Privacy & Cookie Policy

1. Introduction

Mondrix.ai ("we", "us", "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, and share your data when you use our website, platform, and services (collectively, the "Service").

This policy applies to all users worldwide and addresses the requirements of the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and other applicable US state privacy laws.

2. Data Controller

For the purposes of the GDPR, the data controller responsible for your personal data is:

3. Data We Collect

3.1 Information You Provide

• Account & contact data: name, email address, phone number, business name, address
• Website creation data: business descriptions, style preferences, language preferences, uploaded content
• Career applications: name, email, CV/resume, cover letter, LinkedIn profile
• Communications: messages sent through our contact forms or email

3.2 Information Collected Automatically

• Device & browser data: IP address, browser type, operating system, device identifiers
• Usage data: pages viewed, time spent on pages, clicks, referral URLs
• Cookies & similar technologies: see Section 7 below

4. How We Use Your Data

We use your personal data for the following purposes:

• Providing, maintaining, and improving the Service
• Generating AI-powered websites based on your inputs
• Processing and responding to your inquiries and support requests
• Sending transactional emails (OTP verification, order confirmations)
• Processing career applications
• Analyzing usage patterns to improve user experience
• Complying with legal obligations and enforcing our terms
• Preventing fraud and ensuring the security of our platform

5. Legal Basis for Processing GDPR — EU

Under the GDPR, we process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b)): processing necessary to provide the Service you requested
• Legitimate interests (Art. 6(1)(f)): analytics, fraud prevention, improving our Service
• Consent (Art. 6(1)(a)): where you have given explicit consent, such as for marketing communications or non-essential cookies
• Legal obligation (Art. 6(1)(c)): compliance with applicable laws and regulations

6. Data Sharing & Third Parties

We do not sell your personal data. We may share your information with:

• Service providers: hosting (cloud infrastructure), email delivery, analytics providers — bound by data processing agreements
• AI processing partners: for website generation, subject to strict data protection terms
• Legal authorities: when required by law, court order, or to protect our rights
• Business transfers: in the event of a merger, acquisition, or sale of assets

7. Cookies & Tracking

We use cookies and similar technologies to enhance your experience:

• Essential cookies: required for the Service to function (session management, security)
• Analytics cookies: help us understand how users interact with our Service (e.g., Google Analytics)
• Preference cookies: remember your language and display settings

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our Service.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Account data: for the duration of your account, plus 30 days after deletion request
• Website project data: for the duration of active hosting, plus 90 days
• Career applications: up to 24 months from submission
• Analytics data: aggregated and anonymized after 14 months
• Legal/compliance data: as required by applicable law

9. Your Rights — European Union GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the GDPR:

• Right of access (Art. 15): request a copy of your personal data
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten")
• Right to restrict processing (Art. 18): limit how we use your data
• Right to data portability (Art. 20): receive your data in a machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests
• Right to withdraw consent (Art. 7): withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@mondrix.ai. We will respond within 30 days as required by the GDPR. You also have the right to lodge a complaint with your local data protection authority.

10. Your Rights — United States CCPA / CPRA

If you are a resident of California or other US states with comprehensive privacy laws, you have the following rights:

California (CCPA/CPRA)

• Right to know: what personal information we collect, use, and disclose about you
• Right to delete: request deletion of your personal information
• Right to correct: request correction of inaccurate personal information
• Right to opt-out: opt out of the sale or sharing of personal information (we do not sell personal data)
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights
• Right to limit use of sensitive personal information: direct us to limit the use of sensitive data

Other US State Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with privacy legislation have similar rights including access, deletion, correction, and opt-out of targeted advertising. Contact us to exercise any of these rights.

Exercising Your US Privacy Rights

To submit a verifiable consumer request, contact us at privacy@mondrix.ai. We will verify your identity and respond within 45 days. You may designate an authorized agent to make a request on your behalf.

Do Not Sell or Share

Mondrix.ai does not sell and does not share your personal information for cross-context behavioral advertising as defined by the CCPA/CPRA.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. When we transfer data from the EEA to third countries, we rely on:

• EU-US Data Privacy Framework (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where available

12. Children's Privacy

Our Service is not directed to individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@mondrix.ai.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• SSL/TLS encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Regular security audits and vulnerability assessments
• Access controls and role-based permissions
• Secure backup procedures

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website at least 30 days before they take effect. Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

Cookie Policy

This Cookie Policy explains what cookies are, how Mondrix.ai uses them, and how you can control them. This policy forms part of our Privacy Policy above.

What Are Cookies?

Cookies are small text files stored on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently and to provide information to website owners.

Types of Cookies We Use

1. Strictly Necessary Cookies

These cookies are essential for the operation of our website. They enable core functionality such as security, session management, and accessibility. You cannot opt out of these cookies as the Service would not function without them.

• Session ID: maintains your session while navigating the site
• CSRF token: protects against cross-site request forgery attacks
• Language preference: remembers your selected interface language

2. Analytics & Performance Cookies

These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. We use this data to improve the Service.

• Google Analytics (_ga, _gid): tracks page views, session duration, and user behavior — data is anonymized
• Performance metrics: page load times, error rates

3. Functional / Preference Cookies

These cookies allow the website to remember choices you make (such as your language or the region you are in) and provide enhanced, personalized features.

• Language selection: stores your preferred interface language (e.g., EN, IT)
• UI preferences: remembers display settings

4. Marketing / Third-Party Cookies

We currently do not use marketing or advertising cookies. If this changes in the future, we will update this policy and request your consent before setting such cookies.

Cookie Duration

• Session cookies: deleted when you close your browser
• Persistent cookies: remain on your device for a set period (typically 30 days to 24 months) or until you delete them

How to Manage Cookies

You can control and manage cookies through your browser settings. Please note that removing or blocking certain cookies may impact the functionality of our Service.

• Chrome: Settings → Privacy and Security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions → Manage and delete cookies

You can also visit allaboutcookies.org for comprehensive information on managing cookies across different browsers.

Cookie Consent GDPR

Under the GDPR and the ePrivacy Directive, we are required to obtain your consent before placing non-essential cookies on your device. When you first visit our website, you will be presented with a cookie consent banner where you can accept or reject non-essential cookies. You can change your preferences at any time.

Do Not Track (DNT) US

Some browsers offer a "Do Not Track" (DNT) feature. While there is no industry standard for DNT, we respect DNT signals and do not engage in tracking activities when a DNT signal is detected from your browser.

Updates to This Cookie Policy

We may update this Cookie Policy periodically. Any changes will be posted on this page with an updated revision date. We encourage you to review this page regularly.

Contact

For any questions about our use of cookies, please contact us at privacy@mondrix.ai.