Legal
Privacy Policy
How Mondovo handles personal data — both yours, and the data your clients' website visitors leave behind on sites you publish with us. The two are treated differently, and section 2 explains why that distinction matters to you.
Last updated: 9 October 2026
1. Who we are
Mondovo, Inc. provides a platform for designing, publishing and managing websites, including Creative Studio and social publishing tools. In this policy, "Mondovo", "we" and "us" mean Mondovo, Inc. "You" means the person or business with a Mondovo account.
Mondovo, Inc. is a Delaware corporation. Our mailing address is 10685-B Hazelhurst Dr #12282, Houston, Texas 77043, United States, and you can reach us about anything in this policy through How to contact us.
2. Two kinds of data, two different roles
Most of our customers are agencies, studios and freelancers who build websites for their own clients. That means personal data reaches us by two separate routes, and our responsibility is different for each.
For your own data — your account, your billing details, the briefs and content you give us, your conversations with the assistant — we decide how it is used. In data protection terms we are the controller.
For data that visitors leave on a website you publish with us — an enquiry form, a quote request, a chat message, a page view — you decide what is collected and why. We only store and process it so that your site works and so that you can read it. In data protection terms you are the controller and we are your processor. If you are an agency, your client may in turn be the controller and you their processor; that arrangement is between you and them.
Practically: we do not decide what your published sites collect, we do not use what they collect for our own purposes, and we do not contact the people who fill in your forms.
3. What we collect from you
- Account details: your name, email address and an encrypted form of your password, your company name and profile picture if you add them, plus the organisation and team members you set up.
- Billing details: the contact, billing address and subscription information needed to charge you. Card numbers are handled by our payment processor and never reach our systems.
- What you give us to build with: briefs, descriptions, uploaded documents and images, the address of a site you ask us to redesign, and the content of the sites you create.
- Your conversations with the product: messages to the AI assistant, refinement instructions and voice input, along with the results, so that the work is repeatable and you can undo it.
- Usage data: which features you use and how the product performs, including session recordings of your own use of the Mondovo application, used to reproduce faults.
- Device and log data, collected automatically when you use the Mondovo application: browser type, operating system and device identifiers, IP address, access times and referring pages.
- Support and error reports: messages you send us, and diagnostic information captured automatically when something breaks.
4. What sites you publish collect from their visitors
A site published with Mondovo can collect personal data from the people who visit it. What it collects depends entirely on what you put on it. Where a site does collect data, we store it for you:
- Form and quote submissions, and quiz answers.
- Chat conversations, including WhatsApp and Instagram messages where you have connected those channels.
- Contact records built from the above, with the activity timeline attached to them.
- Page analytics events, and records of consent where a visitor subscribes to email.
You are responsible for telling your visitors what your site collects and why — your own privacy notice, and cookie or consent banners where the law requires them. Mondovo does not write or publish that notice for you.
6. Google Analytics and YouTube
These integrations are optional. When you connect Google Analytics, we receive encrypted authorization tokens and read the accounts, properties, web streams and reporting data you authorize. We use this access to let you select a property and web stream and show its visitor, traffic, page and conversion reports in Mondovo. We do not create or edit your Google Analytics accounts, properties or streams. When you save a web stream for a site, we store its identifiers and install its Google Analytics tag when that site is published. The tag sends visitor activity directly to Google according to the site's tracking and consent settings. Customer tracking replaces Mondovo's central Google Analytics tracking by default; you can explicitly choose to run both.
Mondovo uses YouTube API Services. When you connect a YouTube channel, we receive encrypted authorization tokens and channel identifiers, names and profile images. We use these to identify your destination channel and upload the videos you approve, including their title, description, visibility, audience choice and synthetic-media disclosure. We store connection details and upload status to deliver scheduled posts and show their results. Your approved video and metadata are shared with YouTube; authorized members of your Mondovo workspace can see the connected account and delivery results within their assigned scope. Google's handling of data is described in the Google Privacy Policy.
We use Google API data to provide the features you authorize. We do not sell this data, use it for advertising, or use it to train generalized AI models. Mondovo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Access is limited to authorized workspace members and the service providers needed to operate these features, subject to those requirements.
You can disconnect Google Analytics reporting in the site's Analytics settings. This deletes its stored authorization tokens but keeps the site's selected tracking tag; use the separate removal action and republish to remove that tag. You can disconnect YouTube in Social Accounts to erase its stored authorization tokens, channel identity and YouTube delivery data, and stop further scheduled delivery to that connection. We periodically reconfirm authorization and refresh channel data; stale delivery API data is removed within 30 days. Disconnecting Mondovo does not delete videos already stored on YouTube; manage those in YouTube Studio.
