Privacy Policy
Effective 5 October 2026
1.Who is responsible for your data
Shchybria OÜ, the company that provides Monoverse, a private limited company registered in the Republic of Estonia under registry code 17381578, registered address Vesivärava tn 50-201, Kesklinna linnaosa, Tallinn, Harju maakond, 10152, Estonia, is the controller of the personal data described here.
Write to contact@edition.solutions with any question about this policy or to exercise your rights. We have not appointed a data protection officer; that address reaches the people who decide these matters.
2.What this policy covers — and what it does not
This policy covers monoverse.tech and its documentation, the public demo and the account area.
It does not cover the assistant working on a customer’s own store. There the store is the controller of its shoppers’ data and we act only as its processor, under the agreement with that store. If you spoke to an assistant on someone’s shop, that shop’s privacy notice applies, not this one.
3.What we collect, why, and for how long
The public demo. A hashed IP address, the transcript of the demo session, and the industry and role you select. Audio is streamed for recognition and is not stored after the session ends. We do this to run the demo, to protect it from abuse and to check the quality of the answers — our legitimate interests, Article 6(1)(f) GDPR. Kept for 30 days, then deleted.
Your account. Work email address, company name, country, and either a password stored as a hash or, if you sign in with Google, the identifier Google returns to us. We do this to create and run your account — performance of a contract and steps taken at your request before it, Article 6(1)(b) GDPR. Kept while the account exists and deleted within 30 days of your request to delete it, except what we must keep by law.
Payment. You pay by bank card on the Stripe payment page opened from the account area; the card and billing details you enter there go to Stripe, and your card number does not pass through our servers. We send Stripe any billing email address you save in the account area, an internal identifier of your account and the plan you choose, and, for each day, the voice minutes used beyond your plan’s package. From Stripe we keep the identifiers of your customer record and subscription, with the subscription’s status and paid term. Your card’s brand, last four digits and expiry date, and your invoices, are read from Stripe when you open billing and are not stored by us. We do this to take payment under the offer — performance of a contract, Article 6(1)(b) GDPR. The identifiers are deleted with your account. Invoices and payment records are kept for seven years from the end of the financial year in which they are booked, as the Estonian Accounting Act requires — a legal obligation, Article 6(1)(c) GDPR.
Correspondence. What you write to us by email, in Telegram or in the Support section of the account area, and our replies. Our legitimate interest in answering you, Article 6(1)(f) GDPR. Kept for 12 months after the exchange ends, except Support tickets, which are kept until your company’s account is deleted and are deleted with it. A language model sorts Support tickets by type and urgency, which sends a ticket’s subject and the first 2,000 characters of its text to an external language model vendor.
Site statistics. On the home, pricing, demo, about, contact, legal and sign-up pages we use Google Analytics 4 and Google Tag Manager, provided by Google Ireland Limited, to count visits and see which pages are used; the sign-in, verification and password-reset pages and the account area carry neither. Their cookies rest on your consent, Article 6(1)(a) GDPR and Article 5(3) of Directive 2002/58/EC. Before you choose, Google receives only cookieless signals that a page was viewed, on our legitimate interest in knowing what is used, Article 6(1)(f) GDPR. Google Analytics keeps this data for at most 14 months. For visitors in Ukraine these grounds rest on Article 11 of Law of Ukraine No. 2297-VI on personal data protection.
We do not collect special categories of data, we do not buy data about you, and we do not sell or rent data to anyone.
4.Cookies
The site keeps what it needs to work, which needs no consent: vb_locale and vb_theme, your language and theme, for 1 year each, the theme also in your browser’s local storage; vb_consent, your cookie choice, for 180 days, which is also our record of that choice; and, once you sign in, vb_session and vb_csrf, for 7 days.
Until you choose in the cookie banner, every Google consent signal stays denied and no Google cookie is set. Once you allow statistics, Google Analytics sets _ga, a random identifier for your browser, and _ga_LKSZ8X8XMD, the state of your visit, each kept for up to 2 years; Google Tag Manager sets none of its own. The banner also offers an advertising choice: no advertising service is connected today, so it sets no cookie. You can change your choice at any time through the Cookie settings link at the foot of the site’s pages, or block cookies in your browser.
5.Who else sees the data
To run the demo and the site we use providers in these categories:
- cloud hosting and infrastructure;
- speech recognition;
- speech synthesis;
- language models that generate the assistant’s answers;
- site statistics — Google Analytics 4 and Google Tag Manager, provided by Google Ireland Limited;
- authentication — Google, and only if you choose to sign in with Google.
Each of them acts under a written data processing agreement, processes data only on our instructions and for the purposes above, and may not use it for its own. We name the current providers on request at contact@edition.solutions.
Card payments — Stripe. Stripe Payments Europe, Limited, in Ireland, runs the Stripe payment page and takes the payments under the offer. It acts as our processor when it does this for us, and as an independent controller when it uses the payment data for its own purposes: choosing the banks and payment-method providers that carry a payment, preventing fraud, financial loss and other harm, meeting anti-money-laundering and know-your-customer law, its own billing, and improving its services. Stripe’s own privacy policy describes that processing.
We also disclose data where the law or a competent authority requires it.
6.Processing outside the European Economic Area
Some of these providers process data outside the EEA. Where that happens, the transfer rests on the standard contractual clauses approved by the European Commission under Article 46 GDPR, together with the technical measures described below. Google Ireland Limited transfers the statistics data to Google LLC in the United States under the EU–US Data Privacy Framework, an adequacy decision under Article 45 GDPR. Payment data also goes to Stripe, LLC in the United States, which receives it under the EU–US Data Privacy Framework.
7.How we protect the data
Traffic is encrypted in transit. Integration keys and credentials are encrypted at rest. Data belonging to different clients is logically isolated. Access by our people is granted on a need-to-know basis and is logged, and data is backed up.
8.Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or hand it to another provider in a machine-readable form. You may object to processing that rests on our legitimate interests, including the processing described in section 3. Where processing rests on consent, you may withdraw it at any time, which does not affect what was lawful before.
Write to contact@edition.solutions. We answer within one month.
If you think we handle your data wrongly, you may complain to the Estonian Data Protection Inspectorate — Andmekaitse Inspektsioon, info@aki.ee, www.aki.ee — or to the supervisory authority of the country where you live or work.
9.Automated answers
The assistant generates its answers automatically. We make no decisions about you that produce legal effects or similarly significantly affect you, and we do not profile you.
10.Children
The service is meant for businesses. It is not directed at children, and we do not knowingly collect their data. If you believe a child has sent us personal data, write to us and we will delete it.
11.Changes to this policy
We may update this policy. The effective date at the top changes with it, and we announce material changes on the site.
12.Language
The English version of this policy is binding. Translations into other languages are provided for convenience; where they differ, the English version applies.