1. Introduction
This Privacy Policy explains how MonkSuite ("MonkSuite", "we", "us"), a family of products operated by TopMonks, collects, uses, stores, and protects your personal data when you use the MonkSuite family of products — including ScrapeMonk, TidyMonk, MatchMonk, PriceMonk, and Wistery Admin — and related services.
We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR), the Czech Data Protection Act, and other applicable data protection laws.
2. Data Controller
MonkSuite is operated by TopMonks s.r.o., which is the data controller for personal data processed in connection with the MonkSuite services:
TopMonks s.r.o.
Struhařovská 2931/9, 141 00 Praha 4, Czech Republic
Company ID (IČO): 24847437 · VAT ID: CZ24847437
Signing authority and any further entity details are provided on order forms and the MSA. For data-protection correspondence, contact privacy@monksuite.io.
3. Personal Data We Collect
Account Data
When you create an account through our authentication provider (Auth0), we receive and store:
- Email address
- Display name
- Profile picture URL
- Auth0 user identifier
Usage Data
As you use our products, we collect:
- Configurations and parameters you create within each product
- Credit and subscription transaction history (top-ups, usage)
- Notification preferences and history
Technical Data
We automatically collect:
- IP address (used for rate limiting and security)
- Browser type and version (via standard HTTP headers)
- Error reports and application performance data (via Sentry), which may include your user identifier and email for debugging purposes
Marketing Website Analytics
Our marketing websites (including monksuite.io and per-product sites) use Google Analytics to understand visitor traffic and improve content. Google Analytics collects anonymized usage data such as pages visited, referral sources, and device information, and is not used within the MonkSuite applications themselves — only on the public marketing websites. You can opt out using the Google Analytics Opt-out Browser Add-on.
4. How We Use Your Data
We process your personal data for the following purposes:
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Providing and operating the MonkSuite products | Performance of contract |
| Account creation and authentication | Performance of contract |
| Credit management and billing | Performance of contract |
| Payment processing | Performance of contract |
| Transactional email communications | Performance of contract |
| Marketing website analytics | Legitimate interest |
| Rate limiting and abuse prevention | Legitimate interest |
| Error monitoring and service reliability | Legitimate interest |
| Security incident detection and response | Legitimate interest |
| Responding to your inquiries | Performance of contract |
| Complying with legal obligations | Legal obligation |
5. Data You Process Through Our Products
Several MonkSuite products let you collect, import, or process data — including, for data-collection products such as ScrapeMonk, publicly available data from websites. You retain full ownership of the data you process through the products, as stated in our Terms of Service. We process your configurations and job data solely to provide the service you requested.
You are responsible for ensuring that your use of processed data complies with applicable laws, including data protection regulations where the data contains personal information. In particular:
- Sensitive personal data — You must not use the products to systematically collect special categories of personal data as defined in GDPR Art. 9 (health data, political opinions, religious beliefs, sexual orientation, ethnic origin, etc.) or personal data of children (under 16), unless you have a valid legal basis and have obtained all necessary consents. We reserve the right to suspend access if we detect such activity.
- Role as data controller — Where the data you process contains personal information, you act as the data controller and bear full responsibility for having a lawful basis for processing. MonkSuite acts solely as a data processor carrying out your instructions.
- Data Processing Agreements — DPAs are available upon request for customers who process personal data through the products. Contact privacy@monksuite.io.
6. Cookies and Local Storage
MonkSuite products use only strictly necessary and functional cookies and browser storage:
| Storage | Purpose | Type |
|---|---|---|
| Auth0 session & tokens | Authentication and session management | Strictly necessary (localStorage) |
| UI state (e.g. sidebar) | Remembers interface preferences | Functional (cookie, 7-day expiry) |
| Theme preference | Remembers light/dark mode selection | Functional (localStorage) |
| Language preference | Remembers your language choice | Functional (localStorage) |
| Google Analytics cookies (_ga, _gid) | Marketing website traffic analysis | Analytics (marketing sites only) |
We do not use advertising or tracking cookies. No third-party tracking cookies are set within the MonkSuite applications.
