Monnett Privacy Policy

Effective Date: 15 October 2026

1. Introduction

Welcome to Monnett. We are Monnet Social S.A., a company based in Luxembourg, at the heart of Europe. This Privacy Policy explains clearly and transparently how we collect, use, and protect your personal data worldwide. It is written to comply with the highest European standards: the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), and the Artificial Intelligence Act (AI Act). With Luxembourg as our lead supervisory authority, we also look ahead to future rules, so you can trust that your rights will not only be respected, but anticipated.

Monnett is built on the belief that privacy is not a feature, but a foundation. Our promise is simple: your data belongs to you. We use it only to serve you, never to exploit you. Transparency, accountability, and responsible use of technology are at the core of everything we do.

By creating an account or using our services, you agree to the terms described here and acknowledge the processing of your data as outlined below. If we ever make important changes, we will inform you directly and clearly. No surprises, no hidden clauses.

Thank you for placing your trust in us. By choosing Monnett, you are supporting a new kind of social media: one that puts people before algorithms, and values at the forefront.

2. Privacy Policy

2.1 Data Controller

Monnet Social S.A., a public limited liability company (société anonyme) incorporated and existing under the laws of Luxembourg, having its registered office at 9, Rue du Laboratoire, L-1911 Luxembourg, Grand Duchy of Luxembourg, and registered with the Luxembourg Trade and Companies’ Register (Registre de Commerce et des Sociétés, Luxembourg) under number B297382. Email: privacy@monnet.social. DPO: Our Data Protection Officer can be reached at the email above.

2.2 Types of Data Collected

Identity & Account Data: full name (if provided), birthdate, age, username, email, password (hashed), profile photo (if provided)
Subscription Data (if you start a trial or buy a membership): an opaque Monnett or RevenueCat user ID, store and transaction identifiers, plan, price and currency where provided, store country, purchase, renewal, expiry, cancellation, refund and entitlement events, trial start and end dates, and platform (iOS or Android). We never receive your payment card or bank details; these are handled by Apple or Google.
User-Generated Content (UGC [What we call People-Generated Content]): posts, photos, videos, text, audio, comments, metadata (when and if provided)
Interaction Data: likes, messages, followers, other types of activity
Device & Usage Data: IP address, device type, OS, cookies, session logs
Location Data: if enabled
When and if implemented on Monnett Platforms, Artificial Intelligence interaction data handling will comply with the EU AI Act. You will be able to opt out of any such data processing via your account settings.

2.3 Purposes and Legal Basis

Purpose	Legal basis
Create and manage your account	Performance of a contract (Art. 6(1)(b))
Facilitate social interactions and communication	Performance of a contract (Art. 6(1)(b))
Display and distribute your content	Performance of a contract (Art. 6(1)(b))
Provide memberships and free trials: unlock paid features, validate entitlement, and handle renewals, plan changes, cancellations, refunds and expiry	Performance of a contract (Art. 6(1)(b))
Validate app store receipts and prevent payment fraud and repeated trials	Legitimate interest (Art. 6(1)(f))
Keep accounting and tax records of transactions	Legal obligation (Art. 6(1)(c))
Show contextual ads on the free plan (see below)	Legitimate interest (Art. 6(1)(f))
Comply with other legal obligations	Legal obligation (Art. 6(1)(c))
Improve our services and features	Legitimate interest (Art. 6(1)(f))
Provide personalised recommendations and content	Legitimate interest (Art. 6(1)(f))

Ads on Monnett appear only on the free plan. They are sold directly by Monnett and chosen based on the content they appear next to, not on a profile of you. We do not share your individual personal data or usage data with advertisers, we do not track how individuals navigate the platform, and we do not listen to individuals while present on the platform.

Where we rely on legitimate interest, you have the right to object (see section 2.9).

2.4 Rights to Commercial Use of People-Generated Content (so called ‘UGC’)

By uploading content to our platform, you retain all copyright and ownership rights to your work. You grant us a non-exclusive, royalty-free, worldwide license to reproduce, display, perform, and share your content within our websites, platforms, services, and affiliated digital channels. We may sublicense these rights only to service providers who help us operate Monnett on our behalf. This license covers the right to:

Project, share, and reproduce your content across our websites and platforms.
Enable reposting and sharing of your content by other people within the platform (including appearance on their profiles, feeds, or pages)
Display your content publicly (for content and accounts set to public) and in platform-curated collections.

This license is solely for the purpose of operating, promoting, and improving our services, and does not transfer your copyright or ownership. You may revoke this license by deleting your content from our platform.

2.5 AI Governance, Features, Risk Management and Transparency

We will categorize AI features by risk level and implement risk mitigation strategies, including human oversight, transparency disclosures, and opt-out mechanisms. We will comply with Recitals 10, 118, and 136 of the EU AI Act and maintain a registry of high-risk AI systems. Our platform in the future may include AI-powered features such as automated moderation, and AI-generated responses or summaries. If and when that happens we commit to:

Transparent explanations of AI usage
Sufficient human oversight for critical decisions affecting users
User opt-out options where required
Compliance with EU AI Act principles

2.6 Who We Share Your Data With

Apple and Google. If you buy a membership or start a trial, the purchase is made through the Apple App Store or Google Play. Apple and Google process your payment and account details under their own privacy policies. They tell us the status of your subscription, but never your card or bank details.
RevenueCat, Inc. (USA). Our subscription management provider, acting as our processor. It receives an opaque Monnett user ID and your Subscription Data so we can confirm and administer your membership status. Under our current configuration, it does not receive your name, email, content or messages.
Our hosting provider. Your account and content are hosted on servers located in Luxembourg, by a provider acting as our processor. Your messages are end-to-end encrypted: they are stored there only in encrypted form, and neither we nor our hosting provider can read them.
Authorities. Where we are legally required to, for example in response to a valid order or to report child sexual abuse material (see section 2.12).

