MonacHub Privacy Policy

This Privacy Policy explains how MonacHub ("we", "us") collects, uses, shares and protects personal data when you use:

• the MonacHub mobile application (for people who discover and book venues),
• the MonacHub Pro mobile application (for restaurants, bars, shops and other professionals, together "Venues"),
• the website monachub.mc (together, the "Services").

It is written to comply with Monaco Law n° 1.565 of 3 December 2024 on the protection of personal data, and with the EU General Data Protection Regulation (GDPR) for users located in the European Union. It also serves as the privacy policy required by the Apple App Store and Google Play.

If anything is unclear, write to contact@monachub.mc.

---

1. Who is responsible for your data

The data controller is:

MonacHub, Principality of Monaco
E-mail for privacy matters: contact@monachub.mc

Venues that receive your reservation are separate controllers for the data they need to serve you (see section 7). Their own privacy notices apply to what they do with it.

2. In short

• We collect what is needed to run a reservation and social service: your account, your bookings, your messages, and the technical data needed to make the apps work.
• We do not sell your data, we show no advertising, and we do not track you across other apps or websites. We do not use the advertising identifier of your phone.
• Precise location is used only when you allow it, only while you use the map or share your position in a chat, and is shared with other people only when you choose to share it in a chat.
• Your data is hosted in the European Union (Paris, France). A few service providers (map tiles, push notifications, crash reports, sign-in with Google or Apple) may process limited data outside Monaco, with the safeguards described in section 6.
• You can delete your account from inside the app at any time. Deletion becomes final after a grace period of about 30 days.
• You have rights of access, rectification, erasure, portability and objection, and can complain to the APDP in Monaco or to the CNIL in France.

3. What data we collect and where it comes from

3.1 Account and profile (both apps)

• Sign-up and sign-in data: e-mail address (or, where the option is offered, mobile phone number), one-time verification codes, password (stored only in hashed form), sign-in timestamps.
• Sign in with Google / Sign in with Apple: when you use these options we receive an identity token, your e-mail address (or Apple's private relay address) and, the first time only, the name attached to that account. We never receive your Google or Apple password.
• Profile: first name, last name, username, profile photo, preferred language (English or French), notification preference, preferred price range and ambiance.
• Guest mode: you can browse MonacHub without an account. A temporary anonymous identifier is created on our servers; it holds no personal data and is deleted automatically after about 7 days of inactivity or when you sign up.
• Biometric unlock: if you enable Face ID / Touch ID / fingerprint unlock, the check is performed by your phone's operating system. We never receive biometric data; only your on/off preference is stored on the device.

3.2 Food preferences and allergens (health-related data)

In the MonacHub app you can optionally record your dietary preferences, favourite cuisines and allergens (with severity). Allergen information is health-related data. We collect it only with your explicit consent, use it solely to inform the Venue when you book, and you can edit or remove it at any time in your profile. Reservation notes are free text: please do not enter health or other sensitive information there unless the Venue needs it for your visit.

3.3 Reservations (bookings)

Venue, date and time slot, duration, party size, free-text note, visibility setting (private, by invitation, public), reference number, status history (pending, confirmed, cancelled, completed, no-show), who cancelled and why, table number, presence confirmation, and the guests you invite.

When you add guests who are not MonacHub users, we store the name and contact details you enter. You confirm that you are allowed to share them with us and with the Venue for this reservation.

When you share a reservation link, anyone who has the link can see the reservation summary (Venue, date, host name) and ask to join.

3.4 Payment card and no-show fees

Some Venues apply a no-show fee. To book at such a Venue you register a payment card. Card registration and any charge are performed by our payment service provider Core by Carlo (Carlo, Monaco) on its own secure page. MonacHub never sees or stores your full card number or security code. We store only: a card token issued by Core by Carlo, the card brand, the last digits, the expiry date, the label you gave the card (personal or business), and the history of no-show charges (amount, status, reference, reason, outcome of any dispute).

Nothing is charged when you book. See our Terms of Use for how and when a no-show fee can be charged.

3.5 Messages, friends and groups

• Contacts: friend requests you send or receive, your friends list, blocked accounts.
• Conversations: one-to-one and group chats, group name and photo, group membership and admin status.
• Message content: text, photos and videos, voice recordings, shared locations (coordinates, the time the position was captured and the address we derive from them), shared venues, shared reservations, polls and votes.
• Message status: when a message was delivered to and read by each participant.
• Presence: whether you are online and when you were last active, visible to your contacts.
• Reports: if you report a person or a conversation, we store the reason, your description and a copy of the reported messages so that our moderation team can review them.