7. Third-Party Services and Data Sharing
We share personal data with the following categories of service providers, solely to deliver the MonkSuite products:
Authentication
- Auth0 (Okta, Inc.) — Manages user authentication, credentials, and single sign-on. Processes your email, name, and profile picture. SOC 2 Type II certified; EU data residency options available.
Infrastructure
- Amazon Web Services (AWS) — Hosts databases, application servers, and file storage. ISO 27001 and SOC 2 certified.
- Hetzner Cloud — Hosts worker infrastructure in European data centers (Germany). ISO 27001 certified.
- CloudFlare — Provides CDN and DDoS protection. Does not have direct access to customer data.
Payment & Communications
- Stripe — Processes payments. Handles payment card details directly; we do not store card information on our servers.
- Email delivery provider — A managed third-party provider delivers transactional emails (e.g. account notifications). Processes your email address.
Error Monitoring
- Sentry — Receives application error reports for service reliability, which may include your user identifier and email for debugging. Data stored in the US. SOC 2 and GDPR compliant.
Analytics
- Google Analytics — Used on the marketing websites only. Collects anonymized browsing data. Not used within the MonkSuite applications.
AI Processing
- OpenAI, Anthropic, Google — Power AI-driven features such as classification and data extraction. These providers receive only the content being analyzed, not customer account information.
We do not sell your personal data to third parties. We notify customers 30 days before adding any new subprocessor. Data Processing Agreements (DPAs) are available upon request.
8. Data Residency and International Transfers
By default, your data is stored and processed within EU regions, ensuring all data — databases, file storage, and backups — remains within the European Union. Customers can request data residency in other regions. Hetzner Cloud workers (ScrapeMonk) always operate in European data centers (Germany).
Some service providers (Auth0, Sentry, Stripe, email providers, LLM providers) may process data in the United States. Where data is transferred outside the EU, transfers are protected by:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Service provider compliance with applicable data protection frameworks
9. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Duration of your account; upon deletion request, soft-deleted immediately and permanently removed after 30 days |
| Job data and processed content | Retained until explicitly deleted by user |
| Credit transaction history | Duration of your account, for billing records |
| Application logs | 90 days |
| Audit logs | 1 year |
| Error logs (Sentry) | 90 days |
| Database audit logs | 30 days |
We maintain a three-copy backup strategy: primary production database, continuous automated backups, and geographically separated backup copies. Upon account deletion, we remove your personal data from active systems using secure deletion procedures.
10. Data Security
We implement technical and organizational measures to protect your data, including:
- Encryption in transit (TLS 1.2+) for all communications
- Encryption at rest (AES-256) for stored data
- Network segmentation and access controls
- Rate limiting and abuse prevention
- Regular security assessments
11. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Access — Request a copy of the personal data we hold about you
- Rectification — Request correction of inaccurate personal data
- Erasure — Request deletion of your personal data ("right to be forgotten")
- Restriction — Request that we limit processing of your data
- Portability — Receive your data in a structured, machine-readable format
- Objection — Object to processing based on legitimate interest
- Withdraw consent — Where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at privacy@monksuite.io. We will respond within 30 days of receiving your request.
You also have the right to lodge a complaint with a supervisory authority. The relevant authority for the Czech Republic is the Office for Personal Data Protection (ÚOOÚ), www.uoou.cz.
12. Third-Party Data Subject Concerns
If you believe that your personal data has been processed through a MonkSuite product without a lawful basis, you may contact us at privacy@monksuite.io. We will investigate and, where appropriate, cooperate with you in exercising your rights against the responsible data controller (our customer), and with data protection authorities, to resolve any concerns.
13. Children's Privacy
MonkSuite is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@monksuite.io.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable laws. We will notify registered users of material changes via email or in-app notification. Continued use of the products after changes constitutes acceptance of the updated policy.
15. Contact
For privacy-related questions, data subject requests, or concerns:
Email: privacy@monksuite.io
General inquiries: sales@monksuite.io