Privacy Policy

Monthwrap is client reporting software for marketing agencies. This policy explains what personal data we handle, why, who we share it with, and the choices you have.

Monthwrap handles personal data in two roles:

• About the agencies that use Monthwrap and their team members, we decide how the data is used. We are the "controller".
• About an agency's clients and their clients' customers (for example, a person who filled in a contact form on a client's website), the agency decides. We process it for the agency, under its instructions, as its "processor". If that's you, contact the business you got in touch with or its agency. We'll help them answer you.

Who we are

Monthwrap is run by Shazil Khan, Lahore, Pakistan. Questions about privacy go to support@monthwrap.com.

What we collect

Agency accounts and team members

Your name, email address and role, and your password, stored only as a one-way (Argon2) hash that can't be turned back into the password. Also the agency's name, time zone and report branding: logo, colour, sender name and reply-to address.

What agencies add about their clients

Client names, websites, industry, location, the client's contact person (name and email), retainer amount and account manager. Work log entries, the monthly checklist of deliverables, reports, and comments that the agency's team and the client's contacts write on reports.

Leads

For each lead: the person's name, email address and phone number when known, when it came in, how (call, form, booking and so on), where from, its status, the value of any job booked, and notes. Leads arrive from:

• Website forms, through the Monthwrap WordPress plugin or the Monthwrap website snippet. We receive the name, email and phone found in the submission, the form's name and the page address. We never receive the message itself or other answers. The snippet never reads login or password forms.
• Connected lead, call, booking and CRM services: Google Local Services Ads, Meta Lead Ads, GoHighLevel, HubSpot, Salesforce, Jobber, CallRail, CallTrackingMetrics, WhatConverts and Calendly. Depending on the service, these provide contact details, lead or booking identifiers, dates, attribution, status and selected call, appointment or request details. See Connected services and their data below.
• Lead webhooks (for example from Zapier or Make), spreadsheet imports, and entries typed in by the agency.

Website activity

From the WordPress plugin: the titles and addresses of posts and pages published or updated; the names and version numbers of plugins, themes and WordPress itself when they're updated; the site's address and the plugin's version; and an hourly check-in. From the website snippet: form submissions (as above) and check-ins.

Report views

When someone opens a report link, we record that it was opened, when, and how many times. Report-view analytics store counts and timestamps, not IP addresses or browser details. Operational web-server logs may contain request metadata such as IP addresses, requested URLs and browser information for security and troubleshooting.

Billing

Payments are handled by Paddle (see Who we share it with). We receive and keep Paddle's customer and subscription IDs, the plan, its status and renewal dates. We never see or store card details.

Support

What you send us when you email us.

Connected services and their data

An agency chooses which services to connect and which accounts, properties, stores, locations or spreadsheets belong to each client. Availability depends on the provider, the account's permissions and plan, and whether the integration is enabled. Listing a service here does not mean it is connected to your account.

We use the credentials you authorise or supply to check access, list available accounts and read the selected sources. We store access and refresh tokens, API keys and app secrets encrypted when needed, together with connection labels and the identifiers and names of sources linked to clients. We also store reporting dates, supported account currencies, sync status and the imported data described below. We do not ask for your password for the external service.