3.6 Saved places and ratings

Venues you save, your personal rating (0-5) and comment, personal tags, whether friends may see the place, and whether you want to be notified when you are nearby. Ratings and comments are private to you and, if you choose, to your friends; they are not published to the public.

3.7 Location

• Map: with your permission, the MonacHub app reads your precise location to centre the map and show Venues near you. The position is used for that search only; we do not build a history of your movements and we never read your location in the background.
• Chat: when you tap "share location" in a conversation, the coordinates you chose, the time the position was captured and the corresponding address are stored as part of the message and shown to the participants.
• Time zone of the device, so that opening hours and reservation times are displayed correctly.
• The MonacHub Pro app does not use your location.

3.8 Camera, photos and microphone

• Camera / photo library: to set your profile photo, to send photos and videos in a chat, to scan a friend's QR code, and (MonacHub Pro) to upload photos of your establishment, menus and services. We access only the items you select.
• Microphone: to record voice messages in a chat, only while you hold the record button.
• Saving to your gallery: only when you ask to save your QR code.

3.9 Notifications

Push notification tokens (Firebase Cloud Messaging / Apple Push Notification service), an installation identifier (Android App Set ID or an equivalent identifier), platform (iOS or Android), the list of notifications sent to you and whether you opened them. You can disable notifications in the app settings or in your phone settings.

3.10 Technical and security data

• Device model, operating system version, app version, language, time zone, connection type.
• IP address and request logs on our servers (security, abuse prevention, debugging).
• Crash and error reports sent to Sentry: what went wrong, the screens visited just before the error, device and app version. Crash reports contain no screenshots and are not linked to your name or e-mail.
• Install attribution and links via AppsFlyer: when you install the app from an invitation or reservation link, AppsFlyer tells us which link brought you so that we can open the right screen. We have disabled collection of the advertising identifier (IDFA / GAID) and we do not use AppsFlyer for advertising.
• Sign-in security events: failed attempts, temporary lock-outs, forced sign-out when a session is revoked.

3.11 Professionals using MonacHub Pro

• Business identity: trade name, description, legal name, legal form, registration number, address and geographic position, phone, e-mail, website, social links, opening hours, special hours, price range, dress code, accessibility, categories.
• Content: photos, menus and dishes, services, prices.
• Team: e-mail addresses of team members you invite, their role, activation and revocation dates.
• Verification (KYC) documents: identity document of the representative, company registration extract, articles of association, beneficial-owner information and identity documents, bank details (IBAN). These are required by our payment provider Core by Carlo to open the account into which no-show fees are paid, and are transmitted to Core by Carlo for that purpose. They are stored in a private storage area accessible only to authorised staff.
• Calendar connection: provider, account e-mail and calendar identifier if you connect an external calendar.
• Operational data: reservations received, no-show declarations, presence confirmations, payment reports and exports, changes made to your listing (audit log).

3.12 Support and correspondence

Anything you send us by e-mail or through the app (questions, disputes about a no-show fee, requests to exercise your rights), together with our replies.

3.13 Website

Our website monachub.mc records standard server logs (IP address, pages requested, browser). It uses only strictly necessary cookies. If we add audience measurement or other non-essential cookies, we will ask for your consent first and update this policy.

3.14 Data we do not collect

We do not read your address book, your calendar contents, your SMS, your call logs, your other installed apps, or your advertising identifier. We do not collect date of birth. We do not use facial recognition.

4. Why we use your data and on what legal basis

We never make decisions producing legal or similarly significant effects on you by purely automated means. A no-show fee is charged only after a human at the Venue declares the no-show, and you can dispute it within 48 hours (see Terms of Use).

5. Who we share your data with

5.1 Other users and Venues

• Your name, username and profile photo are visible to people you interact with (friends, group members, Venues you book, people who open a reservation link you shared).
• Your online status and last activity are visible to your contacts.
• Saved places are visible to your friends only if you enabled that option.
• Reservation details (name, date, party size, note, allergens and preferences if provided, contact details needed to manage the booking) are sent to the Venue.
• Messages are visible to the participants of the conversation. Clearing a conversation removes it from your view only; other participants keep their copy.

5.2 Service providers (processors)

They act on our instructions and may not use your data for their own purposes.

We contractually require each provider to protect your data to a standard at least equivalent to this policy and to applicable law.

