Privacy Policy

Monolith is a business decision-support platform operated by Mark Shapiro ("Monolith," "we," "us," or "our"). This Policy explains how information is collected, used, disclosed, and protected when authorized users access Monolith.

1. Information we collect

Depending on the features used, we may collect:

• Account and organization information: name, username, email address, role, company, permissions, account preferences, and onboarding status.
• Business and relationship information: companies, contacts, relationships, meetings, communications, notes, clients, prospects, and associated records entered by users or imported by an authorized organization.
• Opportunity and decision information: procurement opportunities, searches, screening results, verdicts, assessments, actions, institutional knowledge, investment cases, diligence materials, financial assumptions, and decisions.
• Documents and AI content: uploaded files, pasted text, source links, extracted text and facts, prompts assembled by the service, model responses, citations, reviews, and user corrections.
• Public-source information: records from sources such as SAM.gov, USAspending, SBIR/STTR, SEC EDGAR, USPTO, company websites, and other reviewed public sources.
• Feedback reports: an optional comment, a screenshot you choose to submit, and a snapshot of recent browser diagnostics, linked to your account and organization. Reports are available through the platform Owner’s feedback inbox.
• Technical and security information: IP address, browser and device information, session and security events, audit history, feature usage, errors, request timing, and authentication records. For authenticated activity, routine logs may include an internal user ID, role, active organization ID, page or endpoint path, request method, response status, duration, and timestamp. Passwords are stored as one-way hashes, not as readable passwords.

2. Activity logging

Monolith records successful sign-ins and sign-outs, security events, changes to business records, aggregate daily usage, and limited request metadata. We use these records to secure accounts, enforce organization access, provide administrators with audit history, investigate errors, and improve reliability. Routine request logs are designed not to contain passwords, form bodies, uploaded document contents, business-record text, or AI prompts and responses. Information submitted to a feature may still be stored as an authorized business record or AI evidence item as described elsewhere in this Policy.

Local diagnostic buffer and feedback

While you use signed-in web pages, Monolith keeps a rolling diagnostic buffer for up to the most recent 60 seconds in the current browser tab. It uses memory and tab session storage so recent activity can remain available as you move between Monolith pages. The buffer is limited to 120 events and approximately 24 KB; older entries may be overwritten sooner when these limits are reached. Entries older than one minute are removed while the page is active and whenever the buffer is read or restored. If a tab is suspended, expired entries are discarded when it resumes. The buffer is cleared on sign-out, on signed-out pages, and when the active account or organization changes.

This buffer contains technical metadata: generalized page and endpoint paths; request methods, response codes, durations, and transport type; page and resource load timings; long browser tasks where supported; error classes and application script file/line locations; basic button, link, form, and selection interactions; scroll position, viewport size, connection changes, and tab visibility. It does not record typed text, field values, control labels, keystrokes, raw console or error messages, request or response bodies, headers, passwords, tokens, cookies, or the contents of other browser storage. URL queries, fragments, external destinations, and unrecognized route segments are excluded or replaced with placeholders.

The rolling buffer is local to your browser and is not automatically uploaded as diagnostic telemetry. Routine server activity logging described above operates separately. Opening Feedback freezes a copy of the preceding minute for that report and prepares a single screenshot; it does not continuously record your screen. You can review the attached diagnostics, review, replace, or remove the screenshot, and add an optional comment. The frozen copy remains in the open draft while you write, even as the running buffer overwrites older events. It is sent to Monolith only when you choose Send feedback, and it is discarded if you cancel the draft or leave the page.

Automatic screenshots hide form fields and designated private regions, but may contain other visible business or personal information. Review the image before sending; manually attached images are not automatically redacted. Submitted reports are stored with Monolith’s existing hosting and database providers and are accessible to the platform Owner for troubleshooting and product improvement. They are not sent to an AI model by this feedback feature.

3. How we use information

We use information to operate and secure Monolith; authenticate users; enforce organization and role permissions; provide Partner Network, SAM Dashboard, assessment, memory, and fund-intelligence workflows; extract and organize evidence; generate user-requested AI analysis; maintain audit history; diagnose errors and performance; improve the service; communicate about accounts or security; and comply with legal obligations.

4. AI processing

When an authorized user invokes an AI feature, relevant prompts, records, and document text may be sent through OpenRouter to the selected model provider. Routine navigation, rules-based scoring, Partner Network operations, and searches do not require premium AI processing. AI output can be incomplete or incorrect and must be reviewed before use. Do not upload information your organization is not authorized to process or disclose.

5. How information is disclosed

We may disclose information to service providers that help operate Monolith, including Render for application hosting, Supabase and PostgreSQL infrastructure for data storage, Resend for account access, invitation, and recovery email, and OpenRouter plus an explicitly approved model processor for user-requested AI processing. These providers process information under their own terms and privacy practices. We may also disclose information when required by law, to protect rights or safety, to investigate misuse, or as part of a merger, financing, acquisition, or transfer of the service.

We do not sell personal information or share it for cross-context behavioral advertising.

6. Organization-controlled data

Much of the information in Monolith is business data controlled by the organization that invited the user. That organization determines which records its users may enter and access. Requests concerning organization-controlled data may be referred to the relevant organization administrator.

7. Cookies and similar technology

Monolith uses essential cookies and browser storage for secure sessions, cross-site request-forgery protection, display preferences, and tutorial progress. If “Keep me signed in” is selected, the secure session can remain active for up to 30 days unless the user signs out or the session is revoked. We do not use advertising cookies or cross-site behavioral tracking. Because we do not track users for advertising across unrelated sites, Monolith does not respond differently to browser "Do Not Track" signals.

8. Retention

We retain information while an account or organization is active and as reasonably needed to provide the service, preserve authorized audit history, secure and troubleshoot the platform, maintain backups, resolve disputes, and meet legal obligations. Operational request logs are retained according to the hosting and security log cycle; daily usage aggregates and audit events may be retained longer for account administration, security, and record integrity. Retention can vary by record type and organization instructions. Information may remain in backups until the applicable backup cycle completes.

Unsubmitted diagnostic events follow the short local buffer lifetime described above, except for a frozen feedback draft while it remains open. Submitted feedback reports, including attached screenshots and diagnostics, are retained under the service’s troubleshooting and record-retention practices; marking a report Reviewed or Resolved does not delete it. Privacy and deletion requests can be made using the contact details below.

9. Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, tenant and role restrictions, secure sessions, password hashing, audit logging, encrypted network connections in hosted environments, and restricted credentials. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

10. Your choices and requests

Authorized users may review and correct many records in Monolith. To request access, correction, deletion, or an export of personal information, or to ask a privacy question, contact Info@jmshapiro.com. We may need to verify identity and authority before acting. Some information may be retained where required for security, audit integrity, legal obligations, or another permitted purpose.

11. California notice

California residents may request information about the categories of personal information collected and disclosed, and may request access, correction, or deletion where applicable. The categories described in Section 1 are collected for the business purposes in Sections 2 and 3 and may be disclosed to the service-provider categories in Section 5. Monolith does not sell personal information or share it for cross-context behavioral advertising.

12. Children and international access

Monolith is a business service for users age 18 or older and is not directed to children. The service is operated from the United States. Users outside the United States understand that information may be processed in the United States and other locations used by our service providers.

13. Changes to this Policy

We may update this Policy as Monolith changes. We will post the revised version here with a new effective date and provide additional notice when a material change requires it.

14. Contact

Privacy questions and requests: Info@jmshapiro.com.