• Google Analytics 4, Google Search Console and Google Business Profile: property, website and business-location identifiers and names; website visits, visitors and key events; search clicks, impressions and positions; profile views, calls, website clicks and direction requests; and review counts, replies and ratings. Performance numbers are aggregates. Review responses may be read to calculate these totals.
• Advertising: Google Ads, Google Local Services Ads, Meta Ads (including Lead Ads), Microsoft Advertising, LinkedIn Ads, TikTok Ads, Pinterest Ads, Snapchat Ads, Reddit Ads and ChatGPT Ads. We read account identifiers and names, currency, and available advertising totals such as spend, impressions, clicks, conversions and attributed value. Local Services Ads and Meta Lead Ads also provide lead records. Meta form responses are read to extract the supported contact and lead fields; these records are personal data, not just anonymous totals.
• Social and video: Facebook Pages, Instagram, LinkedIn Pages, TikTok organic and Pinterest organic provide account, Page or profile identifiers and names, and available reach, view, follower, engagement or click totals. Video or post identifiers and publishing dates may be read to calculate those totals. YouTube provides channel identifiers, names and channel performance totals; see YouTube API Services.
• Email marketing: Mailchimp, Klaviyo, Constant Contact and ActiveCampaign provide account and campaign information and supported campaign totals, such as deliveries, opens, clicks, unsubscribes or attributed orders and revenue. These reporting integrations do not send campaigns from Monthwrap.
• CRM and field service: GoHighLevel, HubSpot, Salesforce and Jobber provide account or organisation details and supported contact, lead or request records, including identifiers, names, email addresses, phone numbers, creation dates, sources and selected status or request details. We use these to build the client's lead history and reporting totals.
• Calls and bookings: CallRail, CallTrackingMetrics, WhatConverts and Calendly provide account, company, profile or user identifiers, and supported caller, contact or invitee details, event dates, attribution and call or booking status. Call duration, answered status and appointment details may be included in a lead's notes. The current connectors do not import call audio or transcripts.
• Stores: Shopify and WooCommerce provide store identifiers, names, currency, and order dates, status and amounts used to calculate sales and order totals. Provider responses may include additional order information while being processed; Monthwrap stores the reporting totals rather than a copy of the store's customer directory. Shopify also provides product, page, blog-post and theme identifiers, titles, links and activity dates for the work log.
• Search, SEO and website analytics: Bing Webmaster Tools, Microsoft Clarity, Semrush, Ahrefs, SE Ranking and BrightLocal provide site, domain, project or location information and supported traffic, search, backlink, ranking, local-search-grid, review or website-engagement summaries. Monthwrap's Clarity integration reads aggregate reports, not session recordings.
• Your own numbers and imports: Google Sheets reads the spreadsheet and optional tab you identify, including the cells needed to import dates, labels and numbers. Monthwrap does not browse your Drive to show a file picker. CSV and Excel uploads, direct webhooks, Zapier and Make can supply leads or reporting numbers, depending on the import or endpoint you choose. Only send data that you have permission to use.

Built-in rank tracking and map grids: when used, we send the client's domain or business identifier, chosen keywords, search engine, device, language and search location or grid coordinates to DataForSEO to obtain rankings. We store settings, search results, positions, dates and usage. Map backgrounds load from OpenStreetMap; those requests disclose your IP address and the requested map area to its tile service. They do not send your Monthwrap credentials or lead list.

Website uptime: we check registered website addresses and store check times, response status, response time and outages. WordPress and snippet collection is described under What we collect.

We use these connections for the agency's dashboards, lead and work records, reporting history, and reports it chooses to share. The reporting connectors read information; they do not publish social posts, change ad campaigns, send marketing emails or edit store orders. An external service may use broader permission names for the access needed to read its reporting data.

How we use it

• To run Monthwrap: to sign you in, show dashboards, build and send reports, count leads without double-counting repeats, sync connected accounts, and send the emails the service needs. These include invitations, password resets, alerts when a connected account stops working, and trial reminders.
• To keep it secure and working: to prevent abuse, investigate problems and fix bugs.
• For billing and support: to manage your plan and answer your messages.

We don't sell personal data, use it for advertising, or use customer data to train AI models.

Legal bases (for people in the EU, UK and similar places): we process agency and team data to provide the service you signed up for (contract); for security, support and reliability (our legitimate interests); and where the law requires it (legal obligation). For data we process for an agency, the agency is responsible for having a legal basis.

AI features

Monthwrap can suggest wording for a report. When someone uses this, we send that report's facts and their instructions to Anthropic, which provides the AI model. The facts include the agency's and client's names, the month's totals (including figures from connected accounts), work log and checklist titles, and report text. We do not include individual lead contact records in the report facts. Free-text instructions, work titles or report text can contain personal data if you put it there, so do not include information you do not want processed for that feature. Under its commercial terms, Anthropic does not use this data to train its models.

