Privacy Policy

Last updated: August 30, 2026

Monkeygun ("we", "us", "our") operates the monkeygun.com website and the Monkeygun video creation platform (the "Service"). This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and your rights regarding that data.

1. Data We Collect

Account data

When you sign up we collect your email address. We use it to authenticate you, associate your videos and credits with your account, and send transactional emails (receipts, password resets). We do not collect your name, phone number, or physical address unless you voluntarily provide them.

Content you create

Prompts, scripts, voiceover text, uploaded images and video assets, and rendered videos are stored on our servers so the Service can function. You own your content.

Payment data

Credit card numbers and billing details are collected and processed exclusively by Stripe (stripe.com). We never see or store your full card number. We receive from Stripe: the last four digits of your card, your Stripe customer ID, and transaction metadata (amounts, dates).

Usage data

We log standard server request data (IP addresses, browser user-agent strings, timestamps, pages visited) for security, debugging, and aggregate analytics. We do not use third-party behavioral trackers or sell this data.

Cookies

We use a session cookie to keep you logged in and a CSRF token cookie for security. We do not use advertising or cross-site tracking cookies. Our authentication provider (Supabase) may set its own first-party cookies strictly for session management.

2. How We Use Your Data

• Provide, maintain, and improve the Service
• Process payments and manage your credit balance
• Send transactional notifications (receipts, account alerts)
• Detect and prevent fraud, abuse, and security incidents
• Generate aggregate, anonymized analytics to improve the product

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

3. Third-Party Processors

To deliver the Service we share limited data with the following processors, each under their own privacy policies:

4. Data Retention

We retain your account data and content for as long as your account is active. If you delete your account, we permanently erase your account record, videos, and conversation history within 30 days. Server access logs are retained for up to 90 days for security purposes, then purged.

5. Your Rights

Depending on your jurisdiction you have the right to:

• Access — request a copy of all personal data we hold about you
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — delete your account and all associated data
• Data portability — receive your data in a machine-readable format
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@monkeygun.com or use the "Delete my account" option in your account settings. We respond to all requests within 30 days.

6. GDPR Compliance (EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, our lawful bases for processing are:

• Contract — processing necessary to provide the Service you signed up for
• Legitimate interest — security monitoring, fraud prevention, product analytics
• Consent — optional marketing communications (you can opt out at any time)

We do not transfer data outside the EEA/UK except to processors listed above who maintain adequate safeguards (Standard Contractual Clauses or equivalent). You may lodge a complaint with your local Data Protection Authority.

7. CCPA Compliance (California Users)

California residents have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To make a request, email privacy@monkeygun.com.

8. Data Security

All data in transit is encrypted via TLS. Data at rest on our servers is stored on encrypted volumes. Access to production systems is restricted to authorized personnel via SSH key authentication. We do not store passwords — authentication is handled by Supabase using industry-standard hashing.

9. Children's Privacy

The Service is not directed to anyone under 16. We do not knowingly collect data from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a prominent notice on the site. Continued use of the Service after changes constitutes acceptance.

11. Contact

For privacy-related questions or requests:
Email: privacy@monkeygun.com
Data Controller: Monkeygun (operated by Barnett Labs)