Privacy Policy

Monica is an AI-powered business management SaaS platform operated by Urpe AI Lab (“we”, “us”, “the company”). This Privacy Policy describes what data we collect, how we use it, who we share it with, and what rights you have. It applies to your use of Monica through https://app.immonica.com and its related services.

• Account data: name, email address, password (stored as a hash), company and role.
• Mobile number and contact consent: the mobile number you give us when you sign up and, if you check the SMS and calls box, the record of your consent (date and time, IP address and the text you accepted).
• Your business data: the information you or your team upload to the platform (clients/leads, appointments, tasks, invoices, messages, notes, etc.).
• Connected account data: when you connect external services (e.g. Google), the access tokens and the information those services return, according to the permissions you authorize.
• Technical data: IP address, browser type, session identifiers and usage logs needed to operate and protect the service.

• Provide, maintain and improve Monica’s features.
• Authenticate users and protect accounts against unauthorized access.
• Sync and display information from the services you connect (e.g. calendar events).
• Send operational communications (email verification, invitations, notifications).
• Text you and call you about your account and Monica plans, only if you gave us consent (Terms of Service, section 11). You can withdraw it anytime by replying STOP to a text or telling us during a call.
• Comply with legal obligations and prevent fraud or abuse.

When you connect your Google account, Monica requests only the permissions (scopes) needed for the feature you turn on, for example access to Google Calendar to create and display your appointments.

Monica’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only use Google data to provide the features you requested within Monica.
• We don’t sell Google data or use it for advertising.
• We don’t transfer it to third parties unless it’s necessary to provide the service, for security, or to comply with the law.
• We don’t use Google data to create, train or improve generalized or foundational artificial intelligence models, and we don’t allow third parties to do so.
• Humans don’t read your Google data unless you authorize it, it’s necessary for security (e.g. investigating abuse), to comply with the law, or the data is aggregated and anonymized.

Use of artificial intelligence with Google data

Scheduling in Monica is handled by an artificial intelligence assistant in a chat conversation. To propose meeting times, that assistant receives only the derived availability from your Google Calendar (free/busy time blocks that our server calculates from your events’ times). We never send the content of your events to the AI (titles, descriptions, guests or notes).

AI models run through third-party providers on paid API plans (via OpenRouter, which routes to providers such as Anthropic and OpenAI). Under the terms of those API plans, data sent through the API is not used to train their models. We don’t transfer Google API data (raw, aggregated or derived) to any AI service that uses it to train or improve its models.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Monica’s access to your Google account at any time from the app’s Connections section or from your Google account’s security settings.

We don’t sell your personal data. We only share it with:

• Infrastructure providers (hosting, database, email delivery, telephony and SMS, AI voice) that process data on our behalf under confidentiality agreements.
• Services you connect, according to the permissions you authorize.
• Artificial intelligence providers: what you write in the chat with Monica, the business and contact data Monica uses to serve your contacts, and the audio of its calls are sent to third-party AI models through OpenRouter (providers such as Anthropic and OpenAI) and to our AI voice provider, only as each task needs and under paid API plans that don't use that data to train their models. In the mobile app we ask for your permission before sending anything.
• Mobile app: the Monica app for iPhone and Android uses the same ad measurement and advertising as the website (the Meta pixel and the Conversions API), described in the items below, and you can opt out the same way. On iPhone, the app declares those tracking domains to Apple and respects the tracking permission you give in Apple's prompt (App Tracking Transparency).
• Meta (ad measurement): to measure our ads, the Meta pixel on immonica.com and on the sign-up page and the Conversions API let Meta know when you sign up, finish setup or start the plan. If you arrive through an ad, we keep the ad identifier and its tags (utm) in your browser for up to 90 days (and in your account once you finish setup) to know which ad you came from. We send your email, first name and account identifier as hashes (irreversibly encoded), plus your IP address, your browser and the identifiers in Meta’s cookies (_fbp, _fbc). We never send them data about your business or your customers.
• Google (ad measurement): if you arrive through a Google ad, we keep the click identifier (gclid, or gbraid and wbraid on iPhone) in your browser (and in your account) for up to 90 days, and every night we let Google Ads know when you signed up, finished setup or started the plan, with that identifier and your email as a hash. On immonica.com, the Google Ads tag uses its own cookies (_gcl_aw). We never send them data about your business or your customers.
• Meta and Google (Monica advertising): besides measuring, we may use the Meta pixel and the Google tag to show you Monica ads on Facebook, Instagram, Google Search, YouTube and other sites if you visited immonica.com or signed up. Meta and Google may include you in audiences based on what their cookies see of your visit and on the sign-up, setup and plan notices we send them; for example, to show you ads if you visited the site but didn’t sign up, or to stop showing them once you’re a customer. Meta and Google use their own cookies to serve ads based on your past visits. We never use your business or customer data, or data from the accounts you connect (Gmail, Calendar or Drive), for this. Some U.S. privacy laws call this “sharing” data for advertising: you can opt out as explained in the next item, and also fromGoogle’s ad settings andMeta’s ad preferences.
• How to opt out of ad measurement and advertising: the “Ad privacy” link at the bottom of immonica.com turns off the Meta pixel and the Google tag, keeps your sign-up from being sent to Meta or Google and stops adding you to their audiences. We also honor your browser’s Global Privacy Control signal. We do not measure ads from, or add people to advertising audiences in, the European Union, the rest of the European Economic Area, the United Kingdom or Switzerland. If you opt out after signing up, we stop sending your data from that moment on (for example, when you start the plan); what Meta or Google already received cannot be withdrawn.
• Authorities, when required by law.

Mobile numbers and text messages: we do not share or sell your mobile number, SMS opt-in data or consent to third parties or affiliates for their marketing or promotional purposes. All the categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, except the service providers that deliver our texts and calls on our behalf (for example, Twilio and our voice provider).

We apply reasonable technical and organizational measures: encryption of credentials and integration secrets (AES-256-GCM), hashed passwords, encrypted transport (HTTPS) and data isolation per organization (multi-tenant). No system is 100% infallible, but we work to protect your information.

We keep data while your account is active or as needed to provide the service and comply with legal obligations. When you disconnect an external account, we delete the associated access tokens.

Deleting your account: on the web or in the Monica app for iPhone and Android, go to My profile → Privacy & account → Delete my account. Before anything is deleted, we show you what will be removed and ask you to confirm. If you are the only admin of your business, the business is deleted with all its data and its subscription is canceled; if there is another admin, only you leave. You can also request it by writing to privacidad@urpeailab.com. Details, including what is kept, are at https://app.immonica.com/delete-account.

After deletion we keep only what the law requires or what serves as legal evidence: the record of SMS, call and AI-use consents (date, IP and accepted text), our payment processor's payment records, and backups, which are deleted automatically within 60 days. What Meta or Google already received for ad measurement can't be withdrawn.

Depending on your jurisdiction, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise them, contact us at privacidad@urpeailab.com.

We may update this Privacy Policy. We’ll post the current version on this page and update the “last updated” date.

Urpe AI Lab — privacidad@urpeailab.com