This Privacy Policy explains how MonthDocs ("we", "us") processes personal data when you visit our website or use MonthDocs (the "Service"), a web application that helps accounting and bookkeeping firms collect documents from their clients. It describes what the Service actually does today.
1. Who is responsible
- Website visitors and firm accounts (owners and staff of accounting firms): we are the controller.
- Data about a firm's clients and the documents they upload: the accounting firm decides what is collected and why and is the controller. We process this data only on the firm's instructions, as its processor, under a data processing agreement.
Contact: MonthDocs. E-mail: [email protected].
2. Data we process
2.1 Website visitors
- Always (technically necessary): the pages you request and technical data your browser sends (IP address, browser type, language) are processed to deliver and protect the website. Our web server and security logs may contain IP addresses.
- Website analytics, without cookies: we use our own, first-party analytics. It records the pages you view, the time spent on each page, how far you scroll, which links and buttons you click, the website that referred you (domain only), campaign parameters in the link (utm_source, utm_medium, utm_campaign), your approximate country, and your device type, browser and operating system. Nothing is stored on your device. To count repeat views on the same day, our server derives an identifier from a one-way hash of your IP address and browser together with a secret and the current date; the identifier changes every day, so visits on different days cannot be linked. We do not store your IP address in analytics, we do not combine analytics with your account, and we do not share analytics data with third parties. If your browser sends the Global Privacy Control signal, you are not counted.
2.2 Firm accounts
- Name, e-mail address, password (stored only as a one-way hash), language and time-zone preference, two-factor authentication settings (the secret is encrypted, recovery codes are hashed).
- Firm details: firm name, settings, trial and subscription status.
- Audit log of important actions (sign-ins, uploads, downloads, acceptances, rejections, role changes), including the IP address of the request.
2.3 Clients of accounting firms (processed on behalf of the firm)
- Contact data entered by the firm: name, company name, e-mail address, phone number, language and time zone.
- Documents you upload and their metadata (original file name, size, type, upload time, review status and any rejection reason written by the firm).
- Sign-in events and the IP address of uploads and sign-ins (audit log).
2.4 Mobile app
- Sign-in: the app keeps a sign-in token in the phone's secure storage (iOS Keychain / Android Keystore). It is not included in device backups.
- Push notifications (only if you allow them): a push token of your device. The text of a notification (for example the name of a requested document) is delivered through Expo and Apple / Google push services.
- Documents you open are downloaded to the app only while they are shown and are deleted afterwards and when you sign out.
- Advertising (iOS app): the free iOS app shows ads from Google AdMob. Google may process device identifiers (such as the advertising identifier, only if you allow tracking in Apple's prompt), IP address and ad interactions to deliver and measure ads. In the EEA, UK and Switzerland you are asked for consent first and can change your choice at any time in the app settings ("Ad privacy choices"). Your documents, their names and your client data are never shared with advertisers. See Google's policy: policies.google.com/technologies/partner-sites.
3. Purposes and legal bases
- Providing the Service to firms and their clients (performance of a contract).
- Security: preventing abuse, rate limiting, audit logs (legitimate interests; legal obligations where applicable).
- Transactional e-mails such as sign-in links and invitations (performance of a contract).
- Website analytics: our legitimate interest in understanding which pages are useful and where the website can be improved. The data is anonymous to us and is never used to identify you. You can object at any time by writing to us or by turning on Global Privacy Control in your browser.
- Legal obligations, for example keeping records of our own invoices.
We do not sell personal data. We do not use client documents for advertising or to train machine-learning models. The website uses no advertising or third-party tracking cookies. The iOS app shows ads as described in section 2.4.
4. Cookies and browser storage
| Name | Purpose | Duration | Type |
|---|---|---|---|
monthdocs-session | Keeps you signed in and remembers your language during a visit. | 120 minutes of inactivity | Necessary |
XSRF-TOKEN | Protects forms against cross-site request forgery. | Same as the session | Necessary |
remember_web_… | Keeps a firm user signed in, only if "Remember me" was ticked. | Up to 400 days | Necessary |
The website uses only the necessary cookies listed above. Website analytics work without cookies or browser storage (see section 2.1), so there is nothing to accept or decline.
5. Storage, security and retention
- Documents are kept in private storage and are only available through authenticated, authorised requests. Accounting firms are strictly separated from each other. Sign-in links are single-use and expire after 30 minutes.
- Website analytics are deleted automatically after 13 months.
- Audit log entries are deleted automatically after 365 days.
- Firm and client data, including documents, are kept while the firm's account exists and are handled according to the firm's instructions. Firms can export their records at any time.
- When a firm closes its account, its data, including all documents, is deleted within 90 days, unless we are legally required to keep specific records longer. Deleted data disappears from our backups within a further 35 days.
- Records of our own invoices are kept as long as tax and accounting law requires.
6. Service providers (sub-processors) and international transfers
We use the following service providers, who process personal data only on our instructions and under written data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Application hosting and database | |
| ADM.TOOLS (Ukraine.com.ua) | Delivery of transactional e-mails | Ukraine |
| Cloudflare, Inc. | Content delivery, DDoS protection and encryption in transit | Global network (USA) |
| 650 Industries, Inc. (Expo), Apple Push Notification service | Delivery of push notifications to the mobile app | USA |
| Google Ireland Limited (AdMob) | Advertising in the iOS app (only with your consent where required) | Ireland / USA |
If personal data is transferred to a country that does not offer an adequate level of protection under the law that applies to you, we rely on appropriate safeguards such as standard contractual clauses. You can ask us for a copy of the relevant safeguards. We will announce changes to this list in advance on this page.
7. Your rights
Depending on the law that applies to you, you may have the right to access, correct or delete your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. If you are a client of an accounting firm, please contact that firm first - it controls your documents. You can always write to us at [email protected]. You may also have the right to lodge a complaint with a data protection supervisory authority.
8. Children
The Service is intended for businesses and is not directed at children.
9. Changes
We will update this policy when the Service changes and show the date of the latest version below.