Privacy Policy
Monastic Media Dashboard · media.monastic.dashboard · Effective 19 August 2026
Effective date: 19 August 2026
Last updated: 19 August 2026
Published at: https://dashboard.monastic.media/privacy
1. Who we are
Monastic Media Dashboard ("the Dashboard", "the app") is operated by:
ECOMFIRST VENTURES
401 Kalp Business Centre, City Light Road
Surat 395007, Gujarat, India
Trading as Monastic Media, a performance-marketing and UGC production agency.
For anything in this policy — questions, requests, complaints — write to support@monastic.media. A named person reads that address and replies; it is not a ticket queue.
In this policy, "we" and "us" mean ECOMFIRST VENTURES. "You" means a person whose personal data we hold through the Dashboard: our employees, our contracted partners, and the individual contacts at our client and prospective-client companies.
2. What the Dashboard is, and who this policy covers
The Dashboard is the operations workspace of Monastic Media. It is used by our team (Google Workspace accounts on @monastic.media), by clients we have invited to their own project view, and by job applicants who sign in with Google from our careers page to follow their application. It is not a consumer service and there is no anonymous or self-serve access: every account is tied to a person we work with, employ or are considering for a role.
This policy covers:
- Our team. Employees and contracted partners who sign in and use the Dashboard.
- Business contacts. People at our client companies and prospective-client companies whose contact details and interaction history our team records in the Dashboard in the ordinary course of doing business with their organisation.
This policy does not cover our public website, nor the separate privacy practices of our clients' own businesses.
If you are a business contact and want to know what we hold about you, section 9 tells you how to ask. You do not need an account with us to make that request.
3. What we collect, and why
3.1 From people who sign in (our team)
| What | Why | Source |
|---|---|---|
| Full name and work email address | To identify your account, control what you can see, and attribute actions inside the workspace ("who moved this deal", "who sent this message") | Your Google Workspace account at sign-in |
| Google account profile picture | Displayed as your avatar in the workspace | Google Workspace |
| Role and permissions | To enforce access control — leadership, business development, delivery and partner roles see different data | Assigned by the company administrator |
| Work-session timestamps | To produce the work log: check-in and check-out times, session start and end, active minutes per day, and whether you are currently online. Used for staffing, capacity planning and attendance | Recorded by the app as you use it |
| Content you create | Notes, comments, tasks, meeting records, uploaded files and messages you send through the Dashboard | You |
| Push notification token | To deliver notifications to the correct device | Your device, via Apple or Google push services, when you grant notification permission |
| Technical and security logs | IP address, device and browser type, timestamps of sign-in and of sensitive actions. Used to detect unauthorised access and to investigate incidents | Automatically, at the network layer |
A note on the work log. It is deliberately narrow. It records when you were signed in and active, not what you typed, which windows you had open, or where you were. There is no keystroke logging, no screenshotting, no idle-time surveillance and no location tracking of any kind. Your own work log is visible to you; the full-team view is restricted to leadership.
3.2 About business contacts (people at client and prospect companies)
| What | Why |
|---|---|
| Name, business email, business phone number, job title, company | To contact you about a commercial relationship between your organisation and ours, and to know who we are speaking to |
| Interaction history — calls, meetings, WhatsApp and email threads, notes, proposals, deal stage and value | To run a normal sales and account-management process, and so that any colleague picking up the relationship has the context |
| Meeting recordings, transcripts and AI-generated summaries | Where a meeting is recorded, to produce notes and action items. See section 4 on Fireflies and section 3.4 on consent |
| Invoices, payments and contract records | To bill for our services and meet Indian accounting and tax obligations |
We obtain this data from you directly (you filled in a form, booked a call, or messaged us), from your public business presence, and from our previous CRM systems on migration.
3.3 Biometric data — we never receive it
Face ID, Touch ID and Android fingerprint unlock are handled entirely by your device's operating system. The app asks the OS "is this the right person?" and receives only yes or no. No fingerprint, face map or other biometric template is ever transmitted to us or stored on our servers. We could not access it if we wanted to.
3.4 Meeting recordings and transcription
Some client meetings are recorded and transcribed to produce notes, action items and summaries. Where a meeting is recorded, participants are notified by the meeting platform at the time. If you are a participant and do not want a meeting recorded, tell the Monastic Media person on the call, or write to support@monastic.media, and we will stop and delete the recording.
