Monty is an AI video editor. You upload your own media, edit videos and choose whether to publish them to a connected platform. Google sign-in identifies your Monty account; connecting YouTube or TikTok is a separate authorization, each one letting Monty identify that account and publish videos there at your request. See those sections below for the data involved and your controls.
This Privacy Policy explains how the operator of the Monty service (the "Provider", "we", "us") collects, uses, shares, and protects personal data of visitors to monty.fast and users of the Service. We aim to comply with applicable data-protection laws, including the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and others, to the extent they apply to you. Your use of the Service is also governed by our Terms of Service, including its disclaimers, "no guarantee of results", and limitation-of-liability provisions, which apply to this Policy to the extent permitted by law.
1. Controller and contact
The controller responsible for your personal data is Monty. Contact for any privacy matter: [email protected].
We act as the controller for account, billing, usage, and marketing data, and for visitors to the Site. For the content you upload and process through the Service, you act as the controller of any third-party personal data it contains, and we act as your processor, handling that content on your instructions and as described here.
EU / UK representative (Art. 27 GDPR): to be appointed; once appointed, the representative's name and address will be published here so EEA and UK users can contact a local point of contact.
2. What data we collect
- Account data - email address, name or nickname, and authentication data (including third-party sign-in such as a Google account).
- Content you provide - the videos, audio, images, and text you upload (Your Content) and the outputs created from them.
- Voice and face data (biometric). If you use voice cloning or avatar features, we process samples of your voice and/or face to build and operate your personalized model. In some jurisdictions this is biometric / sensitive personal data and we process it only with your separate explicit consent (see Section 4).
- Usage and technical data - IP address, device and browser information, cookie identifiers, and date and time of access.
- Transaction data - records of plans, purchases, and history. We do not collect or store full payment card details; these are handled by our payment processors.
- Communications - the content of your requests when you contact us.
Please do not upload special-category data about others, or any person's voice or face, without a lawful basis and their consent. You are solely responsible for the personal data you upload or generate about third parties, including obtaining any required consent and lawful basis, and we rely on your representations that you have done so. You are also responsible for the accuracy of the information you provide to us.
3. Purposes and legal bases
Where the GDPR or similar law applies, we rely on the following legal bases per purpose:
| Purpose | Legal basis |
|---|---|
| Create and manage your account; provide the Service and its features; create and publish Output to the platforms you connect; process payments | Performance of a contract (Art. 6(1)(b)) |
| Secure the Service, prevent abuse and fraud, maintain and improve the Service, basic analytics | Legitimate interests (Art. 6(1)(f)) |
| Voice/face (biometric) processing for cloning and avatars | Your explicit consent (Art. 9(2)(a)) |
| Optional marketing messages; non-essential cookies | Your consent (Art. 6(1)(a)), withdrawable anytime |
| Comply with legal, tax, and accounting obligations | Legal obligation (Art. 6(1)(c)) |
4. Voice, face and automated processing
4.1. Voice and face cloning involves processing biometric data and is carried out only with your separate, explicit, opt-in consent, which you can withdraw at any time; withdrawal does not affect prior processing. We use these samples solely to build and operate your personalized model and do not use them to identify you or to train general AI models.
4.2. The Service uses automated processing to generate and edit videos. We do not make decisions that produce legal or similarly significant effects about you solely by automated means without human involvement.
5. How we share data
We share personal data only as needed, under contracts that require confidentiality and security, with:
- Payment processors - to take and process payments;
- Hosting and cloud infrastructure providers - to run and store the Service;
- AI and media-processing providers - to generate scripts, captions, voice, and video;
- Analytics and email/communication providers - to operate the Service;
- The third-party platforms you connect (YouTube, Instagram, TikTok, Telegram) - when you choose to publish to them;
- Acquirers or successors - in connection with a merger, acquisition, financing, reorganization, or sale of assets, where the recipient is bound to protect your data consistently with this Policy;
- Authorities or advisers - where required by law, to enforce our terms, or to protect the rights, safety, and security of users, the public, or us.
An up-to-date list of our subprocessors is available on request at [email protected].
We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as defined under California law.
When you publish Output to a connected platform (such as YouTube, Instagram, TikTok, or Telegram), or use a payment processor or other third-party service, that party receives and processes the relevant data as an independent controller under its own privacy policy and terms. We do not control, and to the maximum extent permitted by law we are not responsible or liable for, how those third parties collect, use, secure, or disclose data. Please review their policies before you connect or publish.
