Privacy Policy

This Privacy Policy explains what personal data MonthlyAlerts.com (the "Service," "we," "us") collects, how we use it, and the choices and rights you have — wherever in the world you use the Service. We aim to collect the minimum needed to run a multilingual construction checklist tool, and nothing more.

1. Data we collect

• Account data: email address (required), name, and optionally company and phone number, plus your preferred language.
• Project content: checklists, items, comments, and photos that you and your project members create.
• Technical data: IP address and browser user-agent recorded when a sign-in session is created, used for security.
• Payment data — none. Payments are processed entirely by Stripe. We never receive, capture, or store card numbers or other payment credentials; we keep only a payment reference and date. See Stripe's privacy policy for how it handles your payment details.

We use a session cookie that keeps you signed in, a cookie remembering your language choice, and short-lived (90-day) first-party cookies that remember how you first arrived — a referral link, a campaign tag in the URL, or an outreach email link — so we can credit referrals and measure which channels bring projects. We measure page visits with Vercel Web Analytics, which is cookie-less and does not identify individual visitors. When we run advertising campaigns, the public pages may load the Google Ads and Meta conversion tags so those platforms can measure sign-ups and activated projects from their ads; these tags are never loaded inside your projects, and you can block them with standard browser settings.

2. How we use data

• To provide the Service: accounts, projects, checklists, and photos.
• AI translation: text your team writes is sent to OpenAI to be translated into other members' languages, on a best-efforts basis. Translations are cached so the same text is not re-processed repeatedly.
• Email: sign-in links, project invitations, and a monthly project status summary (which you can turn off in Settings or via the unsubscribe link in any status email). We send no marketing email.
• Security, abuse prevention, and legal compliance.

Where the GDPR or similar laws apply, our legal bases are performance of a contract (providing the Service you signed up for), legitimate interests (security, service operation), and consent where required.

3. Who sees your data

• Your project members see your name, company, preferred language, and the content you post in shared projects.
• Service providers (processors) that host and power the Service: Vercel (hosting, photo storage), Neon (database), OpenAI (translation), Resend (email delivery), and Stripe (payments). Each processes data only to provide its function.
• Authorities, where the law genuinely requires it.

We do not sell or rent personal data, and we do not share it with advertisers or data brokers.

4. International transfers

The Service is hosted in the United States. If you use it from outside the US, your data is transferred to and processed in the US and other countries where our providers operate. Where laws such as the GDPR apply, transfers rely on appropriate safeguards, including the providers' standard contractual clauses and equivalent mechanisms.

5. Retention

• Projects (checklists, comments, photos) are kept for two years from payment (or creation, for unpaid projects), then permanently deleted automatically. Owners can delete a project sooner at any time.
• Account data is kept while your account is active and deleted on verified request.
• Translation cache entries are anonymous text pairs keyed by a content hash and are not linked to your account.

6. Your rights

Depending on where you live (including the EU/UK under the GDPR, California under the CCPA/CPRA, Brazil under the LGPD, and similar laws elsewhere), you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to complain to your local data-protection authority. We honor these requests for all users regardless of location: submit a request through our contact form using your account email address and we will verify and respond within the time required by applicable law. We do not discriminate against you for exercising any right.

7. Security

Data is encrypted in transit; passwords are stored only as salted scrypt hashes, and session, verification, and reset tokens are stored only as cryptographic hashes. No system is perfectly secure, so use judgment about what you upload.

8. Children

The Service is a professional tool and is not directed to children under 16. We do not knowingly collect data from them; if you believe a child has created an account, contact us and we will delete it.

9. Changes

We will post any changes to this policy on this page with a new effective date, and for material changes we will notify account holders by email.

10. Contact

Privacy questions and requests: use our contact form. See also our Terms of Use.