Privacy Notice

NTV LTD, trading as Monocrawl, is the controller of personal information used to create accounts, supply the service, bill customers, secure systems and handle enquiries. Its registered office is Amelia House, Crescent Road, Worthing, West Sussex, England, BN11 1QR; company number 11364012.

This Notice applies under the UK GDPR and Data Protection Act 2018 as amended, including relevant changes made by the Data (Use and Access) Act 2025.

This Notice covers visitors, account users, prospective and current customers, people who contact us, and security events involving the service. It does not govern a customer’s independent use of API results.

Personal information appearing in third-party or publicly accessible source data is addressed separately in the Public Data and Data Sources Notice. Depending on the processing, a customer may be an independent controller of its downstream use.

• Account and identity information: name, email address, encrypted authentication records, OAuth identifiers if Google or GitHub sign-in is used, role, two-factor configuration, session and recovery metadata. For new accounts, we also record the Terms and Privacy Notice versions, the time of agreement and whether it was given through the email signup checkbox or the Google/GitHub signup notice. This is separate from optional cookie and advertising preferences.
• Service and security information: API-key hashes, encrypted copies of new API keys and labels, IP address, user agent, sign-in/session activity, rate-limit identifiers, request path and parameters, request ID, response status, timing, provider, credit use, cache status and diagnostic errors. We store a hash to validate API requests and an encrypted copy of new API keys so the signed-in owner can reveal or copy them. Encryption keys are kept separately from the database. We do not persist API keys as plaintext.
• Product content: saved Explorer and research history, source excerpts and generated reports, jobs and job results, monitors and runs, cohorts, notifications, webhook endpoints and delivery records, and support or legal requests you submit.
• Billing information: customer and payment references from Stripe, billing address and tax status where returned to us, pack or plan, amount, currency, tax, credits, invoice/payment status, receipts, subscription state, auto-recharge settings and checkout-consent evidence. Card numbers and CVC are entered into Stripe, not Monocrawl.
• Communications: support, billing, cancellation, privacy, public-data, legal and security messages plus their request status.
• Optional product analytics: when you allow Product analytics in Cookie settings, page categories, selected actions, bounded campaign labels and pseudonymous journey identifiers, linked to confirmed signup, API use and subscription outcomes where you sign in. We also count dashboard tools once per tool per UTC day, with evidence of your consent. No form contents, raw URLs, search queries, result bodies or session replay are collected. These first-party product events are not sent to advertising networks. Optional cancellation reasons and comments are collected separately and also recorded with Stripe; these and existing request and paid service-period records help us understand product use and retention.
• Optional advertising measurement: only when you separately allow Advertising measurement, Google Ads receives ad-click and cookie identifiers, consent signals, network/device information including IP address and user agent, account signup and first-paid-subscription events, a pseudonymous signup ID, the Stripe invoice ID for the first paid subscription, and the actual first subscription payment amount including any tax with its currency. We send a fixed homepage URL containing only supported ad-click parameters. We do not send account email/name, API keys, API activity, search terms, result contents, checkout session references or card details. We do not enable enhanced conversions or remarketing.
• Public-source query material: usernames, URLs, post IDs, search terms or other targets you ask an endpoint to retrieve. A target can itself be personal information.

Contract and steps before a contract

We use account, request, billing, subscription, job, monitor, webhook and support information to open the account, authenticate you, execute requested calls, meter credits, take payment, provide receipts, deliver webhooks and provide support.

Legal obligations

We keep and disclose information where necessary for tax, accounting, company, consumer, payment, sanctions, law-enforcement or data-protection duties.

Legitimate interests

We use proportionate service and security information to prevent fraud and abuse, defend systems, investigate incidents, diagnose failures, enforce the Terms, understand reliability and improve the service. Our interests are providing a secure commercial API and protecting customers and upstream resources. We balance those interests against the impact on people and use less identifying information where practical.

Product-use and cancellation reports are restricted to authorised staff. Account-linked tool visits and cancellation feedback are deleted with your account; legally required billing records follow the retention rules below. You can leave cancellation feedback blank and still cancel.

Consent

We ask separately for consent to referral attribution, optional account-linked product analytics and advertising measurement through Cookie settings. All are off until you agree, including in the UK, EU, US and Israel. Prior analytics or referral permission does not authorize advertising. You can withdraw any permission using the same settings; this stops future collection in that browser and clears the corresponding accessible optional storage. Your signed preference records the version and time of the choice. Authentication, payment processing, required request logs and security controls continue when optional choices are off.