5a. Google sign-in and YouTube API Services
Monty uses Google sign-in to authenticate you and YouTube API Services to connect your channel and upload videos you choose to publish. These are separate authorization steps. Signing in to Monty does not, by itself, give Monty permission to upload to YouTube. We do not ask for or store your Google or YouTube password.
Google sign-in data and purpose. With the openid, email and profile permissions, we receive your email address, its verification status and your name. We use these to verify your identity and create or sign you in to your Monty account. We store your email, name and sign-in provider with your account; the Google sign-in access token is used to retrieve this information during login.
YouTube permissions and data. When you choose to connect YouTube, Monty requests:
youtube.readonly— to retrieve your channel identifier, channel title and thumbnail URL and display the connected channel so you can check the destination before uploading. Although this permission permits broader read access, Monty's channel-connection feature uses it to retrieve this basic channel information, not subscriber lists, comments or analytics.youtube.upload— to upload the video and publication details you select, such as its title, description and visibility. The publishing screen asks you to review and confirm the upload.
Storage and protection. We store the connected channel's identifier, title and thumbnail URL, granted permissions, token expiry information, and OAuth access and refresh tokens needed to keep the connection working. Connection tokens are encrypted in our database and are not returned to the browser's connection list. Authorized backend services and publishing workers use them to perform the requested upload. We protect data in transit with HTTPS and restrict access to the services and personnel that need it for the purposes described here. Publication records may include the uploaded video's identifier, link and status.
Sharing and AI processing. Our hosting and infrastructure providers process data needed to operate sign-in, storage and publishing. Google receives authentication requests and, when you request an upload, the selected video and its publication details. Media you provide for editing may be processed by the AI and media providers described in Section 5; YouTube channel metadata and OAuth tokens are not inputs to our video-generation models. We do not use Google or YouTube API data to train generalized AI or machine-learning models. Any sharing of Google API data is subject to the Limited Use restrictions below, including where the general sharing provisions in Section 5 would otherwise be broader.
Retention and automatic refresh or deletion. Account identity data is retained for your Monty account as described in Section 7. While your YouTube connection is active, Monty rechecks the authorization and the connected channel's information at least every 24 hours, and refreshes or deletes the stored YouTube API data described above (tokens, channel metadata, and upload results) no later than 30 calendar days after it was obtained. If a check finds the grant unusable, that same check starts removing its stored tokens, channel metadata and associated YouTube API publication results, retrying any incomplete cleanup until it finishes.
Disconnect. A Disconnect action in Monty revokes the authorization with Google immediately and, in the same action, deletes the stored connection — its tokens, channel metadata and YouTube API publication results. On the rare partial failure, the remaining cleanup is retried automatically by the next scheduled check, at most 24 hours later. Disconnecting Monty does not delete videos already uploaded to YouTube; you can manage those in YouTube Studio.
Revoking access through Google, and deletion requests. You can also revoke Monty's authorization directly in Google security settings, instead of disconnecting in Monty. Monty detects this on its next authorization check, at least every 24 hours, and deletes the stored YouTube data at that point — no separate deletion request is needed for that automatic cleanup. You can also ask Monty to delete your stored YouTube data at any time, either by using Disconnect or by writing to [email protected]; we delete it as soon as possible and within 7 calendar days. None of this affects data YouTube itself stores about your channel or uploads, which only YouTube controls.
Limited Use. Monty's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google API data is used to provide the features described here, not for advertising, sale to data brokers or building advertising profiles. Human access is limited to your affirmative consent, security or abuse investigations, or legal obligations, as allowed by that policy.
By connecting YouTube, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
5b. TikTok connection and Content Posting API
Monty connects your TikTok account so you can publish a finished video to it from Monty. Connecting TikTok is a separate authorization from signing in to Monty, and signing in does not by itself let Monty post anything. We never ask for or store your TikTok password.
Permissions and data. When you choose to connect TikTok, Monty requests:
user.info.basic— to receive your open ID, display name and avatar, shown on the publishing screen so you can see which account a post will go to.video.publish— to post the video directly to your TikTok profile at your request.video.upload— to send the video to your TikTok inbox as a draft instead, when you prefer to finish and post it in the TikTok app.
What we read when you publish. Immediately before the publishing screen is shown, and again when you press publish, Monty asks TikTok for your current creator settings: your nickname, the visibility options available to you, whether comments, duets and stitches are enabled on your account, and the maximum video length TikTok accepts from you. These are used to draw the screen and to stop a post TikTok would reject. They are not stored.
What we send. Only what you confirm on that screen: the video, its title, the visibility you selected, your comment, duet and stitch choices, and — if you declared it — whether the content promotes your own business or a third party. Nothing is sent to TikTok before you confirm.
