Privacy Policy

Effective: March 3, 2026·Last updated: March 3, 2026

Montaic LLC (“we,” “us,” “our”) is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and Services.

2.1 Information We Collect

2.1.1 Information You Provide

Account information: name, email address, phone number, brokerage name, license number (optional), billing address, and payment information (processed securely through Stripe; we do not store full payment card numbers).

Profile information: agent biography, headshot, brand colors, logos, contact details, and writing style preferences.

Content inputs: property data, listing descriptions, property photos, financial information for commercial listings, and any other content you input into the platform for content generation.

Communication data: messages you send to our support team, feedback, and survey responses.

2.1.2 Information Collected Automatically

Usage data: pages viewed, features used, generation history, session duration, click patterns, and interaction data.

Device and technical data: IP address, browser type, operating system, device identifiers, and screen resolution.

Log data: server logs, error reports, and performance data.

Cookies and similar technologies: as described in our Cookie Policy.

2.1.3 Inferences

We generate inferences from your usage of the platform, including tone profile data, writing style preferences, content patterns, and feature usage patterns. Under applicable privacy laws, including the CCPA, these inferences constitute personal information and are subject to the same rights and protections described in this policy.

2.1.4 Information from Third Parties

Payment processor data: transaction confirmations and billing status from Stripe.

Authentication providers: if you sign in via a third-party service (e.g., Google), we receive basic profile information as authorized by that provider.

2.2 CCPA Data Categories Disclosure

For purposes of the California Consumer Privacy Act, we collect the following categories of personal information:

Identifiers: Name, email, phone number, IP address, account ID. Sources: directly from you, automatically collected. Purpose: provide Services, communicate, security. Retention: active account + 90 days post-deletion. Recipients: infrastructure providers, email providers.

Commercial information: Subscription plan, billing history, transaction records. Sources: you, Stripe. Purpose: billing, subscription management. Retention: 7 years (tax/legal compliance). Recipients: Stripe.

Internet/network activity: Pages viewed, features used, click patterns, session data, log data. Sources: automatically collected. Purpose: improve Services, analytics, security. Retention: 24 months, then anonymized. Recipients: analytics providers (anonymized only).

Geolocation: Approximate location derived from IP address. Sources: automatically collected. Purpose: localize content, analytics. Retention: 24 months. Recipients: none shared.

Professional information: License number, brokerage name, professional role. Sources: directly from you. Purpose: account setup, eligibility. Retention: active account + 90 days. Recipients: none shared.

Inferences: Tone profile, writing style preferences, content patterns. Sources: derived from your platform usage. Purpose: personalize content generation. Retention: active account + 90 days. Recipients: AI model providers receive only data necessary for individual generation requests; tone profiles are not shared in full.

Sensitive personal information: License numbers (government-issued identifiers), financial data for commercial listings. Sources: directly from you. Purpose: professional verification, content generation. Retention: active account + 90 days (license); per individual listing retention (financial data). Recipients: AI model providers (financial data for content generation only). You may limit the use of sensitive personal information through your account settings or by contacting privacy@montaic.com.

2.3 How We Use Your Information

We use the information we collect to: (a) provide, operate, and maintain the Services; (b) process subscriptions and payments; (c) personalize your experience, including training your agent tone profile and style preferences; (d) generate marketing content based on your inputs; (e) communicate with you about your account, updates, and new features; (f) improve and develop the platform through Anonymized, Aggregated Data as defined in Section 1.6(e) of the Terms of Service; (g) detect and prevent fraud, abuse, and security incidents; (h) comply with legal obligations.

We do not sell your personal information. We do not “share” your personal information as defined by the CCPA (cross-context behavioral advertising). We may disclose your information only in the following circumstances:

Service providers (CCPA “service providers”): Stripe (payment processing — receives commercial information), Vercel (hosting — receives identifiers, internet/network activity), Supabase (database — receives all categories stored in database), Resend (email delivery — receives identifiers for transactional email). These providers are contractually restricted to processing data only for the services they provide to us.

Contractors (CCPA “contractors”): AI model providers including OpenAI and Anthropic (content generation — receive content inputs and minimal context necessary for generation requests). These providers are contractually restricted from retaining, using, or disclosing data beyond the specific generation request.