Advertising measurement uses consent, not a legitimate-interest substitute for a declined choice. Google’s and Reddit’s tags stay blocked before permission and when declined; we do not send cookieless advertising pings, upload declined visitors’ conversion data, or send hashed customer contact information. Google may use general conversion modelling in its reports. Our own account and billing totals remain separate operational records, including customers who declined advertising. Adding Reddit requires a new privacy choice; earlier Google-only permission is not reused.

We receive information from you, your organisation, your browser or API client, Stripe, authentication providers you choose, security and infrastructure services, and the third-party source or upstream provider named or implied by the endpoint.

For public-source information about someone who is not a customer, categories typically include public profile identifiers, public posts or comments, public engagement figures and related metadata. Sources include official APIs, independent API providers and publicly accessible pages. Exact provenance varies by endpoint and response; see the Public Data Notice.

We disclose only what is reasonably needed to run the service. Current infrastructure categories are:

• Supabase-hosted PostgreSQL on AWS eu-west-1 (Ireland) for the application database. The application uses the database connection directly; the Supabase Data API is disabled.
• Vercel for web application hosting and request execution, configured to the London region for the application; Fly.io for persistent background jobs and monitor execution.
• Stripe for Checkout, card/payment processing, invoices, tax calculation, subscriptions and fraud controls.
• Upstash Redis for distributed rate-limit counters and eligible public API response caching. Cached responses can contain the public personal information returned by an endpoint. Counter keys use service identifiers or pseudonymous IDs rather than plaintext API keys.
• Google or GitHub only when you choose that OAuth sign-in method.
• Separately from sign-in, Google Ads when you allow Advertising measurement. Google processes the advertising data described above under its applicable advertising terms and privacy policies and may process it outside the UK/EEA. Microsoft advertising tracking and PostHog export are not currently enabled.
• Reddit Ads when configured and you allow Advertising measurement: page-visit, signup and first-paid-subscription events, validated ad-click identifiers, browser identifiers, network/device information, pseudonymous signup or Stripe invoice transaction identifiers, and actual payment amount including tax with its currency. We do not supply customer email, phone or raw account identifiers. The isolated measurement document contains no customer forms or API results. With advertising permission alone, our server can retain encrypted Reddit click/browser identifiers linked to your account and consent for up to 30 days, and upload your first genuine subscription payment through the Conversions API. Browser and server use the same invoice conversion ID for deduplication. No old unconsented payment is backfilled. Withdrawal clears match identifiers and suppresses future queued uploads; an upload already in progress may finish before the change is confirmed. Reddit processes the data under its Business Tool Terms and Privacy Policy, including processing outside the UK/EEA. We do not create remarketing audiences.
• Endpoint upstreams and official APIs, which receive the query target and parameters needed to perform the request but do not receive your Monocrawl password or plaintext API key.
• Public-data suppliers, by category: contracted social-platform data suppliers (public profiles, posts, comments, search and ad-library data); independent vendors reached through an API marketplace (retail and marketplace listings, professional-network data, social content, business and software reviews, travel listings and company financial information); search-and-shopping data suppliers (search results, shopping, app-store and business listings, and web-page audits); and official APIs, public datasets or public pages used by the particular endpoint. The private supplier register and route metadata identify the selected source. A platform appearing in the catalogue does not mean its official API is used. Suppliers receive the query target and parameters needed for the request.
• Large-language-model providers receive relevant instructions and source material when research briefings, monitor relevance checks, schema extraction or the assistant compose text. That material can contain public personal information or identifying text you enter. We do not intentionally send your account credentials or API key. An alternate provider may be used when a configured service fails.
• Infrastructure providers, by category: web hosting and scheduled-job execution; a managed PostgreSQL database; a managed cache and queue service; a payment processor for checkout, invoices, tax and fraud controls; a transactional email delivery service; and a bot-check service on public forms.
• Professional advisers, insurers, auditors, authorities or a buyer of the business where necessary and subject to legal safeguards.

We use transactional email providers to deliver account messages, request acknowledgements and alerts you enable. They receive the recipient address and message content needed for delivery. Requests submitted at Contact are also written to the internal request queue, so recording a request does not depend on email delivery.

Results are delivered to the requesting account and to destinations that account configures, such as email or webhook recipients. Customers can download or export supported results; copies they distribute are outside our direct control. The former standalone Briefings feature and its public report-sharing links are withdrawn.

The primary database region is Ireland and application execution is configured in London. Some suppliers are headquartered or provide support and onward processing outside the UK. Where UK personal information is transferred to a country without UK adequacy regulations, we require an applicable safeguard such as the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful transfer mechanism, together with risk assessment where required.