Storage and protection. We store your TikTok open ID, handle and avatar URL, the granted permissions, token expiry information, and the OAuth access and refresh tokens needed to keep the connection working. Connection tokens are encrypted in our database and are not returned to the browser's connection list. Publication records may include the resulting post's identifier and status.
Sharing and AI processing. Our hosting and infrastructure providers process data needed to operate storage and publishing. TikTok receives the authorization request and, when you request a post, the selected video and its publication details. Media you provide for editing may be processed by the AI and media providers described in Section 5; TikTok account metadata and OAuth tokens are not inputs to our video-generation models. We do not use TikTok API data to train generalized AI or machine-learning models.
Retention, disconnect and revocation. Connection data is retained to maintain the TikTok connection you requested. A Disconnect action in Monty removes the stored connection, including its tokens, and Monty also asks TikTok to revoke the authorization, after which Monty disappears from your TikTok Manage app permissions. You can revoke it there yourself at any time. Disconnecting Monty does not delete posts already published to TikTok; you can manage those in the TikTok app. To delete your Monty account or other retained TikTok data, contact [email protected].
While Monty's TikTok integration is under review, TikTok restricts posts made through it to private visibility, so a post published from Monty is visible only to you until that review completes.
By connecting TikTok, you agree to be bound by the TikTok Terms of Service. TikTok's handling of your data is described in the TikTok Privacy Policy.
6. International data transfers
6.1. The Service operates globally, and your data may be processed in countries other than your own, including countries that may not be the subject of an EU "adequacy" decision.
6.2. Where we transfer personal data of EEA/UK individuals outside the EEA/UK, we rely on appropriate safeguards - in particular the European Commission's Standard Contractual Clauses (or the UK equivalent) together with a transfer risk assessment and supplementary measures (such as encryption and access controls). We work to keep EEA/UK personal data, and biometric data in particular, hosted within the EEA/UK where feasible, with remote access governed by those safeguards. You may request a copy of the relevant safeguards at [email protected].
7. Data retention
We keep account and transaction data for as long as you have an account and as required afterwards for legal, tax, and accounting purposes (generally up to the period required by applicable law). Voice/face models and samples are kept only while needed for the feature or until you withdraw consent or delete them, then deleted or anonymized. Logs and analytics are kept for a limited period.
8. Your rights
Depending on where you live, you may have the right to: access your data and receive a copy; rectify inaccurate data; erase your data; restrict or object to certain processing; data portability; and withdraw consent at any time without affecting prior processing. You may also opt out of marketing.
EEA/UK (GDPR): you may lodge a complaint with your local data-protection authority.
California (CCPA/CPRA): you have the right to know, access, correct, and delete your personal information; to opt out of the sale or sharing of personal information (we do not sell or share it); and to limit the use of sensitive personal information (such as voiceprints, which we use only to provide the feature you requested). We will not discriminate against you for exercising these rights.
To exercise any right, contact [email protected]. We will respond within the time required by applicable law and may need to verify your identity.
9. Cookies
We use cookies and similar technologies to operate the Service and for analytics. Where required, we ask for your consent to non-essential cookies through a banner, and you can change your choice at any time. You can also control cookies in your browser; disabling some may limit functionality.
If you do not accept analytics cookies, or have not answered the banner yet, we still count visits in an anonymous, cookieless way. Nothing is stored on your device: our analytics provider (PostHog, EU region) derives a salted hash of your IP address, the site domain and your browser's user agent. The salt changes every day and is then deleted, so the hash cannot identify you or recognise you on another day. We rely on our legitimate interest in basic analytics (Section 3). Visitors who send a Do Not Track or Global Privacy Control signal are only ever counted this way.
10. Children
The Service is for users aged 18 and over and is not directed to children. We do not knowingly collect their data; if you believe a person under 18 has provided us data, contact us and we will delete it.
11. Security
We take reasonable organizational and technical measures to protect personal data, including access controls, encryption of data in transit, logging, and monitoring, and use of trusted infrastructure. However, no method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. To the maximum extent permitted by law, we are not liable for any unauthorized access to, loss of, or alteration of your data that is beyond our reasonable control, and you provide your data at your own risk. If a breach affects your personal data, we will notify you and the competent authorities where the law requires.
12. Changes
We may update this Policy. The new version takes effect when posted on the Site, unless a later date is stated. We will make reasonable efforts to notify you of material changes.
13. Contact
Controller: Monty · Email: [email protected]