| # GDPR — Privacy & Data Processing |
|
|
| How mona.expert processes personal data, and how the open-source client |
| minimises it. This document supports both end-user transparency |
| (Art. 13/14) and customer due diligence (Art. 28 annex-ready). |
|
|
| ## Roles |
|
|
| - **mona.expert** — data controller for account data; data processor |
| where customers operate the platform on their own behalf. |
| - **You (the user)** — controller of your own device and of the |
| commands you issue. |
|
|
| ## Processing activities (Art. 30 summary) |
|
|
| | Purpose | Categories | Legal basis | Retention | |
| |---|---|---|---| |
| | Account & authentication | Email, username, API token, session | Contract (Art. 6(1)(b)) | Account lifetime + 30 days | |
| | Agent operation & audit | Task text, tool results, audit events, conversation | Contract / legitimate interest (security) | 180-day rolling audit; conversation until deleted | |
| | Device telemetry | Hostname, OS, CPU/memory/disk/load metrics, IP | Contract (service operation) | Latest snapshot + 180 samples (~30 min) | |
| | Security & abuse prevention | IP, rate-limit counters, timestamps | Legitimate interest (Art. 6(1)(f)) | 24 h (rate limits), 180 days (audit) | |
|
|
| ## Data minimisation by design |
|
|
| - **The device stores no provider keys.** Only a mona.expert token |
| lives locally (`~/.mona-agent/credentials.json`, mode 0600). |
| - **Telemetry is system metrics only** — no keystrokes, no screen |
| content, no file contents. Command results are sent only because you |
| asked the agent to run them. |
| - **Egress-only networking** — the daemon opens no inbound ports and |
| sends nothing to third parties. |
|
|
| ## Security of processing (Art. 32) |
|
|
| - AES-256-GCM encryption at rest for all key material |
| - HTTPS/TLS for all traffic |
| - Per-user bearer tokens + session auth + CSRF protection |
| - Least-privilege tool sandbox, allowlisted shell |
| - Full audit trail of every action |
|
|
| ## Data subject rights |
|
|
| - **Access / rectification / erasure** — the dashboard shows your |
| agents, conversations and audit entries; delete them there or write to |
| `privacy@mona.expert`. |
| - **Portability** — conversations and settings export via API. |
| - **Objection / restriction** — stop the agent; processing stops |
| (device disconnects, no further collection). |
|
|
| ## International transfers |
|
|
| - Processing and storage occur in the EU (Hetzner/Hostinger EU data |
| centres via the mona.expert infrastructure). No data is transferred to |
| third countries by mona.expert itself. |
| - AI provider calls (OpenAI, Anthropic, Google, …) are made **with your |
| own keys**, under the terms you hold with those providers. |
|
|
| ## Sub-processors |
|
|
| | Sub-processor | Purpose | |
| |---|---| |
| | Hosting (EU) | Infrastructure for the mona.expert cloud | |
| | AI providers (your keys) | Model inference on your instruction | |
|
|
| ## DPIA note |
|
|
| mona-agent processes telemetry and command output, not special-category |
| data. For typical use a DPIA is not required; a template is available on |
| request for enterprise deployments (`compliance@mona.expert`). |
|
|
| ## DPA |
|
|
| A data-processing agreement annex (Art. 28) is available for business |
| customers on request: `compliance@mona.expert`. |
|
|