You can also revoke Mondovo's access through your Google account permissions. To request deletion of Google or YouTube data stored by Mondovo, or to ask about these integrations, write to privacy@mondovo.com. We process YouTube API data deletion requests as soon as possible and within seven calendar days. Deleting data held by Mondovo does not delete data held by Google or YouTube.
7. Text messages (SMS)
Mondovo handles mobile phone numbers and text messages (SMS and MMS) in two ways, matching the two roles described in section 2.
Texts we send to you. If you give us your mobile number and agree to receive texts, we use it to send account and service messages — sign-in and verification codes, alerts about new enquiries and bookings, and notices about your sites and account. Message frequency varies. Message and data rates may apply. Reply STOP to stop receiving them, or HELP for help, at any time, or write to us through How to contact us. Agreeing to receive texts is never a condition of buying anything from us.
Texts your published sites send. When you turn on text messaging for a site, messages such as booking reminders, enquiry replies and follow-ups are sent in your business's name to people who have agreed to receive them from you. To deliver them we process the recipient's mobile number, the message content, delivery status and records of their consent and opt-out. To register your business with mobile carriers on your behalf we also process the business details you give us, such as its legal name, tax or registration number, address, website and a contact person. For this data you are the controller and we are your processor.
When someone replies STOP to your business, we record the opt-out and stop sending them texts from that business until they opt in again. You are responsible for collecting consent before texting anyone and for following the messaging laws that apply to you and your recipients.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, other than the messaging providers and carriers needed to deliver the messages. We do not sell mobile numbers or SMS consent records.
8. Why we use it
- To run the service: generating and refining designs, publishing sites, delivering enquiries to your inbox.
- To bill you and keep records of what you paid for.
- To support you when you ask, and to investigate faults you or our monitoring report.
- To keep the platform secure and to prevent abuse.
- To improve the product — understanding which features are used, and where people get stuck.
9. AI processing
Generating and refining a website means sending the material you give us — the brief, the content, reference images and the instructions you type or speak — to the AI providers we use. Those providers are named on our sub-processors page, which is linked from Who else sees it.
We do not sell this material, and we do not use your content or your clients' content to train models of our own.
AI output is generated, not verified. It can be wrong, and it can resemble other work. Review what a design says before you publish it for a client — particularly prices, claims, and anything a customer might rely on.
11. Where data is held
Mondovo is based in the United States and our providers operate in the United States and other countries. If you or your visitors are in the United Kingdom, the European Economic Area or another region with transfer rules, your data may be transferred outside that region to be processed. Where that happens we rely on the transfer safeguards our providers offer, including standard contractual clauses.
12. How long we keep it
We keep your account and site data for as long as your account is open. When you delete a site it leaves your workspace immediately and is held in a recoverable state for a short period so it can be restored if the deletion was a mistake, after which it is removed.
Data collected by your published sites — contacts, submissions, conversations — is yours. You can delete it from your workspace at any time, and we delete it when you close your account.
We keep billing records for as long as tax and accounting law requires, and security and audit logs for a limited period.
13. Your rights
Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted (including data we hold under a Meta or Google authorization), to object to or restrict how we use it, to receive it in a portable form, and to withdraw consent where we rely on it. You can exercise most of these directly in your workspace; for anything else, write to us through How to contact us and we will respond within the time the law allows.
If a visitor to a site you publish asks us to exercise their rights, we will pass the request to you, because that data is yours rather than ours.
If you are in the UK or EEA you also have the right to complain to your data protection authority.
15. Security
Data is encrypted in transit. Access to production data is restricted to the people who need it, credentials and connected-account tokens are stored encrypted, and administrative actions are logged.
No service can promise it will never be breached. If a breach affects your personal data we will tell you and, where required, the relevant authority.
16. Links to other services
The service and the sites you publish may link to websites and services run by others. We are not responsible for their privacy practices; read their own policies.
17. Data processing agreement
Because we process personal data on your behalf when your sites collect it, agencies with clients in regulated markets usually need a data processing agreement. We will provide one on request — write to us through How to contact us.
18. Children
Mondovo is a business tool and is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.
19. Changes to this policy
We update this policy when what we do with data changes. The date at the top is the version you are reading. If a change materially affects you we will tell you in the product or by email before it takes effect.
20. How to contact us
Write to us about anything in this policy — a request about your data, a data processing agreement, or a question about how something works.
Contact
Questions about this policy, requests about your personal data, or a data processing agreement:
Mondovo, Inc. 10685-B Hazelhurst Dr #12282 Houston, Texas 77043 United Statesprivacy@mondovo.com