Privacy Policy

1. Who We Are

This Privacy Policy applies to Stoado Limited, a company registered in England and Wales under company number 15375067, with its registered office at:

Suite G04, 1 Quality Court, Chancery Lane, London, England, WC2A 1HR

We operate under the trading names Stoado and Monty by Stoado.

For any privacy-related concerns or requests, you can contact us at: operations@stoado.com

2. What This Policy Covers

This policy outlines how we collect, use, and protect your information while using our services, including:

• Our website and dashboard
• Our browser extensions (e.g. Monty)
• Our authentication systems
• Any services hosted under the Stoado or Monty names

By using Monty or any affiliated service, you also agree to the Google Chrome Web Store Privacy Policy.

3. What We Collect

We prioritize privacy. We do not collect personally identifiable information (PII) unless:

• You provide it voluntarily (e.g., for support or sign-up)
• It is essential for service functionality (e.g., email for account creation)

Instead, Monty focuses on:

• Marketplace metadata (e.g., price, seller ratings, listing language)
• Pattern-based risk signals
• Session identifiers
• Anonymized, cryptographically hashed memory references

4. How We Use Your Data

Data is used to:

• Detect patterns of fraudulent activity
• Score listings and orders for risk
• Train and refine models via Reinforcement Learning from Human Feedback (RLHF)
• Provide personalized insights to users

We never sell or share personal data with advertisers or third parties for unrelated purposes.

5. Tiered Memory and Data Handling

Monty uses a risk-based memory strategy:

High/Critical Risk

• Cryptographic hashing
• Server-side pattern storage (anonymized)
• Persistent for pattern recognition across sessions

Medium Risk

• Temporarily hashed with decay (30–60 days)
• Helps maintain short-term context

Low/Negligible Risk

• Local-only encrypted session memory
• Never leaves the user's device

This balance protects users while enabling Monty to get smarter over time.

6. Legal Basis for Processing (Under GDPR)

We process your data under these lawful bases:

• Contractual necessity: To deliver the services you request
• Legitimate interests: To improve fraud detection and protect users
• Consent: For waitlists, updates, or optional features

You may withdraw consent at any time by contacting operations@stoado.com.

7. Data Sharing and Subprocessors

We use trusted GDPR-compliant subprocessors for core functionality:

• Stripe – for payment processing
• Auth0 – for user authentication
• Vercel / AWS – for hosting and AI model execution

No unnecessary third-party sharing takes place.

8. User Rights (Under UK GDPR)

You have the right to:

• Request access to your data
• Correct inaccuracies
• Request deletion ("Right to be Forgotten")
• Restrict or object to certain processing
• Lodge a complaint with the ICO (Information Commissioner's Office)

To exercise these rights, email operations@stoado.com.

9. International Data Transfers

Where necessary, we may transfer anonymized or hashed data outside the UK or EU (e.g. AWS servers). In such cases, we ensure protections via:

• Standard Contractual Clauses (SCCs)
• Or equivalent safeguards under GDPR

10. Data Security

We adhere to modern security practices:

• End-to-end encryption of sensitive communications
• Cryptographic hashing for identifiers
• Role-based access control
• Monitoring and audit logging

While no system is entirely immune, we take every reasonable measure to protect your data.

11. Children's Privacy

Monty is not intended for use by individuals under 16. We do not knowingly collect data from minors.

12. Updates to This Policy

We may revise this policy periodically. If significant changes occur, we'll notify users via:

• Email
• Banner in-app notifications

13. Contact Information

operations@stoado.com
Stoado Limited
Suite G04, 1 Quality Court, Chancery Lane, London, England, WC2A 1HR