Calling an endpoint may send a target to an upstream in another country. Do not submit confidential information or unnecessary personal information as a query.

You can ask for information about the recipient and transfer mechanism relevant to your data, including how to obtain a copy of applicable safeguards, through our recorded privacy request route.

For Google Ads, see how Google uses information from partner sites and Google’s advertising data-processing terms, including applicable international-transfer terms. Consent to measurement does not remove the requirement for a valid transfer mechanism.

For Reddit Ads, see Reddit’s Privacy Policy and Reddit’s Business Tool Terms, including their international-transfer provisions.

• Authentication sessions expire after seven days under the current account configuration; a user or operator can revoke them sooner.
• Advertising dispatch markers and first-party ad identifiers normally last up to 90 days. We only offer recent signup/payment events from the last 30 days that occurred during the current advertising-permission period; older events are not backfilled. Google and Reddit retain information they receive under their own advertising policies and account settings. Withdrawal stops future sends but does not automatically retract past conversions or delete cookies on their domains; contact us about erasure or correction requests.
• Account, keys, wallet, usage events, jobs, monitors, cohorts, webhook configuration and ordinary service history are kept while the account exists, or until an available deletion action removes the item. Self-serve account deletion cascades through those account-linked records.
• Manual research-tool history normally retains the latest 30 runs per account. This is a number of runs, not a 30-day time limit; records needed for pending work or monitor review can remain longer. Historical research reports and monitor evidence can remain until deleted or the account is closed. Withdrawing a feature or pausing a monitor does not itself erase its saved records.
• Scraper history expires after 30 days, and temporary MCP result evidence expires after 24 hours. Housekeeping removes expired records; their read paths enforce expiry before physical deletion.
• Public response cache entries use documented endpoint-specific lifetimes. The public category directories for Amazon and Target and the Sephora brand directory may be retained for up to one additional hour for a clearly marked response during a temporary retrieval outage; total cache retention never exceeds 24 hours from the original retrieval. Eviction can remove an entry sooner.
• Idempotency records expire after 24 hours and are deleted by worker housekeeping.
• Open support, cancellation, privacy, legal and security requests are kept while handled and afterwards only as long as reasonably needed for follow-up, dispute evidence, safeguarding or legal compliance.
• Payment, tax, invoice and checkout-consent evidence is kept for at least the applicable statutory period. Current deletion takes a pseudonymised snapshot of payment records through the end of the sixth year after the transaction year. Stripe references can still permit re-identification with access to Stripe, so this record is pseudonymised, not anonymous.

Deletion first disables auto-recharge and cancels an active Stripe subscription; if Stripe does not confirm cancellation, local erasure is aborted. Legal holds, disputes, fraud prevention or tax duties may require limited information to be kept longer.

Controls include hashed API keys, authenticated encryption for recoverable keys, encrypted transport, scoped authentication, optional two-factor authentication, revocable sessions, body-size limits, distributed rate limiting, signed webhooks, audit records, private-network blocking for customer-supplied fetch targets and restricted database access.

No internet service can guarantee absolute security. Use unique credentials, enable two-factor authentication, restrict and rotate keys, and report suspected incidents through the security category without sending secrets.

Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability, or an explanation of processing; object to processing based on legitimate interests; withdraw consent; and complain to a supervisory authority. Rights are not absolute and we may need identity evidence or retain information required by law.

For direct marketing, an objection is unconditional. For legitimate-interest processing, we will stop unless compelling legitimate grounds override your interests, rights and freedoms or the information is needed for legal claims. Public-data suppression requests are handled under the Public Data Notice.

We do not currently make solely automated decisions about customers that produce legal or similarly significant effects.

Monocrawl uses authentication/session storage, security state and a cookie remembering your privacy choice, plus storage for requested interface and workflow features. Referral storage, product analytics and advertising measurement are separate optional, permission-controlled choices. Stripe may set its own security and checkout storage on Stripe-hosted pages.

The inventory, durations and controls appear in the Cookie Policy. Use Cookie settings in the website footer or dashboard to change your optional choices at any time.

Submit a privacy request at our recorded contact route; choose “Privacy/data rights”. It accepts requests without an account and provides a reference. Postal requests may be sent to NTV LTD, Amelia House, Crescent Road, Worthing, West Sussex, England, BN11 1QR.

You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the chance to address the issue first, but you do not have to contact us before the ICO.

We acknowledge data-protection complaints within 30 days, investigate them appropriately and communicate the outcome. Requests to exercise your data rights follow their applicable deadline, normally one calendar month; the complaint acknowledgement period does not replace that deadline.