1. Scope and controller
This policy applies to the Montesque website and application. Montesque is the controller of personal data collected directly through the service. If an organization provides Montesque to you, that organization may be the controller and Montesque may act as its processor.
2. Data we collect
- Account data, including your name, email address, and authentication records.
- Optional profile data you provide, such as age, location, education, household, income range, and insurance information.
- Content and activity, including conversations, prompts, saved legislation, preferences, and feature usage.
- Technical data needed to operate and secure the service, including IP address, request metadata, device/browser information, and security logs.
- Support or privacy correspondence you send to us.
Please do not submit highly sensitive information that is unnecessary for your use of Montesque.
3. How we use data
- Provide accounts, personalized civic explanations, and requested features.
- Respond to support, privacy, and security requests.
- Protect Montesque from abuse, fraud, and unauthorized access.
- Maintain, troubleshoot, and improve reliability and accessibility.
- Comply with legal obligations and enforce our terms.
Where GDPR applies, these uses rely on performance of our contract, legitimate interests in operating and securing the service, consent where requested, and compliance with legal obligations.
4. AI processing and personalization
Prompts and relevant conversation context are sent to Google's Gemini service to generate responses. If personalization is enabled, relevant profile details may also be included. You can disable personalization or clear stored profile details in Settings. Do not rely on AI output as legal, financial, medical, or voting advice.
5. Service providers and disclosures
We use providers only as needed to operate Montesque, including:
- Supabase for authentication, database, and account infrastructure.
- Google Gemini for AI generation and embeddings.
- PostHog for optional product analytics and privacy-masked session replay after consent.
- Geocodio, Congress.gov, and news providers for requested civic information.
- Hosting, network, monitoring, and security providers used for service delivery.
We may also disclose data when legally required, to protect rights or safety, or as part of a business transaction. Montesque does not sell personal data or use it for cross-context behavioral advertising.
7. Retention and security
Account and user content are retained while your account is active and deleted when you delete the account, subject to limited backup, fraud-prevention, dispute, and legal-retention needs. Security controls reduce risk but no online service can guarantee absolute security.
8. Your choices and rights
Settings lets you download a portable JSON copy of your data, disable personalization, clear profile details, or permanently delete your account. Depending on your location, you may also request access, correction, deletion, restriction, portability, or objection, and withdraw consent without affecting prior processing. You may complain to your local data protection authority.
See the Settings page for self-service controls.
9. International transfers and children
Providers may process data outside your country. Where required, appropriate transfer safeguards are used. Montesque is not directed to children under 13, and we do not knowingly collect their personal data.
10. Contact and changes
For a private privacy or security request, use the private disclosure channel. We may update this policy as Montesque changes and will revise the effective date when material updates are published.