This Privacy Policy explains how the operator of the Monty service (the "Provider", "we", "us") collects, uses, shares, and protects personal data of visitors to monty.fast and users of the Service. We aim to comply with applicable data-protection laws, including the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and others, to the extent they apply to you. Your use of the Service is also governed by our Terms of Service, including its disclaimers, "no guarantee of results", and limitation-of-liability provisions, which apply to this Policy to the extent permitted by law.
1. Controller and contact
The controller responsible for your personal data is Monty. Contact for any privacy matter: [email protected].
We act as the controller for account, billing, usage, and marketing data, and for visitors to the Site. For the content you upload and process through the Service, you act as the controller of any third-party personal data it contains, and we act as your processor, handling that content on your instructions and as described here.
EU / UK representative (Art. 27 GDPR): to be appointed; once appointed, the representative's name and address will be published here so EEA and UK users can contact a local point of contact.
2. What data we collect
- Account data - email address, name or nickname, and authentication data (including third-party sign-in such as a Google account).
- Content you provide - the videos, audio, images, and text you upload (Your Content) and the outputs created from them.
- Voice and face data (biometric). If you use voice cloning or avatar features, we process samples of your voice and/or face to build and operate your personalized model. In some jurisdictions this is biometric / sensitive personal data and we process it only with your separate explicit consent (see Section 4).
- Usage and technical data - IP address, device and browser information, cookie identifiers, and date and time of access.
- Transaction data - records of plans, purchases, and history. We do not collect or store full payment card details; these are handled by our payment processors.
- Communications - the content of your requests when you contact us.
Please do not upload special-category data about others, or any person's voice or face, without a lawful basis and their consent. You are solely responsible for the personal data you upload or generate about third parties, including obtaining any required consent and lawful basis, and we rely on your representations that you have done so. You are also responsible for the accuracy of the information you provide to us.
3. Purposes and legal bases
Where the GDPR or similar law applies, we rely on the following legal bases per purpose:
| Purpose | Legal basis |
|---|---|
| Create and manage your account; provide the Service and its features; create and publish Output to the platforms you connect; process payments | Performance of a contract (Art. 6(1)(b)) |
| Secure the Service, prevent abuse and fraud, maintain and improve the Service, basic analytics | Legitimate interests (Art. 6(1)(f)) |
| Voice/face (biometric) processing for cloning and avatars | Your explicit consent (Art. 9(2)(a)) |
| Optional marketing messages; non-essential cookies | Your consent (Art. 6(1)(a)), withdrawable anytime |
| Comply with legal, tax, and accounting obligations | Legal obligation (Art. 6(1)(c)) |
4. Voice, face and automated processing
4.1. Voice and face cloning involves processing biometric data and is carried out only with your separate, explicit, opt-in consent, which you can withdraw at any time; withdrawal does not affect prior processing. We use these samples solely to build and operate your personalized model and do not use them to identify you or to train general AI models.
4.2. The Service uses automated processing to generate and edit videos. We do not make decisions that produce legal or similarly significant effects about you solely by automated means without human involvement.
5. How we share data
We share personal data only as needed, under contracts that require confidentiality and security, with:
- Payment processors - to take and process payments;
- Hosting and cloud infrastructure providers - to run and store the Service;
- AI and media-processing providers - to generate scripts, captions, voice, and video;
- Analytics and email/communication providers - to operate the Service;
- The third-party platforms you connect (YouTube, Instagram, TikTok, Telegram) - when you choose to publish to them;
- Acquirers or successors - in connection with a merger, acquisition, financing, reorganization, or sale of assets, where the recipient is bound to protect your data consistently with this Policy;
- Authorities or advisers - where required by law, to enforce our terms, or to protect the rights, safety, and security of users, the public, or us.
An up-to-date list of our subprocessors is available on request at [email protected].
We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as defined under California law.
