# GDPR — Privacy & Data Processing

How mona.expert processes personal data, and how the open-source client
minimises it. This document supports both end-user transparency
(Art. 13/14) and customer due diligence (Art. 28 annex-ready).

## Roles

- **mona.expert** — data controller for account data; data processor
  where customers operate the platform on their own behalf.
- **You (the user)** — controller of your own device and of the
  commands you issue.

## Processing activities (Art. 30 summary)

| Purpose | Categories | Legal basis | Retention |
|---|---|---|---|
| Account & authentication | Email, username, API token, session | Contract (Art. 6(1)(b)) | Account lifetime + 30 days |
| Agent operation & audit | Task text, tool results, audit events, conversation | Contract / legitimate interest (security) | 180-day rolling audit; conversation until deleted |
| Device telemetry | Hostname, OS, CPU/memory/disk/load metrics, IP | Contract (service operation) | Latest snapshot + 180 samples (~30 min) |
| Security & abuse prevention | IP, rate-limit counters, timestamps | Legitimate interest (Art. 6(1)(f)) | 24 h (rate limits), 180 days (audit) |

## Data minimisation by design

- **The device stores no provider keys.** Only a mona.expert token
  lives locally (`~/.mona-agent/credentials.json`, mode 0600).
- **Telemetry is system metrics only** — no keystrokes, no screen
  content, no file contents. Command results are sent only because you
  asked the agent to run them.
- **Egress-only networking** — the daemon opens no inbound ports and
  sends nothing to third parties.

## Security of processing (Art. 32)

- AES-256-GCM encryption at rest for all key material
- HTTPS/TLS for all traffic
- Per-user bearer tokens + session auth + CSRF protection
- Least-privilege tool sandbox, allowlisted shell
- Full audit trail of every action

## Data subject rights

- **Access / rectification / erasure** — the dashboard shows your
  agents, conversations and audit entries; delete them there or write to
  `privacy@mona.expert`.
- **Portability** — conversations and settings export via API.
- **Objection / restriction** — stop the agent; processing stops
  (device disconnects, no further collection).

## International transfers

- Processing and storage occur in the EU (Hetzner/Hostinger EU data
  centres via the mona.expert infrastructure). No data is transferred to
  third countries by mona.expert itself.
- AI provider calls (OpenAI, Anthropic, Google, …) are made **with your
  own keys**, under the terms you hold with those providers.

## Sub-processors

| Sub-processor | Purpose |
|---|---|
| Hosting (EU) | Infrastructure for the mona.expert cloud |
| AI providers (your keys) | Model inference on your instruction |

## DPIA note

mona-agent processes telemetry and command output, not special-category
data. For typical use a DPIA is not required; a template is available on
request for enterprise deployments (`compliance@mona.expert`).

## DPA

A data-processing agreement annex (Art. 28) is available for business
customers on request: `compliance@mona.expert`.