PLAN MONSTER PRIVACY POLICY

Effective Date: May 1 2026

This Privacy Policy describes how Monster collects, uses, and shares Personal Data in connection with the Offerings

Personal Data Collected

Monster collects the following categories of Personal Data:

• Account information, including name, email, business name, role, phone number, and password
• Profile and verification information you provide
• Content you submit, including User Content and Inputs as defined in the Terms of Use (available at https://planmonster.com/terms)
• Communications with Monster, including support messages, sales calls, interview transcripts, and feedback
• Google API Data, if you connect a Google account, as described in the Google API Data section below
• Usage Data, including device information, IP address, browser and operating system, log data, clickstream, query history, and feature usage
• Payment and billing information, processed by third party payment processors
• Information from third party sources, including referral partners, public business records, and identity verification providers

Purposes of Processing

Monster processes Personal Data to:

• Provide, operate, secure, and improve the Offerings
• Authenticate users and protect accounts from unauthorized access
• Communicate about the Offerings, including service updates and transactional messages
• Send marketing communications, subject to your right to opt out
• Comply with legal obligations
• Enforce these Terms and protect Monster, its users, and third parties from fraud, abuse, and other unlawful activity
• Analyze usage and develop new features
• Conduct outbound trade citation notifications based exclusively on publicly available sources, in accordance with the Terms of Use (available at https://planmonster.com/terms)

Sharing

Monster shares Personal Data with:

• Service providers operating Monster infrastructure, including hosting, analytics, customer support, payment processing, email and SMS delivery, identity verification, and AI model providers
• Professional advisors, including legal, accounting, and insurance advisors, under confidentiality obligations
• Authorities and parties to legal proceedings, when required by law or to protect rights and safety
• Acquirers, in the event of a merger, acquisition, financing, reorganization, or asset sale, with notice to affected users
• Other parties with your consent or at your direction

Monster does not sell Personal Data in the colloquial sense. Certain disclosures to service providers and partners may constitute a sale or share under the California Consumer Privacy Act. California residents may exercise opt out rights as described below. Monster does not sell or share Google API Data under any definition.

Retention

Monster retains Personal Data for as long as necessary to provide the Offerings, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention practices include:

• Account data, retained for the duration of the account plus seven years
• Google API Data, deleted within thirty days of disconnection, as described in the Google API Data section below
• Usage Data and Derived Data, retained in aggregated or de identified form indefinitely
• Communications and support records, retained for seven years
• Backups, deleted on the standard backup rotation cycle, typically within ninety days

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the Personal Data Monster holds about you
• Correct inaccurate Personal Data
• Delete Personal Data, subject to retention obligations and legitimate business needs
• Port Personal Data to another provider
• Object to or restrict certain processing
• Opt out of marketing communications
• Opt out of sale or sharing of Personal Data under the CCPA
• Withdraw consent where processing is based on consent

To exercise these rights, contact hello@planmonster.com. Monster will verify your identity before fulfilling requests and will respond within the timeframes required by applicable law.

California Residents

California residents have specific rights under the California Consumer Privacy Act, including the rights listed above and the right to non discrimination for exercising those rights. Monster does not knowingly process Personal Data of California residents under sixteen for sale or sharing.

Children

The Offerings are not directed to individuals under eighteen. Monster does not knowingly collect Personal Data from individuals under eighteen. If you believe Monster has collected such data, contact hello@planmonster.com and Monster will delete it.

International Transfers

Monster operates from the United States. If you access the Offerings from outside the United States, your Personal Data will be transferred to and processed in the United States. By using the Offerings, you consent to this transfer. Where required by applicable law, Monster relies on appropriate transfer mechanisms, including Standard Contractual Clauses.

Security

Monster maintains administrative, technical, and physical safeguards designed to protect Personal Data. No system is fully secure. Monster does not warrant the security of Personal Data and is not liable for unauthorized access not caused by Monster's gross negligence or willful misconduct.

Cookies and Tracking

The Offerings use cookies and similar technologies for authentication, security, analytics, and feature delivery. You may control cookies through your browser settings. Some features will not function without cookies.

Changes to this Notice

Monster may update this Notice from time to time. Material changes will be communicated by email to registered users or by prominent notice within the Offerings.

Privacy Contact

Privacy questions and requests: hello@planmonster.com

GOOGLE API DATA

Plan Monster offers an optional feature that connects to your Google account to answer questions from your existing project mail. This connection uses Google's openid, email, and profile identity permissions plus the gmail.readonly permission. That permission lets Plan Monster search and read your email messages, threads, labels, and attachments, including PDF and Office files attached to those messages. Plan Monster does not send, delete, label, compose, or modify mail. Plan Monster does not access Google Drive.

If you choose to connect your Google account, we use your Gmail data to answer questions about your project mail and to identify invoices, receipts, purchase orders, and payments in that mailbox. We may store processed summaries and extracted information on our servers to provide the service. We do not use Gmail data for ads or model training.

We process your Google API Data using artificial intelligence systems. This processing involves service providers that operate our AI infrastructure. These service providers process your data solely to provide the Plan Monster service, do not retain your data beyond the duration of the API call (zero retention API tier), and do not use your data to train their own models. The current list of subprocessors is published at https://planmonster.com/subprocessors.

You can disconnect your Google account at any time through your Plan Monster account settings or by contacting us at hello@planmonster.com. You can also revoke Plan Monster's access directly through your Google Account permissions page at https://myaccount.google.com/permissions. When you disconnect your Google account, we will delete the Google API Data we have stored within thirty days.

GOOGLE API SERVICES USER DATA POLICY COMPLIANCE

Plan Monster's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Specifically:

Plan Monster only uses access to Google user data to provide and improve the Plan Monster service for the user who granted access.

Plan Monster does not use Google user data to train, fine tune, evaluate, benchmark, or develop any artificial intelligence model, machine learning model, knowledge engine, or other product or feature beyond the user facing features delivered to the user who granted access.

Plan Monster does not transfer Google user data to third parties except as necessary to provide the service (through our AI processing infrastructure under data processing agreements that prohibit any other use), to comply with applicable laws, or as part of a merger, acquisition, or asset sale with notice to users.

Plan Monster does not use Google user data to serve advertisements.

Plan Monster does not permit humans to read Google user data unless the user has provided affirmative consent for specific messages, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymized and can no longer be associated with an individual user.

Plan Monster does not use Google user data for marketing, sales outreach, citation notifications, lead enrichment, public display, or any communication directed to any party other than the user who granted access. Plan Monster's outbound trade citation feature operates exclusively on publicly available web sources and does not access Google user data.

Plan Monster does not sell, license, or share Google user data with any third party for any purpose.