3.5 What we do not collect
- No device location. The app does not request, receive or store location. It has no location permission on any platform.
- No contacts, photos, camera or microphone access from your device.
- No advertising identifiers, no advertising SDKs, no cross-app or cross-site tracking. The app contains no advertising of any kind.
- No special-category data — we do not collect health, biometric, genetic, racial or ethnic origin, religious belief, political opinion, sexual orientation or trade-union membership data, and you should not enter any into the Dashboard.
- No selling of data. We have never sold personal data and we will not.
4. Who else processes this data
We use a small number of service providers ("processors") who handle data strictly on our instructions and for no purpose of their own. We do not sell, rent or trade personal data, and we do not share it with anyone for advertising.
| Provider | What it does for us | What it sees |
|---|---|---|
| Supabase | Hosts our database, file storage, authentication layer and backend functions. This is where the Dashboard's data actually lives | All data stored in the Dashboard |
| Google (Google Workspace) | Sign-in (SSO), plus Calendar, Gmail and Drive where the Dashboard reads or writes on our behalf | Account identity; calendar events, email threads and files we access through it |
| WATI / Meta WhatsApp Business Platform | Sends and receives WhatsApp messages with business contacts | Phone numbers and message content of WhatsApp conversations |
| Zoho Books | Invoicing, billing and accounting records | Client billing contacts, invoice and payment data |
| Fireflies.ai | Joins meetings, records and transcribes them, and generates summaries | Meeting audio, transcripts and participant names |
| Apple Push Notification service / Google Firebase Cloud Messaging | Delivers push notifications to devices | A device token and the notification content |
In addition, where a client authorises it, the Dashboard connects to that client's own marketing and commerce accounts — such as Meta Ads, Google Analytics, Google Search Console, Shopify and Judge.me — to read performance data for reporting. That data belongs to the client, is accessed under permission the client grants and can revoke at any time, and is used only to report to that client on work we are doing for them.
International transfers. Some of these providers store or process data outside India, including in the United States and the European Union. Where data is transferred out of India or out of the EEA/UK, we rely on the provider's own contractual safeguards, including Standard Contractual Clauses where applicable, and we take reasonable steps to satisfy ourselves that the provider's security is adequate.
Other disclosures. We may disclose personal data where we are legally required to — to a court, a regulator, or a tax or law-enforcement authority acting under proper legal authority — and to our professional advisers (accountants, lawyers) under a duty of confidence. If our business is restructured, sold or merged, data may transfer to the acquiring entity, which would remain bound by this policy or a materially equivalent one.
5. Why we are allowed to hold this data
Depending on which law applies to you:
- Contract. For our team, holding your account identity and work records is necessary to perform your employment or contractor agreement. For business contacts, it is necessary to take steps at your request and to perform a contract between our organisations.
- Legitimate interests. Running a sales pipeline, keeping records of who we spoke to and what was agreed, protecting our systems from unauthorised access, and understanding the profitability of our own work. We have considered whether these interests are overridden by your rights, and have kept collection to what the work actually requires.
- Legal obligation. Invoices, payment records and contracts are retained because Indian tax and companies legislation requires it.
- Consent. Where consent is the right basis — for example marketing messages to a contact who is not yet a client, or recording a meeting where you object — we ask for it and you may withdraw it at any time without penalty. Withdrawing consent does not affect processing already carried out.
For people in India, we act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023. For people in the EEA or UK, we act as a controller under the GDPR / UK GDPR in respect of our own team and our business contacts.
6. How long we keep it
| Data | Retention |
|---|---|
| Team account and profile | For the duration of your employment or contract, then deleted or anonymised within 90 days of your last day, except where a record must be kept for a legal reason |
| Work log and session timestamps | 24 months, then deleted |
| Business contact records and interaction history | For the duration of the commercial relationship, and for 36 months after our last substantive contact, after which records for contacts who did not become clients are deleted |
| Meeting recordings and transcripts | 12 months, then deleted. Written summaries and action items may be kept for the life of the client relationship |
| Invoices, payments, contracts and accounting records | 8 years, as required by Indian tax and companies law. This period is not shortened by a deletion request, because we are legally obliged to keep it |
| Security and access logs | 12 months |
| Backups | Encrypted backups are retained on a rolling basis and are overwritten within 35 days. Data deleted from the live system persists in backups until those backups roll over |
7. How we protect it
- All traffic between the app, our backend and every provider listed above is encrypted in transit using TLS. Data at rest is encrypted by our hosting provider.
