Privacy Policy — Monolith Platform

1. Who We Are

Monolith is a business operations platform built for field service and trades businesses. We provide CRM, VoIP communications, and document management under one login. Our registered entity is Altus Labs LLC. For privacy inquiries, contact us at privacy@monolith.cx.

2. Information We Collect

2.1 Information You Provide

When you or your team use Monolith, you provide information directly including:

Account and identity data — business name, your name, work email address, phone number, and account credentials managed through Firebase Authentication.
Customer records — names, email addresses, phone numbers, physical addresses, dates of birth (where provided), and custom fields you configure in Monolith CRM.
Financial and transaction data — quotes, proposals, invoices, payments, deposits, refunds, and credit memos you create and manage in the Commerce module. Monolith does not store raw payment card numbers. Card processing is handled by Stripe, and Monolith stores only Stripe-provided tokens and transaction metadata.
Communications content — the body of SMS and RCS messages you send or receive through Monolith Connect, call recordings and voicemail audio (when recording is enabled), call transcripts, and email threads captured through the Connect shared inbox.
Documents and files — files you upload, create, or edit in Monolith Docs, including Office-format documents (DOCX, XLSX, PPTX), PDFs, and any content within them.
Intake form data — business name, contact name, email, phone, industry, team size, current tools, and product interests when you apply for Beta access at monolith.cx/beta.

2.2 Information Generated Through Use

Activity and audit logs — records of actions taken in your account including who created or modified a record and when, document access history, and call and message metadata (numbers, timestamps, duration, direction).
Job and field service data — job status, crew assignments, scheduling, and location data associated with work orders.
AI-generated content — summaries, draft documents, proposal line items, and automation suggestions produced by Moli using your account data. See Section 5 for how AI data is handled.
Session and usage data — browser type, IP address, device identifiers, pages visited, and feature interactions collected through standard web logging and Cloudflare's infrastructure.

2.3 Information From Third Parties

Stripe — we receive payment status, subscription state, and billing event data from Stripe when you subscribe to or manage a Monolith plan.
Twilio and Telnyx — our telephony providers deliver and receive calls and messages on your behalf. They provide us with message delivery status, call metadata, recording files, and carrier information for numbers you provision or port.
Firebase Identity Platform — provides identity verification data (UID, email verification status, sign-in method) when you authenticate.
Migration data — during Beta, if you migrate from a prior platform such as ServiceTitan, Jobber, or Housecall Pro, the records you provide are imported into your Monolith tenant.

3. How We Use Your Information

We use the information we collect to:

Provision, operate, and maintain the Monolith platform and all its products.
Process transactions, manage subscriptions, and send billing-related communications through Stripe.
Route and deliver voice calls, SMS, and RCS messages through Twilio and Telnyx on your behalf.
Store, retrieve, and render documents you create or upload in Monolith Docs via Google Cloud Storage and OnlyOffice.
Power Moli AI features — call summaries, document drafting, proposal generation, and automation suggestions — using your account data within your tenant context only.
Send transactional and operational emails (invoices, notifications, account alerts) through Resend.
Maintain audit trails and access logs for security and compliance purposes.
Detect, investigate, and prevent fraud, abuse, and security incidents.
Respond to your support requests and communications.
Comply with applicable laws and legal obligations.
Improve the platform based on aggregate, de-identified usage patterns. We do not use your business data or customer records for this purpose.

4. Legal Bases for Processing (EEA / UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

Contract performance — processing necessary to provide the services you have signed up for.
Legitimate interests — security monitoring, fraud prevention, product improvement using aggregate data, and communicating service changes, where these interests are not overridden by your rights.
Consent — for optional features such as call recording and AI-assisted content generation where we request your explicit opt-in.
Legal obligation — where processing is required to comply with applicable law, including telecommunications regulations.

5. Moli AI Features and Your Data

Moli is Monolith's AI assistant, powered by large language model APIs including Anthropic (Claude) and OpenAI. When you use an AI feature:

Relevant portions of your business data (customer records, job details, call transcripts, document content) are sent to the AI provider to generate the requested output.
Your data is used only within your tenant context. It is never shared with other Monolith customers.
Your data is not used to train shared AI models. Our agreements with Anthropic and OpenAI prohibit use of customer-submitted data for model training.
AI features are opt-in at the feature level. You can disable individual AI capabilities from your account settings.
AI-generated content is produced as a suggestion. You review and control what is saved or sent.