Legal requirements: We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email at least 30 days before any such transfer.

With your consent: We may share your information for any other purpose with your explicit consent.

2.5 AI-Specific Data Practices

Content generation inputs: Property data, descriptions, and other content you provide for content generation are processed by third-party AI model providers. We transmit only the data necessary for each individual content generation request.

Tone and style learning: Your writing style preferences and tone profile are stored within your account and used to personalize AI-generated outputs. This data is associated with your account, is not shared with other users, and is explicitly excluded from the Anonymized, Aggregated Data described in Section 1.6(e) of the Terms of Service.

Data minimization: We transmit only the minimum data necessary to AI providers for each generation request. We do not send your full account history, tone profile, or listing archive with each request.

2.6 Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. Specific retention periods:

Account data (name, email, profile): Retained while account is active. Upon deletion request: 30-day export window, then 90-day soft-delete for recovery, then permanent deletion.

Content inputs and generated outputs: Retained while account is active. Same deletion lifecycle as account data. Exportable in machine-readable formats upon request.

Tone profile and style preferences: Retained while account is active. Deleted on the same lifecycle as account data. Not included in Anonymized, Aggregated Data.

Payment records: Retained for 7 years as required for tax and legal compliance.

Usage analytics (identifiable): Retained for 24 months, then anonymized or deleted.

Anonymized, Aggregated Data: Reviewed every 36 months. Data no longer useful for service improvement is deleted.

Support communications: Retained for 3 years from the date of last communication.

AI provider processing: AI model providers are contractually required to delete input data after processing each request and do not retain your content for model training.

2.7 Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.

Correction: Request correction of inaccurate or incomplete information. Submit correction requests via your account settings or by contacting privacy@montaic.com.

Deletion: Request deletion of your personal information, subject to legal retention requirements.

Portability: Request a machine-readable copy of your data in commonly used formats (CSV, PDF, JSON), including generated content and listing history.

Opt-out of Anonymized Data: Opt out of contributing to Anonymized, Aggregated Data through your account settings.

Limit Sensitive PI: You may limit the use of sensitive personal information (license numbers, financial data) to purposes necessary for providing the Services. Exercise this right through your account settings or by contacting privacy@montaic.com.

Authorized agents: You may designate an authorized agent to submit privacy requests on your behalf. We may require the authorized agent to provide proof of written authorization and may verify your identity directly.

We will confirm receipt of your request within 10 business days and fulfill your request within 45 calendar days (or sooner if required by applicable law). To exercise any of these rights, contact us at privacy@montaic.com.

2.8 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, including the right to know what personal information we collect, the right to delete, the right to correct, the right to opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information.

We do not sell or share (as defined by the CCPA) the personal information of California residents.

We will not discriminate against you for exercising your CCPA rights. We will not deny you services, charge you different prices, or provide you a different level of service for exercising any of your rights under the CCPA.

We recognize and honor Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request for the sale or sharing of personal information associated with that browser.

For purposes of CCPA compliance, we treat all personal information of California residents — including information provided in a business or professional capacity — as subject to the consumer rights described in this policy.

To exercise your California privacy rights, contact us at privacy@montaic.com or use our in-app privacy controls.

2.9 Additional State Privacy Rights

In addition to the California-specific rights described above, residents of other states (including but not limited to Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, and Kentucky) may have additional privacy rights under their state's privacy laws. To exercise any applicable privacy rights, contact us at privacy@montaic.com.

2.10 Data Security

We implement industry-standard security measures to protect your information, including: encryption in transit (TLS 1.2+) and at rest; Supabase Row Level Security (RLS) for multi-tenant data isolation; regular security audits and vulnerability assessments; access controls and authentication safeguards; and secure API communication with third-party providers.

Despite our efforts, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

2.11 International Data Transfers

Your data may be processed in the United States. If you access the Services from outside the United States, your data will be transferred to and processed in the United States. By using the Services, you consent to this transfer.

2.12 Children's Privacy

The Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected information from a minor, we will delete it promptly.

2.13 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 30 days before changes take effect. The “Last Updated” date at the top of this policy indicates when it was most recently revised.