Privacy policy

Who is responsible

• For accounts, the site and page statistics: Badr Zinoun, publisher of MonoProfile, based in Morocco. Contact: contact@monoprofile.com.
• For the subscribers and messages a creator collects through the forms on their page: that creator. MonoProfile stores and processes this data on the creator's behalf, only to provide the service.

If you have an account

We keep what is needed to run your account and your pages, secure them and write to you about them:

• your email address, your optional name and the language you choose;
• your password, only as a salted hash (PBKDF2-SHA256): nobody can read it;
• if you turn on two-step verification, its secret (encrypted) and your recovery codes (as hashes);
• your sessions: a hash of the session token, the browser description (user agent) and the dates of creation and last use. A session ends after 30 days;
• the single-use links we email you (email check, password reset, login link, invitation), stored as hashes until they expire;
• the access tokens you create: their name, first characters and a hash;
• the number of failed logins, to block repeated attempts;
• your pages: username, texts, links, blocks, settings and the files you upload (photos, backgrounds, thumbnails);
• your plan and, once payments open, the status of your subscription.

If you visit a creator's page

MonoProfile sets no cookies for visitors. For each view or click, we record the date and time, the page and link, the country and city that Cloudflare derives from the connection, the type of device, the system and browser (from the user agent), the domain of the site you came from, the UTM parameters of the address and, for a click, the time before it.

To count unique visitors without cookies, we compute each day a short fingerprint from your IP address, your user agent, the page and a secret value. We do not store your IP address. The fingerprint changes every day and cannot be turned back into your IP address. Robots and link previews are not counted.

Your IP address is also used, without being stored by MonoProfile, to limit abuse: too many logins, form submissions, reports or clicks from the same connection.

Detailed records are kept for 400 days, then deleted once they are added to daily totals. The daily totals are kept as long as the page exists. The creator sees only these statistics, never who you are.

If you fill in a form on a creator's page

Signup and contact forms keep what you enter (email, phone, name, country, message), the date, the site you came from and your consent if the creator asks for it. The creator can read, export and delete this data, and send it to Mailchimp, Klaviyo, Kit or their own webhook if they connect one. To use your rights on this data, contact the creator, or write to contact@monoprofile.com and we will pass your request on.

If you report a page with the report form, we keep the page, the reason, your details and your email address if you give it, to handle the report.

Content from other services

Creators can add content from other services, for example YouTube, Spotify, Calendly, Google Maps or products from a Shopify store. This content loads from those services, which may set their own cookies under their own policies. YouTube videos use the youtube-nocookie.com address.

On the Pro plan, a creator can add Google Analytics or a Meta pixel to their page. They load only after you accept them in a banner. Your browser remembers your answer locally; it is not sent to MonoProfile.

Cookies

One cookie, only for people who log in to the dashboard: __Host-sid, which keeps you logged in (30 days, HttpOnly, Secure, SameSite=Lax). It is strictly necessary, so it does not need consent. Visitors of creator pages get no cookie from MonoProfile.

Who processes the data, and where

• Cloudflare, Inc. (United States) hosts the whole service: the application, the database (Western Europe region), the files, the queues and the sending of emails. Your data is therefore processed by Cloudflare, including outside Morocco.
• AI features (Pro and Premium plans) run on Cloudflare Workers AI and only when you ask. Suggestions receive your page title, bio, link titles and addresses; the analysis receives your aggregated statistics.
• Paid plans are not open yet. When they open, Lemon Squeezy will handle payments as merchant of record, and this policy will be updated first.
• The integrations a creator connects (Mailchimp, Klaviyo, Kit, webhook) receive subscriber data under that creator's responsibility.

Cloudflare keeps technical logs (errors, failed email sends) for a limited time to run and secure the service. They can contain an email address.

How long we keep data

• Account and pages: until you delete them. Deleting your account deletes your pages, files, statistics, subscribers, messages, integrations, short links, sessions and tokens.
• Sessions: 30 days. Expired sessions and links are deleted every day.
• Visitor records: 400 days, then only daily totals.

Your rights

Under Moroccan law 09-08 and, for people in the European Union, the GDPR, you can access, correct, export or delete your data, and object to its use. In the dashboard, you can edit your details, export all your data and delete your account at any time. For anything else, write to contact@monoprofile.com.

You can also complain to the CNDP, the Moroccan data protection authority, or to the data protection authority of your country.

Security

Connections use HTTPS. Passwords, sessions, single-use links and tokens are stored as hashes, and the secrets of integrations and two-step verification are encrypted.

Changes

We publish every change on this page, with its date.