The AI only suggests. Nothing it writes is saved or sent to a client unless a person accepts it. Automated checks help flag unsupported numbers in proposed report changes, but they do not verify every statement in a chat response. Review the draft and its figures before using it.

Google user data

When an agency connects a Google account, Monthwrap uses the authorised Google Analytics, Google Search Console, Google Business Profile, Google Ads, Google Local Services Ads, Google Sheets or YouTube connection to read the data needed for its chosen reporting features. Some Google permissions have broader names, such as Business Profile management; Monthwrap does not use them to edit your profiles or campaigns. We use the access to:

• list the agency's properties, sites, locations or ad accounts, so the agency can match each one to a client; and
• read performance and review totals, supported Local Services Ads leads, the spreadsheet data you identify, or YouTube channel totals, to show in the agency's dashboards and reports and to keep the client's history.

We store the access and refresh tokens encrypted, and the totals in our database. The totals may be included in the facts sent to Anthropic when the agency uses the AI features described above, only to draft that agency's own report. We don't use Google user data for advertising, and we don't sell it. We don't use it to develop, improve or train general AI or machine learning models. People at Monthwrap don't read it, except with your permission, for security or legal reasons, or when it's aggregated and anonymised.

You can revoke Monthwrap's Google access at any time in Google's security settings. Disconnecting in Monthwrap and deleting retained records are described under Disconnecting and deleting your data.

Monthwrap's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services

Monthwrap uses YouTube API Services when you connect a YouTube channel. We access the channel's identifier and name and authorised daily analytics, including views, watch time, likes and subscriber gains or losses. We store channel reporting totals to build the agency's dashboards and reports. We do not upload videos, post comments or collect individual viewers' identities through this integration.

These figures may be shared with the people the agency gives access to its reports and, when the agency uses AI report drafting, with Anthropic as described above. The integration does not serve YouTube advertisements or embed a YouTube player. Browser storage is described under Cookies and browser storage.

The Google Privacy Policy applies to Google's handling of information. You can revoke Monthwrap's access through Google's security settings. To request deletion of retained YouTube data, including copies in saved reports, follow the deletion instructions or email support@monthwrap.com. Disconnecting alone does not erase every retained report copy. You can use the same email address for questions or complaints about this integration's privacy practices.

Disconnecting and deleting your data

1. Stop a connection in Monthwrap: an agency owner or admin can open Sources, choose Manage for the account, then Disconnect account and confirm. This removes the stored connection credentials, its client-source links and the daily metric rows attached to those links. It stops future syncs for that connection.
2. Revoke access at the provider too: use the provider's connected-app settings or revoke its API key. For Google and YouTube, use Google's security settings. For Meta, open Facebook Settings & privacy → Settings → Business integrations, select Monthwrap and remove it. The provider controls its own records and permissions; removing its access does not itself delete Monthwrap's retained records.
3. Request deletion of retained data: email support@monthwrap.com with your agency or business name, the connected platform and account, and what you want deleted. For Meta data, identify the relevant Facebook Page, Instagram account or ad account if known. For YouTube, identify the channel if known. Do not send passwords, access tokens or API keys. We may need to verify your identity and authority before deleting someone else's records.

What disconnecting leaves behind: imported leads and work entries, text already copied into drafts, and copies in sent reports can remain in the agency's records. Disconnecting a source or revoking access is not the same as deleting the client or closing the agency account. Include these retained copies in your deletion request. Copies already downloaded or received by other people are outside Monthwrap's control; the agency should ask those recipients to delete them where appropriate.

We respond to privacy and deletion requests within 30 days, or sooner where applicable law or platform requirements require. We explain any identity checks, lawful retention requirement or other reason a request cannot be completed as asked. If your data was supplied by a business or its agency, contact that business as well; we help it carry out its instructions. Backup retention is described below.

