Montro Privacy Policy
1. Who we are
Montro is a third-party and AI governance platform operated by Outproduct Limited, a company based in Dublin, Ireland ("Montro", "we", "us"). This policy explains how we collect, use, store and share personal data when you use our platform, visit our website or interact with us.
Montro helps organisations keep a live record of the software, SaaS applications and AI tools they depend on, so they can assess risk and meet their regulatory obligations. To do this, we read data from the systems our clients connect to Montro.
Our role. We act in two capacities under the EU General Data Protection Regulation (GDPR):
- Controller for data about our clients' accounts, billing, website visitors and marketing contacts. We decide how this data is used.
- Processor for data we receive from the systems our clients connect to Montro (integration data). We process it only on our client's documented instructions, under our agreement with that client. For questions about how your employer uses Montro, please contact your employer first.
If you have questions about this policy, contact us at [email protected].
2. Who this policy covers
This policy applies to:
- Clients: organisations that subscribe to Montro.
- Users: employees and representatives of our clients who use the platform.
- People whose data appears in integration data: employees of our clients whose account, licence, sign-in or device details are read from connected systems.
- Website visitors and prospects: people who visit montro.io, sign up for updates or engage with our marketing.
3. Data we collect
Account data (clients). Organisation name, industry and size; billing and subscription details, including plan and renewal dates; the account owner's name, email address and contact details.
User data. Name, email address and role in Montro (for example, Admin or Application Owner); login times, features used and activity logs; assigned permissions.
Integration data. When a client connects an identity provider, productivity suite or cloud account (for example, Microsoft 365, Microsoft Entra ID, Okta, Google Workspace or a cloud provider), we read:
- users' names, email addresses, departments, roles and account status
- licences and administrator roles
- the third-party applications and AI tools users have signed in to or authorised, and the access those apps hold
- sign-in records and activity reports
- details of managed devices
- supplier, contract and usage details that clients add or that we derive from the above
Integrations are read-only by default. Section 5 sets out exactly what we access through Google Workspace.
Website visitor data. Details you give us through forms (for example, demo requests and newsletter sign-ups); IP address, device type and browser information collected through cookies and similar technologies (see section 8).
4. How we use data and our legal basis
| Purpose | Data used | Legal basis (GDPR Article 6) |
|---|---|---|
| Provide the platform: sign-in, registers, risk and regulatory mapping, reports | Account, user and integration data | Performance of our contract with the client; for integration data, the client's instructions as controller |
| Keep the platform secure and prevent misuse | User and integration data, logs | Legitimate interests in protecting our clients and our service |
| Improve and develop features | Usage data, in aggregated form where possible | Legitimate interests in improving our service |
| Billing and account administration | Account data | Performance of contract; legal obligation (tax and accounting records) |
| Service messages: account updates, notifications, renewal reminders | Account and user data | Performance of contract |
| Marketing emails and updates | Website and contact data | Consent, which you can withdraw at any time; or legitimate interests for existing client contacts, with an opt-out in every message |
| Non-essential cookies and analytics | Website visitor data | Consent |
| Respond to lawful requests and meet legal duties | Any relevant data | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 10).
We do not use personal data for automated decisions that have legal or similarly significant effects on you.
5. Google Workspace data
When a Google Workspace administrator connects Montro, we access the following through Google's APIs, only with the administrator's explicit authorisation:
- Users: names, email addresses, departments and account status
- Organisation details: Google customer ID and primary domain
- Licences and administrator roles held by each user
- Connected apps: third-party apps each user has authorised in their Google account, and the access those apps hold
- Activity reports: sign-in times and sign-ins to third-party apps
- Devices: managed Chromebooks and mobile devices that access company data
How we use it. We use this data only to provide and improve the features administrators see in Montro: the inventory of users, licences, admin roles, connected apps and devices; unused-licence insights; and security reviews. The integration is read-only by default. If an administrator turns on Take Action mode, Montro can assign or remove Google Workspace licences and create a missing user account, only when an administrator starts that action in Montro.
What we don't do. We don't read the content of emails, documents, Drive files, calendars or chats. We don't edit, suspend or delete existing users, change passwords or admin rights, remove connected apps, or change any device.