5.3 Other recipients

• Authorities: courts, police and regulators when the law requires it or to defend our rights.
• Business transfer: a buyer or successor in the event of a merger, sale or reorganisation, who will be bound by this policy.

We do not share data with advertising networks or data brokers, and we do not sell personal data.

6. International transfers

Your data is stored primarily in the European Union (Paris, France) and in Monaco. Some providers listed above process limited data in the United States or elsewhere. For those transfers we rely on the safeguards recognised by Monaco Law n° 1.565 and the GDPR: EU standard contractual clauses incorporated into our provider agreements, the EU-U.S. Data Privacy Framework where the provider is certified, and additional technical measures (encryption in transit and at rest). You can ask contact@monachub.mc for a copy of the relevant safeguards.

7. Venues as independent controllers

When you book, the Venue receives the reservation data described in 5.1 and becomes responsible for its own use of it (seating, service, accounting, legal obligations). Our Terms of Use oblige Venues to use that data only to manage your reservation, not to contact you for marketing without your consent, and to protect it. For anything a Venue does beyond your reservation, contact the Venue directly.

8. How long we keep your data

9. Deleting your account

In the MonacHub app: Profile → Delete account. In MonacHub Pro: Profile → Delete account. You will be asked to confirm.

On the web: if you no longer have the app, send a request from the e-mail address linked to your account to contact@monachub.mc with the subject "Delete my MonacHub account", or use the form at monachub.mc/delete-account. We will verify that the request comes from the account holder.

What happens:

1. Your account is deactivated immediately. You are signed out on all devices and can no longer be found by other users.
2. For about 30 days you can restore the account by signing in again. This protects you against accidental or malicious deletion.
3. At the end of that period we permanently erase your identity data (e-mail, phone, username, first and last name, profile photo, allergens and preferences, push tokens, card tokens, friends list, saved places).
4. Content that other people need to keep (your messages in their conversations, reservations in a Venue's history, reports) is kept in an anonymised form that no longer identifies you, or for the legal retention periods in section 8.
5. Data held by Core by Carlo is deleted or anonymised under its own retention obligations as a payment institution.

10. Your rights

Under Monaco Law n° 1.565 and, where applicable, the GDPR you have the right to:

• access your data and obtain a copy;
• rectify inaccurate or incomplete data (most profile data can be edited in the app);
• erase your data ("right to be forgotten"), subject to the retention obligations in section 8;
• restrict processing while a dispute is examined;
• portability: receive the data you provided in a structured, machine-readable format;
• object to processing based on our legitimate interests, and at any time to commercial communications;
• withdraw consent at any time (allergens: edit your profile; location and notifications: your phone settings; this does not affect processing carried out before withdrawal);
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
• give instructions on the fate of your data after your death (for users in France).

To exercise these rights, use the settings in the app or write to contact@monachub.mc. We may ask you to confirm your identity. We reply within one month, extendable by two further months for complex requests, in which case we will tell you.

You may also lodge a complaint with a supervisory authority:

• Monaco: Autorité de Protection des Données Personnelles (APDP), Le Concorde, 11 rue du Gabian, 98000 Monaco — https://apdp.mc
• France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — https://www.cnil.fr
• Or the data protection authority of your country of residence in the EU.

11. Security

We apply technical and organisational measures appropriate to the risk, including: encryption of all traffic (TLS), encryption at rest by our hosting provider, row-level access rules in our database so that each user can only reach their own data, hashed passwords, one-time verification codes with a short expiry, temporary lock-out after repeated failed sign-ins, secure on-device storage of session tokens, private storage areas with time-limited access links for chat media and professional documents, least-privilege access for our staff and providers, and logging of administrative actions.

No system is perfectly secure. If a breach is likely to affect your rights, we will notify the APDP within 72 hours and inform you as the law requires.

12. Children

The Services are intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, contact contact@monachub.mc and we will delete it.

13. Cookies and similar technologies

The mobile apps use local storage on your device (session tokens, your preferences, cached images) which is necessary to run the apps. They do not use advertising or cross-site tracking technologies. The website uses only strictly necessary cookies. Any future non-essential cookie will require your prior consent.

14. Changes to this policy

We may update this policy when the Services or the law change. For material changes we will notify you in the app or by e-mail before they take effect. The current version is always available at monachub.mc/privacy and from the app settings.

15. Contact

MonacHub, Monaco
E-mail: contact@monachub.mc