When you publish Output to a connected platform (such as YouTube, Instagram, TikTok, or Telegram), or use a payment processor or other third-party service, that party receives and processes the relevant data as an independent controller under its own privacy policy and terms. We do not control, and to the maximum extent permitted by law we are not responsible or liable for, how those third parties collect, use, secure, or disclose data. Please review their policies before you connect or publish.
5a. YouTube API Services
Monty uses YouTube API Services to publish videos to the YouTube channel you connect and to read basic channel information (channel identifier, channel title, and avatar) needed to show you where your video will be published. By connecting a YouTube account you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
What we access and store: your channel identifier, channel title, and avatar (to label the connection in your cabinet), and the OAuth tokens required to upload the videos you explicitly approve. We do not read your subscriber lists, analytics, comments, or private data, and we never publish anything without your explicit per-video confirmation.
Retention and deletion: OAuth tokens and channel metadata are stored only while the connection is active. Disconnecting the account in your cabinet, or deleting your Monty account, deletes the stored tokens and channel metadata within 7 days. You can also revoke Monty's access at any time in your Google security settings.
Limited Use. Monty's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data (your channel identifier, title, avatar and the OAuth tokens) is used only to provide the publishing feature you request; it is never used for advertising, never sold, never transferred to data brokers or used to build profiles, and is read by humans only with your consent, for security or abuse investigations, or where required by law.
6. International data transfers
6.1. The Service operates globally, and your data may be processed in countries other than your own, including countries that may not be the subject of an EU "adequacy" decision.
6.2. Where we transfer personal data of EEA/UK individuals outside the EEA/UK, we rely on appropriate safeguards - in particular the European Commission's Standard Contractual Clauses (or the UK equivalent) together with a transfer risk assessment and supplementary measures (such as encryption and access controls). We work to keep EEA/UK personal data, and biometric data in particular, hosted within the EEA/UK where feasible, with remote access governed by those safeguards. You may request a copy of the relevant safeguards at [email protected].
7. Data retention
We keep account and transaction data for as long as you have an account and as required afterwards for legal, tax, and accounting purposes (generally up to the period required by applicable law). Voice/face models and samples are kept only while needed for the feature or until you withdraw consent or delete them, then deleted or anonymized. Logs and analytics are kept for a limited period.
8. Your rights
Depending on where you live, you may have the right to: access your data and receive a copy; rectify inaccurate data; erase your data; restrict or object to certain processing; data portability; and withdraw consent at any time without affecting prior processing. You may also opt out of marketing.
EEA/UK (GDPR): you may lodge a complaint with your local data-protection authority.
California (CCPA/CPRA): you have the right to know, access, correct, and delete your personal information; to opt out of the sale or sharing of personal information (we do not sell or share it); and to limit the use of sensitive personal information (such as voiceprints, which we use only to provide the feature you requested). We will not discriminate against you for exercising these rights.
To exercise any right, contact [email protected]. We will respond within the time required by applicable law and may need to verify your identity.
9. Cookies
We use cookies and similar technologies to operate the Service and for analytics. Where required, we ask for your consent to non-essential cookies through a banner, and you can change your choice at any time. You can also control cookies in your browser; disabling some may limit functionality.
10. Children
The Service is for users aged 18 and over and is not directed to children. We do not knowingly collect their data; if you believe a person under 18 has provided us data, contact us and we will delete it.
11. Security
We take reasonable organizational and technical measures to protect personal data, including access controls, encryption of data in transit, logging, and monitoring, and use of trusted infrastructure. However, no method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. To the maximum extent permitted by law, we are not liable for any unauthorized access to, loss of, or alteration of your data that is beyond our reasonable control, and you provide your data at your own risk. If a breach affects your personal data, we will notify you and the competent authorities where the law requires.
12. Changes
We may update this Policy. The new version takes effect when posted on the Site, unless a later date is stated. We will make reasonable efforts to notify you of material changes.
13. Contact
Controller: Monty · Email: [email protected]