Sharing. We don't sell Google Workspace data, use it for advertising or marketing, or include it in the aggregated data described in section 6. We transfer it only to the sub-processors needed to host and run Montro, to comply with the law, or as part of a merger or acquisition, with prior notice to you.
Human access. Montro staff don't read Google Workspace data unless you ask us to (for example, for support), it is needed for security purposes, or the law requires it.
AI and machine learning. We don't use Google Workspace data to develop, improve or train generalised AI or machine-learning models.
Storage, retention and deletion. Google Workspace data is stored in the EU (Frankfurt) and encrypted in transit and at rest. We keep it while the integration is connected and delete it within 30 days of disconnection or the end of your contract. You can disconnect at any time from the Integrations section in Montro, or revoke Montro's access in your Google Admin console under Security > Access and data control > API controls. To request deletion sooner, email [email protected].
Montro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Sharing and where data is stored
We do not sell personal data. We share it only in these cases:
- Sub-processors. Trusted providers that help us run Montro, such as cloud hosting, email delivery, analytics and customer support. They act only on our instructions, under written agreements that include confidentiality and data protection terms. Our current list of sub-processors is available on request from [email protected]. Our current sub-processors are listed on our Trust & Security page.
- Payments. We use Stripe to manage subscriptions and payments. Stripe receives billing details, plan and payment history, and handles them under its own privacy policy.
- Within your organisation. Account administrators can see data about their organisation in Montro. Other users see only what their role allows.
- Legal requirements. We may disclose data where the law requires it, or in response to a valid request from a court or public authority.
- Business transfers. If Montro is involved in a merger, acquisition or sale, data may transfer to the parties involved. We will notify affected clients and users before this happens.
- Aggregated or anonymised data. We may use and share data that cannot identify any individual or organisation, for research and to improve our service. This never includes Google Workspace data (see section 5).
Where data is stored. We host Montro in the EU, in Frankfurt (AWS eu-central-1). Client data is not stored outside the EU. If a sub-processor needs to access personal data from outside the European Economic Area, we protect the transfer with the safeguards GDPR requires, such as the European Commission's Standard Contractual Clauses.
7. How long we keep data
| Data | How long we keep it |
|---|---|
| Account and user data | While the account is active, then 12 months after closure, unless the client asks us to delete it sooner |
| Integration data | While the integration is connected and the contract is active; deleted or returned within 30 days of disconnection or contract end, as the client instructs |
| Billing records | As long as Irish tax and company law requires (usually six years) |
| Marketing contacts | Until you unsubscribe or withdraw consent, or after 24 months without engagement |
| Website analytics | Up to 14 months |
When we no longer need data, we securely delete it or anonymise it so it can no longer identify anyone.
8. Cookies
We use cookies and similar technologies on our website:
- Essential cookies make the website and platform work. They don't need your consent.
- Analytics cookies help us understand how people use the website.
- Marketing cookies help us measure campaigns and show relevant ads.
We set analytics and marketing cookies only if you agree to them in our cookie banner. You can change your choice at any time from the cookie settings link in the website footer, or through your browser settings.
9. Security
We protect data with measures that include:
- encryption in transit and at rest
- role-based access, so only authorised staff can reach sensitive data
- continuous monitoring for threats
- independent penetration testing
We are working towards ISO 27001 certification. No system is completely secure, so we review and improve our security practices regularly. If a breach affects your personal data, we will notify the relevant parties as GDPR requires.
10. Your rights
Under GDPR, you have the right to:
- access the personal data we hold about you and get a copy
- correct data that is inaccurate or incomplete
- delete your data in certain circumstances
- restrict how we use your data in certain circumstances
- object to processing based on legitimate interests, and to direct marketing at any time
- port data you gave us to another provider, in a commonly used format
- withdraw consent at any time, where we rely on consent
To use any of these rights, email [email protected]. We will reply within one month. Where we act as a processor for your employer, we will pass your request to them and help them respond.
You also have the right to complain to the Data Protection Commission in Ireland (dataprotection.ie) or to the data protection authority where you live or work.
11. Changes to this policy
We may update this policy when our service or the law changes. We will post the new version here with a new effective date. If the changes are significant, we will also tell clients by email before they take effect.
