Privacy Policy

1. Who this policy covers

“Monyo”, “we” and “us” mean InstaMonyo Inc., a Delaware corporation with its principal place of business at [REGISTERED ADDRESS], San Francisco, CA [ZIP]. “You” means anyone who visits our sites, applies for or holds a Monyo account, takes part in the creator marketplace, or deals with us on behalf of a brand.

This policy covers:

• our websites, including instamonyo.com;
• the Monyo creator app and the Monyo brand dashboard;
• paid creator tiers, the creator marketplace, campaigns and rewards;
• the Monyo virtual account, and any card products we offer in future.

This policy does not cover:

• the separate privacy practices of Partner Bank, N.A., which holds deposits and issues any card. Its notice is at [LINK TO PARTNER BANK PRIVACY NOTICE] and applies to the information it holds about you;
• brands, merchants, social platforms and other third parties you choose to deal with. When you leave Monyo for their site or app, their policy governs;
• information about our own employees and job applicants, which is handled under a separate notice.

If a brand uses Monyo to run a campaign, Monyo is the business that decides how creator information is handled for that campaign. Information a brand uploads about its own customers is the brand’s, and we process it only on the brand’s instructions under our brand agreement.

2. Monyo is not a bank

We say this here because it changes who holds what. Account balances, deposit records and card transaction records sit with Partner Bank, N.A. and are subject to its privacy notice as well as this one. Monyo holds the information needed to operate the programme and to service your account on the bank’s behalf.

Nothing on our sites, in our advertising or in this policy is an offer or guarantee of credit, of a card, or of any particular reward amount. Eligibility, approval and all terms are decided at the time you apply and are subject to the applicable account agreement.

3. The information we collect

The categories below use the labels in the California Consumer Privacy Act so that this section also serves as our notice at collection. Not every category applies to every person; what we hold about a site visitor is far less than what we hold about an account holder.

Sensitive personal information

We collect sensitive personal information only to verify who you are, to meet our legal obligations, to prevent fraud, and to provide the account or service you asked for. We do not use or disclose it to infer characteristics about you. Because our use is limited to these purposes, the CCPA right to limit its use does not require us to offer a separate link — but you may still ask us to limit it using the contact details in section 19 and we will honour the request where the law allows.

Information we do not want

Please do not send us information about your health, race, religion, sexual orientation, union membership, immigration status or political opinions. We do not need it, we do not ask for it, and if you send it anyway we will delete it when we find it.

4. Federal privacy notice (GLBA / Regulation P)

Information we collect in connection with a financial product or service — the virtual account, payouts, and any future card — is nonpublic personal information under the Gramm-Leach-Bliley Act. It is governed by this section and by federal law, and it is exempt from the California Consumer Privacy Act under Cal. Civ. Code § 1798.145(e). Sections 7 and 8 apply to everything else.

To limit our sharing, where the table says you can, email privacy@instamonyo.com or call [TOLL-FREE NUMBER]. If you are a new customer we may share your information as described above for 30 days from the date we sent this notice; once you tell us otherwise we will stop. Your choice stays in effect until you change it. If you hold an account jointly, a choice made by one of you applies to all of you.

California residents: we will not share information about you with non-affiliates for them to market to you, and we will limit sharing among our affiliates, except as permitted by California law, including Cal. Fin. Code § 4050 et seq. (the California Financial Information Privacy Act).

Vermont residents: we will not disclose information about your creditworthiness to our affiliates, and will not disclose your personal information to non-affiliates for marketing, without your authorisation.

Partner Bank, N.A. gives you its own GLBA notice covering the information it holds. Read both.

5. How we use information

We use the information described in section 3 to:

• create, verify and maintain your account, and authenticate you when you sign in;
• decide whether you are eligible for a creator tier, a campaign, the virtual account, or a card, and on what terms;
• operate the marketplace — match you to campaigns, confirm that content was posted, measure performance, calculate and pay rewards, and settle with brands;
• process payments, transfers, payouts and reversals, and keep accurate records of them;
• detect, investigate and prevent fraud, abuse, money laundering and other unlawful or prohibited activity, and to protect our users, our brands and ourselves;
• meet legal obligations, including identity verification, sanctions screening, suspicious-activity reporting, tax reporting and record-keeping;
• provide support, respond to disputes and complaints, and keep a record of what was said and done;
• improve, test and secure our products, including by training internal models on the data we hold;
• send you service messages, and — where you have not opted out — marketing about Monyo products and partner offers;
• enforce our terms and defend legal claims.

Automated decisions

We use automated systems to score eligibility, match creators to campaigns, rank the Market, and flag risk. These affect what you are offered. Where an automated decision has a legal or similarly significant effect on you, you may ask us for a human review using section 19, and we will tell you the main factors involved. Where the decision concerns credit, section 11 also applies.

