Privacy Policy

This Privacy Policy explains how Mondoir LLC FZ ("Mondoir", "we", "us", or "our"), a company registered in Meydan Freezone, Dubai, United Arab Emirates, collects, uses, discloses, and protects information about you when you visit our websites, use our mobile and web applications, or otherwise interact with us.

This Policy applies to all Mondoir properties and subsidiary services, including but not limited to mondoir.com, mondoir.art, artpraisal.com, sixgent.com, mondoir.ai, elizoid.com, workshop.mondoir.ai, the Mondoir Gallery iOS application, and any other product or service that links to this Policy (collectively, the "Services").

1. Information We Collect

We collect information in the following ways:

1.1 Information you provide

• Account information: name, email address, profile photo, username, password (hashed), date of birth where required, and language preferences.
• Identity information from third-party sign-in providers (e.g., Google, Apple, GitHub, Microsoft, X/Twitter, Facebook): we receive a unique identifier, basic profile information (name, email, profile picture), locale, and any other information you authorize the provider to share with us. We do not receive or store your password from these providers.
• Profile and content: biography, portfolio, artworks, uploads, listings, posts, comments, messages, voice recordings (e.g., AI artist interviews), and any other content you create or submit.
• Transactions: billing name, billing address, items purchased, shipping information, order history, and tax identifiers. Payment card and bank details are collected and processed by our payment processors (e.g., Stripe) and are not stored on our servers. Cryptocurrency transactions are recorded on the relevant public blockchain.
• Communications: emails, support requests, survey responses, and feedback you send to us.

1.2 Information collected automatically

• Device and log data: IP address, device identifiers, browser type and version, operating system, language, referring URLs, pages viewed, actions taken, timestamps, and crash and performance data.
• Cookies and similar technologies: we use cookies, local storage, pixels, and SDKs to keep you signed in, remember preferences, secure the Services, and measure usage.
• Approximate location: derived from your IP address; we do not collect precise GPS location unless you explicitly grant permission within an app.

1.3 Information from third parties

We may receive information from analytics, fraud-prevention, marketing, and integration partners (such as Instagram, Stripe, OpenAI, and shipping carriers) to operate and improve the Services.

2. Google OAuth and Third-Party Sign-In

When you sign in using Google, Apple, or another third-party identity provider, we use the OAuth 2.0 protocol to authenticate you. We request only the minimum scopes required to create and operate your account, typically your basic profile and verified email address.

Mondoir's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• only use Google user data to provide and improve user-facing features of the Services;
• do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger or acquisition with appropriate notice;
• do not use Google user data for serving advertisements, including retargeting or personalized advertising;
• do not allow humans to read Google user data unless we have your explicit consent, it is necessary for security purposes, to comply with applicable law, or the data is aggregated and used for internal operations in compliance with the policy;
• do not use Google user data — or data from any other OAuth provider — to develop, improve, or train generalized or third-party artificial intelligence or machine-learning models.

We request the minimum OAuth scopes necessary (typically openid, profile, and email). If a feature requires additional scopes (for example, calendar or drive access for an integration), we will request them in-context and explain why. You can revoke our access at any time from your provider's account settings, and you can request deletion of associated data by emailing privacy@mondoir.com.

You can review and revoke Mondoir's access to your Google account at any time at myaccount.google.com/permissions.

3. How We Use Information

We use the information we collect to:

• create and manage your account and authenticate you securely;
• provide, maintain, and improve the Services and develop new features;
• process transactions, fulfill orders, and provide customer support;
• personalize content and recommendations, including AI-powered search and matching;
• receive, assess, research, and fulfil appraisal requests submitted through Artpraisal;
• send transactional messages (receipts, security alerts, service notices) and, where permitted, marketing emails you can opt out of;
• monitor, prevent, and investigate fraud, abuse, and security incidents;
• comply with legal obligations and enforce our Terms of Service;
• conduct analytics and research to understand how the Services are used.

4. Legal Bases for Processing (EEA, UK, and Similar Jurisdictions)

Where applicable law (such as the UK GDPR or EU GDPR) requires a legal basis for processing your personal data, we rely on:

• Performance of a contract — to provide the Services you request;
• Legitimate interests — to operate, secure, and improve the Services, where our interests are not overridden by your rights;
• Consent — for marketing communications, certain cookies, and processing of sensitive data;
• Legal obligation — to comply with applicable laws.

5. AI Features

Several Services use artificial intelligence — for example, semantic search, voice interviews, image analysis, and content generation. When you use these features, your inputs (text prompts, images, audio recordings) may be processed by us and by trusted AI sub-processors (such as OpenAI) to generate the requested output. We do not knowingly use your private inputs to train third-party foundation models without your consent, and we configure providers to opt out of training on customer data where that option is available.

6. How We Share Information

We do not sell your personal information. We share information only in these situations:

• Service providers: hosting (e.g., Replit, cloud providers), databases, payment processors (e.g., Stripe), AI providers (e.g., OpenAI), analytics, email delivery, customer support, and shipping carriers, all under contractual confidentiality and data-protection obligations.
• Other users: profile information, listings, artworks, and posts you choose to make public are visible to other users.
• Buyers, sellers, and partners: where you transact through the Services, we share information necessary to complete the transaction (e.g., shipping address with the seller, contact information with the buyer).
• Legal and safety: where required by law, regulation, legal process, or government request, or to protect the rights, property, or safety of Mondoir, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy.
• With your consent or at your direction.

7. International Data Transfers

Mondoir is headquartered in the United Arab Emirates and operates globally. Your information may be transferred to, stored, and processed in countries other than your own, including jurisdictions that may not provide the same level of data protection as your home country. Where required, we put in place appropriate safeguards, such as Standard Contractual Clauses, to protect your information.

8. Data Retention

We retain personal information for as long as necessary to provide the Services, comply with our legal obligations (such as tax and accounting requirements), resolve disputes, and enforce our agreements. When information is no longer needed, we delete or anonymize it.

9. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (TLS), encryption at rest where appropriate, access controls, and routine security reviews. No security measure is perfect, and we cannot guarantee absolute security.

10. Your Rights and Choices

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, port, or restrict processing of your data, and to object to certain processing. You may also have the right to withdraw consent and to lodge a complaint with a supervisory authority.

You can exercise these rights by emailing privacy@mondoir.com. We will respond within the timeframe required by applicable law. We may need to verify your identity before fulfilling your request.

You can also manage many settings (profile information, notifications, connected accounts) directly inside your account, and unsubscribe from marketing emails using the link in any such email.

11. Cookies

We use strictly necessary cookies to operate the Services and, where permitted, analytics and preference cookies. You can control cookies through your browser settings. Disabling some cookies may affect your experience of the Services.

12. Children

The Services are not directed to children under the age of 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

13. Third-Party Links

The Services may contain links to websites, apps, or services operated by third parties. This Policy does not apply to those third parties, and we are not responsible for their practices. Please review their privacy policies before providing them with information.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice (such as an in-product notice or email). Your continued use of the Services after the changes take effect means you accept the updated Policy.

15. Contact Us

If you have any questions or concerns about this Policy or our privacy practices, please contact: