Privacy Policy

Last updated: March 28, 2026

This Privacy Policy describes how Kaaren Orbiit ("Company", "we", "us", or "our") collects, uses, and protects your information when you use MonkeyLeads ("Service"). By using the Service, you consent to the practices described in this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Name and last name
• Email address
• Phone number (optional)
• Password (stored as a one-way hash, never in plain text)
• Timezone preference

1.2 Lead Data

When you or your website visitors submit data through the MonkeyLeads API, we collect and store the lead information transmitted. This may include names, email addresses, phone numbers, and any custom fields you define. You are the data controller for Lead Data; we act as a data processor on your behalf.

1.3 Usage Information

We automatically collect certain information about how you interact with the Service:

• IP address and approximate location
• Browser type and operating system
• Pages visited and features used within the dashboard
• Dates and times of access
• API call logs (endpoint, timestamp, response status)

1.4 Billing Information

Payment processing is handled by Stripe. We do not store your full credit card number. We receive and store a limited set of billing details from Stripe, including the last four digits of your card, card brand, and billing address.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service — process leads, execute automation rules, manage team access, and deliver dashboard functionality.
• Communicate with you — send transactional emails (account verification, password reset, team invitations), billing notifications, and important service updates.
• Improve the Service — analyze usage patterns to fix bugs, improve features, and develop new functionality.
• Ensure security — detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations — respond to legal requests and enforce our Terms of Service.

We do not sell, rent, or trade your personal information or Lead Data to third parties for marketing purposes.

3. How We Share Your Information

We share your information only in the following circumstances:

• Service providers. We use third-party services to operate the platform (hosting, email delivery, payment processing). These providers access your data only to perform services on our behalf and are contractually bound to protect it.
• Automation destinations. When you configure automation rules (email notifications, webhooks), Lead Data is transmitted to the endpoints you specify. You control these destinations.
• Team members. Lead Data is shared within your workspace with team members you invite, according to their assigned roles.
• Legal requirements. We may disclose information if required by law, regulation, legal process, or governmental request.
• Business transfers. In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data becomes subject to a different privacy policy.

4. Data Retention

• Account data is retained as long as your account is active.
• Lead Data is retained as long as your workspace exists.
• After account termination, we retain your data for 30 days to allow for export, then permanently delete it.
• API logs are retained for 90 days for debugging and security purposes.
• Billing records may be retained longer as required by tax and financial regulations.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/HTTPS) for all connections
• Encryption at rest for sensitive data
• Password hashing using secure one-way algorithms
• API key authentication with domain restrictions
• Role-based access control within workspaces
• Regular security reviews and updates

While we take reasonable steps to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request correction of inaccurate or incomplete data.
• Deletion. Request deletion of your personal data (subject to legal retention requirements).
• Portability. Export your Lead Data via the API at any time.
• Objection. Object to processing of your data for certain purposes.
• Withdrawal of consent. Withdraw consent for data processing where consent is the legal basis.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Your Responsibilities as Data Controller

When you collect Lead Data through the MonkeyLeads API, you act as the data controller. You are responsible for:

• Obtaining appropriate consent from individuals before collecting their data.
• Providing a privacy notice to individuals whose data you collect.
• Ensuring your data collection practices comply with applicable laws (GDPR, CCPA, LGPD, etc.).
• Responding to data subject requests from individuals whose Lead Data you store in MonkeyLeads.
• Configuring the Allowed Domains feature to prevent unauthorized data submissions.

8. Cookies and Tracking

The Service uses session cookies to maintain your authentication state. These are essential for the Service to function and cannot be disabled.

We do not currently use third-party analytics or advertising cookies. If this changes, we will update this policy and provide appropriate controls.

9. International Data Transfers

Your data may be processed and stored in servers located outside your country of residence. By using the Service, you consent to the transfer of your data to these locations. We ensure that appropriate safeguards are in place for international transfers.

10. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect. The "Last updated" date at the top of this page indicates the most recent revision.

12. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Kaaren Orbiit
Email: [email protected]