6. Communications and Telephony Compliance

6.1 SMS and Messaging

Monolith Connect supports outbound SMS and RCS messaging to your customers. You are responsible for obtaining and maintaining valid consent from the individuals you message in compliance with the Telephone Consumer Protection Act (TCPA) and applicable carrier requirements.

Monolith manages A2P 10DLC brand and campaign registration on your behalf for U.S. messaging. We track and honor STOP, START, and HELP keywords automatically to maintain compliance with carrier opt-out requirements.

6.2 Call Recording

Call recording in Monolith Connect is disabled by default. When enabled by your administrator, calls are recorded and stored in Monolith's file storage. You are responsible for notifying call participants that recording is in progress, as required by applicable state and federal wiretapping laws. Recording can be disabled at the business unit level.

7. How We Share Your Information

We do not sell your personal information or your customers' data. We share information only in the following circumstances:

Service providers — we share data with vendors who process it on our behalf under contractual data protection obligations. Our current sub-processors include: Stripe (billing), Twilio (telephony), Telnyx (telephony), Firebase / Google Cloud (authentication, storage), Anthropic (AI), OpenAI (AI), Resend (email), OnlyOffice (document editing), and Cloudflare (CDN, security, Workers runtime).
Legal requirements — we may disclose information when required by law, court order, or valid legal process, or when necessary to protect the rights, property, or safety of Monolith, our users, or the public.
Business transfers — if Monolith is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
With your consent — in any other circumstance where you have explicitly authorized the disclosure.

8. Data Retention

We retain your account data for as long as your account is active. When you close your account, we will delete or anonymize your personal data within 90 days, except where we are required to retain it longer by law (for example, financial records required for tax compliance).

Call recordings and transcripts are retained for 12 months by default. Administrators can configure shorter retention periods or delete individual recordings at any time.

Prospect intake form submissions are retained for up to 24 months from the date of submission.

9. Security

We implement security measures appropriate to the nature of the data we hold, including:

Encryption in transit (TLS 1.2+) for all data moving between your browser, our services, and our sub-processors.
Encryption at rest for documents stored in Google Cloud Storage and credentials stored in Monolith Connect.
Tenant isolation enforced at the application layer — every data query is scoped to your tenant ID and cannot return data belonging to another customer.
Role-based access controls so employees within your organization see only what their role permits.
Firebase Identity Platform for authentication, with support for multi-factor authentication.
AES-256-GCM encryption for stored telephony provider credentials in Monolith Connect.

We are working toward SOC 2 Type II certification. No security measure is perfect. If you discover a potential security issue, please email security@monolith.cx.

10. Cookies and Tracking

The monolith.cx marketing site uses Cloudflare's infrastructure for CDN, performance, and bot protection (Cloudflare Turnstile on the Beta intake form). Cloudflare may set cookies necessary for its security and performance functions.

The Monolith platform applications (CRM, Connect, Docs, Portal) use session cookies for authentication. We do not use third-party advertising cookies or behavioral tracking cookies on any part of the platform.

11. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Correction — request correction of inaccurate or incomplete data.
Deletion — request deletion of your personal data, subject to our retention obligations.
Portability — receive your data in a structured, machine-readable format.
Objection or restriction — object to certain processing activities or request that we restrict processing in specific circumstances.
Withdraw consent — where processing is based on consent (such as call recording or AI features), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email privacy@monolith.cx. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

12. Children's Privacy

Monolith is a business platform and is not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us at privacy@monolith.cx.

13. International Data Transfers

Monolith is operated from the United States. If you are accessing the platform from outside the U.S., your information will be transferred to and processed in the United States and potentially other countries where our sub-processors operate. We rely on standard contractual clauses and other appropriate transfer mechanisms for cross-border data flows from the EEA and UK.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) and post the updated policy at monolith.cx/privacy with a new effective date. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

15. Contact Us

For privacy questions, data requests, or concerns, contact us at:

Email: privacy@monolith.cx
General support: support@monolith.cx