Early access: we are launching soon. Payments are in test mode, so no real charges yet.

Privacy Policy

Last updated: November 2, 2026

MondayBrief ("we", "us") is operated by Aupaju Varahaldus OÜ, a company registered in Estonia (contact: privacy@getmondaybrief.com). This policy explains what data we collect when you use getmondaybrief.com and how we use it.

Data we collect

  • Account data: your email address, whether (and when) you opted in to product tips and news, and, if you sign in with Google, your name and Google account ID.
  • Client details you enter: client names and website addresses.
  • Google data (only if you connect a client): OAuth tokens and aggregated website metrics from Google Analytics 4 and Google Search Console (for example sessions, users, conversions, search clicks, impressions, top pages and top search queries).
  • Billing data: handled by Stripe. We receive your Stripe customer ID and subscription status; we never see or store your full card number.
  • Technical data: basic server logs (IP address, browser type) kept for security and debugging.

How we use Google user data

MondayBrief requests only these Google permissions:

  • https://www.googleapis.com/auth/analytics.readonly — to read report data from the GA4 properties you choose.
  • https://www.googleapis.com/auth/webmasters.readonly — to read search performance data from the Search Console sites you choose.
  • openid, email, profile — to sign you in and show which Google account a client is connected with.

We use this data only to generate the weekly performance briefs that you see in your dashboard. We do not use it for advertising, we do not sell it, and we do not transfer it to anyone except the processors listed below that are needed to provide the service. We do not use Google user data to train general-purpose AI models.

MondayBrief's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We never request Gmail access or any permission to send email, and we never change anything in your Google accounts.

AI processing

To write a brief, we send the aggregated weekly metrics for that client (not your OAuth tokens and not personal data about website visitors) to our AI text-generation provider. The provider processes the data only to return the text and is not allowed to use it to train its models.

Storage and security

OAuth tokens are encrypted at rest with AES-256-GCM. Data is transmitted over HTTPS. Access to production systems is limited to the operator.

Retention and deletion

You can disconnect a client at any time; we then revoke the Google token and delete it. Deleting a client deletes its briefs. To delete your account and all data, email privacy@getmondaybrief.com; we complete deletion within 30 days. You can also revoke access at myaccount.google.com/permissions.

Processors

  • Vercel (hosting) and our database hosting provider
  • Stripe (payments and tax)
  • Resend (sign-in and account emails)
  • MailerLite (product tips and news emails — only if you opted in when signing up; unsubscribe at any time)
  • Our AI text-generation provider (xAI or Anthropic)

Your rights

If you are in the EU/EEA or UK you have the right to access, correct, delete, restrict or port your data, and to object to processing. Our legal bases are performance of a contract (providing the service, including sign-in and account emails), legitimate interest (security) and your consent (product tips and news emails, which you can withdraw at any time via the unsubscribe link). You may complain to the Estonian Data Protection Inspectorate (aki.ee). California residents may request access to and deletion of their personal information; we do not sell or share personal information.

Changes

We will post changes on this page and update the date above.