security documentation, including subprocessor list, security overview, and questionnaire responses, by contacting security@monaro.ai.
No method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security. We encourage you to use a strong, unique password and to enable any available security features on your account.
7.1 Security incidents. If we become aware of a breach of security safeguards affecting your personal information or Customer Content, we will notify you without undue delay after confirming the incident. Our notice will describe what happened, the information involved, what we are doing about it, and what you can do. Where the law requires it, we will also report the breach to the Office of the Privacy Commissioner of Canada, to affected individuals, and to any other regulator with jurisdiction.
8. Cookies and similar technologies
We use cookies and similar technologies to operate the Service, remember your preferences, authenticate sessions, and analyse usage. You can control cookies through your browser settings; disabling certain cookies may affect Service functionality. We do not use cookies for cross-site advertising tracking.
9. CASL: Canadian commercial electronic messages
We send commercial electronic messages (including marketing emails) only where we have:
- your express consent;
- implied consent under CASL (for example, an existing business relationship or a conspicuously published business contact address relevant to your role); or
- another lawful basis under CASL.
Every commercial electronic message we send identifies us, includes valid contact information, and includes a working unsubscribe mechanism that takes effect within ten (10) business days. To unsubscribe at any time, use the link in any message or email unsubscribe@monaro.ai.
10. Your privacy rights
Subject to applicable law, you have the right to:
- access the personal information we hold about you;
- request correction of inaccurate or incomplete information;
- request deletion of your information (subject to legal retention obligations);
- request a portable copy of your personal information;
- withdraw consent or opt out of marketing communications at any time;
- lodge a complaint with your privacy regulator.
To exercise these rights, contact privacy@monaro.ai. We will respond within thirty (30) days where PIPEDA applies, and within forty-five (45) days for requests made under US state privacy laws, which we may extend once by a further forty-five (45) days where permitted, telling you the reason before the first period ends. We may need to verify your identity before fulfilling certain requests.
10.1 California residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the CCPA/CPRA:
- Right to know: request the categories and specific pieces of personal information we have collected about you, the sources, the purposes of collection, and the categories of third parties with whom we share it.
- Right to delete: request deletion of personal information we have collected from you, subject to legal exceptions.
- Right to correct: request correction of inaccurate personal information.
- Right to opt out of sale or sharing: we do not sell personal information and do not share it for cross-context behavioural advertising. No opt-out is therefore required, but you may confirm this in writing to privacy@monaro.ai.
- Right to limit use of sensitive personal information: we do not use or disclose sensitive personal information beyond what is necessary to provide the Service.
- Right to non-discrimination: we will not discriminate against you for exercising any of these rights.
You may designate an authorised agent to make a request on your behalf. Agents must provide written authorisation, and we may require you to verify your identity directly.
10.2 Appealing a decision. If we refuse a request you make under this Section, we will tell you why. You may appeal that decision by emailing privacy@monaro.ai with "Appeal" in the subject line. We will review the appeal and respond in writing within forty-five (45) days, explaining the reasons for our decision. If we deny your appeal, you may complain to the Office of the Privacy Commissioner of Canada, the California Privacy Protection Agency, your state Attorney General, or your local privacy regulator.
11. Children
The Service is intended for business use and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at privacy@monaro.ai and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice at least fourteen (14) days before taking effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy. We will maintain prior versions on request.
13. Contact us
Monaro has designated a Privacy Officer responsible for compliance with this Policy and applicable privacy laws. You can reach our Privacy Officer using the details below, and we will provide their name on request.
Email:privacy@monaro.ai
Mailing address: Monaro, 155 Queens Quay E, Suite 200, Toronto, ON M5A 0B5, Canada
For general enquiries, you may also write to legal@monaro.ai. We take all privacy concerns seriously and will respond within thirty (30) days. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), the California Privacy Protection Agency (cppa.ca.gov), or your local privacy regulator.
