Privacy policy

Information we collect

Information you provide directly. When you request access to our platform or create an account, we may collect:

• Name and contact information (email address)
• Professional background and practice details
• Account credentials
• Content you create, including session notes, journal entries, and knowledge base materials
• Communications with us, including support requests and feedback

Voice and audio data. Our platform includes optional voice input features that allow you to dictate text. When you use voice input:

• Audio recordings are sent to our transcription service provider (OpenAI Whisper) for conversion to text
• Audio data is processed in real-time and is not stored after transcription is complete
• The resulting text is returned to you and may be saved as part of your content, subject to your privacy settings
• We do not retain audio recordings or use them for any purpose other than transcription

Automatically collected information. When you use our platform, we may automatically collect device information (browser type, operating system, device identifiers), usage data (features accessed, time spent, interaction patterns), and log data (IP address, access times, error reports).

How we use your information

• Provide, maintain, and improve our platform and services
• Process and respond to your access requests and inquiries
• Authenticate your identity and manage your account
• Enable agentic workflows and AI-powered features you configure
• Send administrative communications about the platform
• Ensure security and prevent fraud
• Comply with legal obligations

AI and machine learning

We do not train AI models on your data. Your content, session recordings, journal entries, and other personal information are never used to train or improve AI models, whether by MNSTRY or our AI service providers.

Privacy-preserving processing. When your content is processed by cloud-based AI services, we employ privacy-preserving techniques including content morphing to replace identifying information with plausible alternatives, stylometric sanitization to prevent re-identification through writing patterns, and request batching and aggregation to prevent identity correlation.

Privacy tiers. The platform supports multiple privacy tiers that you can select on a per-interaction basis:

• Standard tier: cloud processing with privacy-preserving techniques
• Confidential tier: processing on MNSTRY-controlled infrastructure
• Secret tier: on-device processing only, with zero cloud exposure

Data ownership and sovereignty

• Practitioners own their proprietary frameworks, methodologies, and knowledge base content
• Clients own all personal data they generate, including journal entries, session notes, and engagement records
• MNSTRY acts strictly as technical infrastructure and does not claim ownership of user content
• We enforce security at the database level to ensure structural isolation
• Data is only ever accessed or shared based on explicit, granular consent from its owner

Third-party services

We work with trusted third-party service providers to operate our platform: Supabase (database hosting and authentication), Vercel (web application hosting and deployment), OpenAI (voice transcription and language model services; we require zero-data-retention agreements with AI providers where available), and Resend (transactional email delivery). We carefully select service providers that maintain appropriate security measures and only share the minimum information necessary for them to perform their services.

Data security

• Encryption in transit using TLS/SSL
• Encryption at rest for stored data
• Row-level security (RLS) ensuring data isolation between users
• Regular security audits and vulnerability assessments
• Access controls limiting data access to authorized personnel
• Client-side encryption options for sensitive content

While we strive to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.

Data retention

• Account information is retained while your account is active
• Content you create is retained until you delete it or close your account
• Access request submissions are retained via email for processing purposes
• Voice recordings are not retained after transcription is complete
• Log data is retained for security and debugging purposes, typically for 90 days

When you delete content or close your account, we will delete or anonymize your information within a reasonable timeframe, except where retention is required by law or for legitimate business purposes.

Your rights

Depending on your location, you may have rights to access, correct, delete, or receive a portable copy of your personal information; to object to or restrict certain processing; and to withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@mnstry.ai. We will respond within the timeframe required by applicable law.

Cookies and tracking

We use cookies and similar technologies to maintain your session and authentication state, remember your preferences, and understand how you use our platform. We do not use cookies for advertising purposes or share cookie data with advertising networks. You can manage cookie preferences through your browser settings.

International data transfers

Your information may be transferred to and processed in countries other than your country of residence. We take appropriate safeguards including standard contractual clauses, data processing agreements with all service providers, and compliance with applicable data protection frameworks.

Children's privacy

Our platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us immediately at privacy@mnstry.ai and we will take steps to delete such information.

Healthcare disclaimer

MNSTRY is a technology platform and does not provide medical, therapeutic, or mental health services. All client care is the responsibility of the designated practitioner using our platform. Practitioners using MNSTRY for healthcare-related purposes are responsible for their own compliance with applicable healthcare regulations, including HIPAA in the United States.

Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date, notify you through the platform or via email for significant changes, and provide you with an opportunity to review the changes before they take effect.

Contact us

Email: privacy@mnstry.ai. Mailing address: Merkaba Group L.L.C., P.O. Box 35512, Dallas, TX 75235, United States.