6. How we disclose information

We disclose personal information to:

• Our partner bank and payment partners — Partner Bank, N.A., card networks, processors and payout providers, so that accounts, transfers and cards can exist at all.
• Service providers and contractors — cloud hosting, identity verification, fraud and sanctions screening, analytics, customer support, communications, and professional advisers. They act on our instructions and are contractually barred from using the information for their own purposes.
• Brands — when you apply to or take part in a campaign, we give the brand what it needs to run it: your handle, tier, relevant audience metrics, the content you submit, and delivery status. We do not give brands your government identifiers or financial account numbers.
• Other creators and the public — information you choose to make public, such as your profile, storefront or Market position. Earnings figures are private by default and are shown only if you turn that on.
• Credit bureaus and reporting agencies — where we offer a credit product and are required or permitted to furnish information about it.
• Authorities — regulators, law enforcement and courts, where we are required to respond, or where we believe disclosure is necessary to investigate or prevent fraud, harm or a violation of our terms.
• Acquirers — in a merger, financing, reorganisation or sale of assets, subject to the acquirer honouring this policy for information collected before the change.

We do not sell your personal information

We do not sell personal information for money, and we have not done so in the preceding twelve months. We do not sell or share the personal information of consumers we know to be under 16.

We do use advertising and analytics cookies that pass identifiers and browsing activity to partners who may use them for cross-context behavioural advertising. California law treats that as sharing, whether or not money changes hands, so we offer an opt-out. Use Email privacy@instamonyo.com with the subject Do Not Sell or Share, use the cookie controls where we offer them, or send a Global Privacy Control signal from your browser — we treat GPC as a valid opt-out for the browser that sends it.

7. California privacy rights (CCPA / CPRA)

If you live in California, you have the rights below as to personal information that is not exempt under section 4. Exercising them costs nothing and we will not treat you differently for it.

• Know and access. Ask what we collected, where it came from, why, who we gave it to, and for a copy, covering at least the past twelve months and, on request, beyond that where the law requires.
• Delete. Ask us to delete what we hold. We must keep some records — for example to complete a transaction, meet anti-money-laundering and tax obligations, prevent fraud, or defend a legal claim — and we will tell you what we kept and why.
• Correct. Ask us to fix information that is inaccurate.
• Opt out of sharing. Tell us to stop sharing your information for cross-context behavioural advertising, as described in section 6.
• Limit sensitive information. Ask us to limit use of sensitive personal information, as described in section 3.
• No retaliation. We will not deny service, charge a different price, or give you a lesser experience because you exercised a right. If we ever offer a financial incentive for data, we will describe its terms and material value before you join, and you may withdraw at any time.

How to make a request

Email privacy@instamonyo.com, call [TOLL-FREE NUMBER], or use the privacy controls in your account. We will verify you before we act — usually by confirming details we already hold, and for sensitive requests by a stronger check. An authorised agent may act for you with written permission that we can verify; we may still ask you to confirm directly.

We confirm receipt within 10 business days and respond within 45 calendar days, extendable once by a further 45 days if we tell you why.

Shine the Light

California Civil Code § 1798.83 lets you ask once a year about personal information we disclosed to third parties for their own direct marketing. We do not make those disclosures. Ask at privacy@instamonyo.com and we will confirm it in writing.

Do Not Track

Browsers send Do Not Track signals in inconsistent ways and there is no common standard, so we do not respond to them. We do honour the Global Privacy Control, as described in section 6.

Minors

Monyo is not offered to anyone under 18. If you are a California resident under 18 and registered with us anyway, you may ask us to remove content you posted — Cal. Bus. & Prof. Code § 22581. Removal may not be complete or comprehensive, for example where it has been copied by others.

8. Other U.S. state privacy rights

Residents of states with comprehensive privacy laws — currently including Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — have comparable rights to access, correct, delete and obtain a portable copy of their information, and to opt out of targeted advertising, sale, and certain profiling. Use the same channels in section 19.

Most of these laws also exempt information covered by the GLBA, and several exempt financial institutions entirely. Where an exemption applies, section 4 governs instead.

If we deny your request you may appeal by replying to our decision with the word Appeal. We will respond within 45 days with our reasoning, and tell you how to complain to your state Attorney General.

Nevada: Nevada residents may tell us not to sell certain information. We do not sell it, but you may still submit a request to privacy@instamonyo.com.

9. Connecting your social accounts

Creator products depend on social data. If you connect Instagram, TikTok, YouTube or another platform, you authorise us and our data providers to collect, through the platform’s own interfaces, information such as your handle, follower count, engagement rate, audience characteristics in aggregate, and metrics for the posts you submit to a campaign.