Our processors may use your data only on our instructions and under a data processing agreement.

2.7 Data Transfer Mechanisms

Your posts and profile are hosted in Luxembourg. Your messages are end-to-end encrypted, so only you and the people you message can read them. To provide our services, we may still need to transfer some personal data outside the European Economic Area (EEA), for example if you travel abroad, or if you live outside of the EEA. Whenever this happens, we make sure your data is protected according to strict EU privacy laws (GDPR).

In particular, if you buy a membership or start a trial, your Subscription Data and an opaque user ID are processed in the United States by RevenueCat, Inc. We protect these transfers by using the European Commission’s Standard Contractual Clauses (SCCs) incorporated into our data processing agreement and, where required, additional safeguards following an assessment of the transfer. You may request information about the applicable safeguards at privacy@monnet.social.

2.8 Data Retention

Data Type	Retention Period	Reason
Basic account information	While account is active + 1 year	Contract management
People-generated content (‘UGC’)	While account is active + 3 months	User access, legal compliance. We remove data from our active services when someone deletes their account; copies in back-ups may take up to 3 months to be fully deleted.
Subscription entitlement and operational event data	While needed to administer the membership and for a limited period after expiry for support, refunds, fraud prevention and reconciliation	Contract management and legitimate interests
Accounting, tax and legally required supporting transaction records	For the period required by Luxembourg law, generally up to 10 years where the record falls within the applicable statutory category	Legal obligation
AI Interaction Data (when available)	While account is active + 1 year	Service improvement
Profile and user preferences and consents	While account is active, and/or until revoked + 1 year (the record of consent, not the consent itself)	Consent management
Legal and tax-related records	While account is active and up to 10 years after account deletion where required by law	Legal obligations

The 10-year period does not apply to all Subscription Data. It is limited to accounting, tax and supporting transaction records that must be retained by law. Other subscription events and identifiers are deleted or anonymised sooner when they are no longer needed for membership administration, refunds, fraud prevention, reconciliation or legal claims.

When you delete your account, we also request deletion or de-linking of your identifiable record at our subscription management provider, except for data we must keep for tax, accounting, fraud prevention or legal claims. Apple and Google keep their own records of your purchases under their privacy policies.

2.9 Your Rights

You have the right to:

Access, correct, delete, restrict, object, withdraw consent, and port your data
Contact the CNPD (https://cnpd.public.lu) if you are in the EU/EEA.

Some limits apply: transaction records we must keep for tax purposes cannot be deleted before the end of their legal retention period, and your purchase history held by Apple or Google must be requested from them directly.

2.10 Security Measures

We use encryption, access controls, audits, and breach notification procedures to protect your data.

2.11 Personal Data Shared between People on Monnett

Monnett does not control or moderate the personal information that the people using the platform voluntarily share with each other (for example in messages, comments or posts). However, we strongly advise not to share sensitive personal data such as phone numbers, addresses or identification details in public or private communications. Monnett will never request this type of information via direct messages and/or informal channels.

2.12 Children

At Monnett, the safety and privacy of minors are a top priority. While currently the ability to join Monnett is reserved only for people of age 18+, we are working to implement the following measures:

Private Accounts by Default: our aim is for future minors’ accounts to be set to private, so their personal information, posts, and data are only visible to approved connections.
Content Recommendations and Controls: our platform’s recommendation systems and algorithm controls will ensure we are giving children more control over their feeds and experience.
Blocking, Muting, and Group Controls: minors will be able to block or mute any person(s) easily, helping to prevent cyberbullying and unwanted interactions.
Limits on Addictive Features: features designed to encourage excessive use, such as streaks, are not part of Monnett. We also place safeguards around AI chatbots and remove design elements that unduly push engagement.
Commercial Protection: we will not exploit minors’ limited commercial understanding. Minors will be protected from manipulative commercial practices, unwanted spending, and addictive elements like virtual currencies or loot boxes.
Moderation and Support: we will continuously improve moderation and reporting tools, provide prompt feedback, and offer parental control options to support minors and their families.

The app is currently not intended for users under 18 years of age (or if the minimum in your country is higher for the usage of social media networks, then the minimum age in your country). If we discover underage usage we will delete the relevant accounts promptly.

Explicit CSAE / CSAM Prohibition: Monnett strictly prohibits the creation, upload, sharing, publishing, or facilitation of Child Sexual Abuse and Exploitation (CSAE) or Child Sexual Abuse Material (CSAM).
In-App Reporting Mechanism: Users can report any policy violations or safety concerns directly within the Monnett app using our built-in content reporting tools. All reports involving child safety are prioritized for immediate review and action.
Enforcement & Legal Compliance: Any account found involved with or attempting to distribute CSAE/CSAM will face immediate permanent suspension, deletion of content, and prompt reporting to law enforcement and relevant authorities, in full compliance with applicable child safety laws and regulations.
Child Safety Contact: For questions, urgent reports, or inquiries regarding child safety practices, contact support@monnet.social.

3. Changes and Notifications

We maintain a regulatory roadmap and commit to updating this policy in line with future EU regulations and best practices globally. Major changes will be communicated via changelogs, emails and in-app notifications. We may consult people on our platform before implementing significant updates.

4. Contact Us

For questions or requests:
Monnet Social S.A.
9, Rue du Laboratoire, L-1911 Luxembourg, Grand Duchy of Luxembourg
Email: privacy@monnet.social