Who we share it with

We use these companies to run Monthwrap. Each gets only what it needs for its job:

Data also flows from the services an agency connects on its instruction. Their own privacy policies govern the data they hold. An agency's authorised team members can access information according to their roles, and reports go to whoever the agency shares them with. Webhooks, Zapier and Make process the fields the agency configures before passing them to Monthwrap.

We may also disclose data when the law requires it, or to protect people's safety or our rights. If Monthwrap is sold or merged, data would move to the new owner under this policy, and we'd tell account owners first. For Google API data, we obtain explicit prior consent where its Limited Use rules require it before a transfer connected with a sale or merger.

Where it's stored

Monthwrap's database and servers are in Germany, in the EU. Monthwrap is run from Pakistan, and some of the companies above are in the UK or the US. When personal data from the EU or UK goes to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or equivalent safeguards offered by those companies.

Keeping and deleting data

• Accounts: kept while the account is open. To close an agency account, email us. We delete the agency's data within 30 days, except records we must keep for tax and accounting. Paddle keeps its own billing records.
• Clients: when an agency deletes a client, that client's records, leads, work log and reports go with it.
• Connected services: we keep the connection and its reporting history while the agency uses it, until the relevant data is removed. Disconnecting and deleting your data explains which records disconnecting removes and which may remain. Revoking access at an external provider can stop syncing without deleting historical records in Monthwrap.
• Backups: daily database backups are kept separately from the live database. Server backups have restricted access; offsite copies are encrypted. The backup system is configured for a rolling retention period of about 30 days. Deleted live records may remain in a backup until that backup expires; disconnecting a source does not immediately erase backups.

Security

Connections to the Monthwrap app and API use HTTPS. Encryption for database connections depends on the selected connection settings. Passwords are stored only as Argon2 hashes. Access tokens and API keys for connected accounts are encrypted in the database, and website keys are stored only as hashes. Inside an agency, roles control who can see and change what. Read our Security page for details about access, connections, and shared reports. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.

Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, correct it, delete it, get a copy to take elsewhere, object to or limit how we use it, and complain to your data protection authority. Email support@monthwrap.com and we'll answer within 30 days. We may need to confirm it's you first.

If your data is in Monthwrap because a business you contacted works with an agency that uses Monthwrap, please ask that business. They decide how it's used, and we'll help them answer.

California residents: we don't sell personal information or share it for cross-context behavioural advertising.

Cookies and browser storage

The public Monthwrap website keeps optional analytics off until you choose Accept analytics or enable Google Analytics in Cookie preferences. Rejecting optional cookies does not limit access to the website. We remember your choice in local browser storage for 180 days and ask again when it expires. We also use local browser storage to remember your motion preference. If your browser blocks this storage, your privacy choice applies only to the current page.

If you accept, Google Analytics measures website visits, page views, and clicks on links such as creating a workspace, viewing a sample report, or getting in touch. Our custom click events use fixed action labels and page paths; they do not include email contents or visitor-written text. The Google tag sends website usage data to Google and uses first-party cookies, including _ga and _ga_ZM849QCTBJ, to distinguish visitors and sessions. See Google's Analytics cookie information and Google's Privacy Policy.

Use Cookie preferences in the footer to change or withdraw your choice. Turning analytics off stops further measurement and removes this website's analytics cookies. When the changed choice can be saved, the page refreshes to unload Google's tag. Withdrawing consent does not delete information already sent to Google. You can also clear cookies and local storage through your browser settings.

The Monthwrap app sets no cookies and has no advertising or analytics trackers. It uses browser session storage to keep you signed in and browser storage for report drafts and interface preferences. Drafts can contain client and report information. You can clear this storage in your browser; doing so can sign you out and remove unsaved drafts. When you follow a provider's sign-in link or load an external map, that provider handles its requests under its own privacy policy.

Children

Monthwrap is a tool for businesses and isn't meant for anyone under 16.

Changes

If we change this policy, we'll post the new version here with a new date. For changes that matter, we'll also email account owners at least 14 days before they take effect.

Contact

support@monthwrap.com
Shazil Khan
Lahore, Pakistan