- Access is least-privilege and enforced in the database, not merely hidden in the interface. Row-level security rules mean a business-development user cannot read another team's records even by manipulating a request, and financial data is restricted to leadership.
- Sign-in is Google Workspace SSO on a domain we administer, so an account can be disabled centrally and immediately when someone leaves.
- The mobile app can be locked with device biometrics, and re-locks when it is backgrounded, so a picked-up unlocked phone does not expose company data.
- The mobile app verifies its own integrity before it is allowed to reach our data layer, so a tampered or repackaged build is refused.
- The desktop app stores no company data on disk. Everything is fetched live, so a lost laptop carries no local copy.
- Backups are taken nightly and are encrypted.
No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that is likely to result in risk to you, we will notify you and the relevant authority — including the Data Protection Board of India, and any EEA/UK supervisory authority where applicable — without undue delay and within the deadlines the applicable law sets.
8. Automated decision-making and AI
The Dashboard computes scores and suggestions — lead scores, suggested pricing, churn-risk indicators, AI-drafted messages, and AI summaries of meetings. These are decision support. No decision that produces a legal or similarly significant effect on a person is made solely by automated means. A named human reviews and sends every message, sets every price and makes every commercial decision. If you believe an automated output has been applied to you unfairly, write to support@monastic.media and a person will review it.
9. Your rights
Whoever and wherever you are, you may ask us to:
- Access the personal data we hold about you, and get a copy of it
- Correct anything inaccurate or incomplete
- Delete it, where we do not have a legal obligation or an overriding legitimate ground to keep it
- Restrict or object to processing, including any processing based on legitimate interests
- Withdraw consent you previously gave, at any time
- Receive a portable copy in a common machine-readable format, where that right applies
- Nominate another person to exercise your rights on your behalf in the event of your death or incapacity (a right specific to India's DPDP Act)
- Complain to a supervisory authority — in India, the Data Protection Board of India; in the EEA or UK, your local data protection authority
How to make a request
Email support@monastic.media with the subject line "Privacy request" and tell us what you want. We may ask you to confirm your identity, so that we do not hand your data to someone else.
We respond within 30 days. If a request is genuinely complex we may take longer, and we will tell you why before the 30 days are up. We do not charge for this.
Account and data deletion
Dashboard accounts are employment- or contract-linked identities on a company Google Workspace domain, so they are created and removed by the company administrator rather than deleted self-serve inside the app. To have your account and associated personal data deleted, email support@monastic.media with the subject "Delete my account".
We will confirm receipt, delete or anonymise your personal data within 30 days, and tell you what — if anything — we are legally required to keep and for how long. Records we must retain by law (invoices, signed contracts, tax records) are kept for the period in section 6; where we can strip a personal identifier from such a record without breaking its legal purpose, we do.
Business contacts who have never had an account may use exactly the same address and the same process.
10. Children
The Dashboard is a workplace tool for adults. It is not directed at children, we do not knowingly collect data about anyone under 18, and accounts are issued only to employees and contracted partners. If you believe a child's data has reached us, tell us at support@monastic.media and we will delete it.
11. Cookies and similar technologies
The Dashboard uses only what it needs to work: a session cookie or token to keep you signed in, and local device storage for your interface preferences such as dark mode and saved filters. There are no advertising cookies, no third-party trackers and no cross-site analytics. Because none of this is used for tracking or advertising, there is no consent banner to dismiss.
12. Changes to this policy
If we change this policy we will update the "Last updated" date at the top and publish the new version at https://dashboard.monastic.media/privacy. Where a change materially affects how we handle your data — a new category of data, a new purpose, a new processor with meaningful access — we will tell affected users directly by email or in-app notice before it takes effect, not merely by editing the page.
13. Contact
ECOMFIRST VENTURES
401 Kalp Business Centre, City Light Road
Surat 395007, Gujarat, India
Privacy contact: support@monastic.media
Phone: +91 90160 18089