• We collect this only while the connection is active and only for the accounts you connect.
• We do not collect your platform password. Access runs on tokens you can revoke, either in Monyo or in the platform’s own settings.
• Disconnecting stops future collection. It does not erase metrics already used to pay a completed campaign, because those are part of the payment record.
• Each platform’s own terms and privacy policy continue to apply to your account there.

10. Identity verification and biometric information

Federal law requires us and our partner bank to verify the identity of every account holder. To do that we collect the identifiers in section 3 and check them against government, credit-header and sanctions databases through verification providers.

11. Credit, scoring and adverse action

When you apply for a product that involves credit, you authorise us and our partner bank to obtain consumer reports about you from credit reporting agencies, and to use them to decide whether you qualify and on what terms. We may obtain further reports to review, maintain, renew or collect on the account.

The Monyo Score is our own internal measure. It combines conventional credit information with creator activity such as audience size, engagement and campaign delivery. It is not a FICO or VantageScore, no credit bureau produces it, and it is not a consumer report about you.

If we decline an application, or offer less favourable terms, because of information in a consumer report, you will receive an adverse action notice telling you the main reasons, naming the agency that supplied the report, and explaining your right to a free copy of it and to dispute what it says. The agency did not make the decision and cannot explain it.

We do not use race, colour, religion, national origin, sex, marital status, age, or the fact that you receive public assistance, as a basis for any credit decision.

12. Paid creator tiers and billing

Monyo offers paid creator tiers — Nano, Sprite, Micro, Macro and Mega — charged in advance. To take payment we collect your billing name, billing address, and card or bank details. Card numbers go directly to our payment processor; we hold a token and the last four digits, never the full number.

We keep records of what you were charged, when, under which tier, what you were entitled to, and what was delivered. We keep them for as long as the law requires and for as long as a dispute or chargeback could be raised.

The commercial terms of a tier — price, renewal, cancellation and refunds — are in the Monyo Terms of Service and in the checkout disclosures you accept before you are charged, not in this policy.

13. Cookies, analytics and advertising

We and our providers use cookies and similar technologies for four things:

• Strictly necessary — signing you in, keeping your session, protecting against fraud and abuse. These cannot be switched off.
• Functional — remembering your settings and preferences.
• Analytics — understanding which pages are used and where people get stuck.
• Advertising — measuring campaigns and showing Monyo adverts on other sites and apps. These are the ones that count as “sharing” under California law.

Change your choices at any time through the cookie controls where we offer them, through your browser or device settings, or by emailing privacy@instamonyo.com. Blocking strictly necessary cookies will stop the service working.

14. How long we keep information

We keep each category only as long as we need it for the purpose we collected it, and then for as long as the law requires. In practice:

• Account and identity records — for the life of the account and at least five years after it closes, which is the period the Bank Secrecy Act requires for customer identification and transaction records.
• Transaction, reward and payout records — at least five years, and longer where tax law requires.
• Campaign content and performance — for the campaign, its monitoring window, and the period in which it could be disputed.
• Support and dispute records — for as long as the matter is open and then as evidence while a claim could still be brought.
• Biometric identifiers — as set out in section 10.
• Marketing and analytics data — up to 24 months, or until you opt out.

When a period ends we delete the information or de-identify it so it can no longer identify you.

15. Security

We encrypt personal information in transit and at rest, restrict access to staff who need it, log access, use multi-factor authentication internally, test our systems, and maintain a written information security programme as required of financial institutions under the GLBA Safeguards Rule.

No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorisation. Keep your credentials to yourself, turn on every authentication step we offer, and tell us immediately at security@instamonyo.com if you think your account has been used by someone else. If a breach affects you we will notify you and the regulators as the law requires.

16. Children

Monyo is for adults. You must be at least 18 to hold an account. We do not knowingly collect information from anyone under 13, and we do not knowingly sell or share the information of anyone under 16. If we learn that we hold a child’s information we will delete it. Tell us at privacy@instamonyo.com if you believe a child has given us information.

17. Where we operate

Monyo is offered in the United States, to United States residents, and our products are not offered to residents of the European Economic Area, the United Kingdom or Switzerland. Information is stored and processed in the United States. If you use Monyo from outside the United States, you understand that your information will be transferred to and handled in the United States under United States law.

Some of our service providers operate outside the United States. Where they do, we require contractual protections at least as strong as those in this policy.

18. Changes to this policy

We may update this policy. When we do we will change the date at the top and post the new version here. If a change materially reduces your rights or materially expands how we use information you have already given us, we will give you notice in the app or by email before it takes effect, and where the law requires it we will ask for your consent. Continuing to use Monyo after a change takes effect means you accept the updated policy.

We will send the GLBA notice in section 4 at least once a year while you hold an account, as Regulation P requires.

19. How to contact us and exercise rights

You may also complain to the California Privacy Protection Agency, the California Attorney General, your own state Attorney General, or the Consumer Financial Protection Bureau at consumerfinance.gov/complaint.