Privacy Policy — Pure Monograph

Last updated: 3 September 2026 Operated by: Pure Monograph ("we," "us"), Vancouver, British Columbia, Canada.

1. Who this applies to

This policy covers puremonograph.ai and the Pure Monograph platform. It applies to visitors, account holders, and organizations using the service in Canada, the United States, and the European Economic Area / United Kingdom.

2. The short version

• Lab files you upload leave the browser. They are sent to our FastAPI backend and stored on a Railway volume. Extracted text is stored in our database. There is no in-product delete button; email legal@puremonograph.ai to request deletion. See Section 4.
• We never use your data to train models — ours or anyone's.
• We collect the minimum account and billing information needed to run the service.
• You have rights over your personal data, and we honour them regardless of where you live.

3. Information we collect

Account data: name, email, organization, and authentication credentials (passwords are stored only as salted hashes). Billing data: processed by our payment provider (Stripe). We store a customer reference and subscription status, not your full card number. Usage data: which modules you run, timestamps, and error logs — used to operate, secure, and bill the service. Communications: messages you send us by email. Technical data: IP address, browser type, and similar, via essential cookies and security logging.

4. Uploaded lab files — how they are handled

When you upload a lab file through the platform (POST /api/upload/lab-data), that file is treated as your confidential material. The product does not keep it in the browser.

• The raw file is written to a Railway volume at /data/uploads/{user_id}/{timestamp}_{filename} (local development falls back to _data/uploads).
• We extract text from the file and store it in our SQLite lab_uploads table, with a path back to the raw file.
• If you attach the upload to a conversation, the first 20,000 characters of extracted text may be appended to that thread.
• Accepted types today: CSV, XLSX, XLS, TXT, and PDF, up to 10 MB.
• There is no delete endpoint. To request deletion of an uploaded file, extracted text, or an account, email legal@puremonograph.ai.
• Model engines: if you use a managed generation engine (rather than bringing your own key), the content of your query — which may include extracted upload text already on the thread — is transmitted to the third-party model provider (e.g., xAI) to generate output, and is handled under that provider's terms and privacy policy. If you use your own API key (BYOK), that transmission is governed by your own agreement with the provider. Pure Monograph still retains the file and extracted text as described above.
• We do not use any of this data to train, fine-tune, or improve any model or product.
• Outputs you choose to save to a project are retained to provide pause/resume, for as long as you keep the project.

5. How we use information

We use collected data to: provide and maintain the service; authenticate you; process payments; provide support; secure the platform and prevent abuse; comply with legal obligations; and send service-related (not marketing) messages unless you opt in.

We rely on the following legal bases under GDPR: performance of a contract (providing the service), legitimate interests (security, service improvement that does not involve training on your uploaded files), consent (any optional marketing), and legal obligation.

6. Sharing

We do not sell personal data. We share it only with:

• Service providers who process data on our behalf under contract (payment processing, hosting on Railway, email delivery, error monitoring), bound to confidentiality and data-protection terms.
• Model providers, only as described in Section 4.
• Authorities, where required by valid legal process.
• A successor, in the event of a merger or acquisition, subject to this policy.

7. International transfers

We operate from Canada and use service providers that may process data in the US and elsewhere. For EEA/UK personal data, transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses) or an adequacy decision where available. Canada has an EU adequacy decision for commercial organizations under PIPEDA.

8. Retention

Account and billing records are kept while your account is active and for the period required by law after closure. Usage logs are kept for a limited operational period. Uploaded lab files and extracted text remain on the Railway volume and in lab_uploads until you request deletion by emailing legal@puremonograph.ai or close your account and we complete that request. Saved project outputs persist until you delete them or close your account.

9. Your rights

Regardless of location, you may request to access, correct, delete, or export your personal data, and to object to or restrict certain processing.

• EEA/UK (GDPR): you also have the right to withdraw consent and to lodge a complaint with your supervisory authority.
• Canada (PIPEDA / BC PIPA): you may access and correct your information and complain to the Office of the Privacy Commissioner of Canada or the BC OIPC.
• US (incl. California/CCPA where applicable): you may request access and deletion and are protected against discrimination for exercising these rights. We do not sell personal information.

To exercise any right, including deletion of uploaded files, email legal@puremonograph.ai. We respond within the timeframe required by applicable law.

10. Security

We use encryption in transit, hashed credentials, access controls, and audit logging. No system is perfectly secure; we cannot guarantee absolute security.

11. Children

The service is not directed to anyone under 18 and is intended for professional use.

12. Changes

We will post updates here and change the "last updated" date. Material changes affecting your rights will be communicated where required.

13. Contact

Data controller: Pure Monograph Email: legal@puremonograph.ai Mailing address: Vancouver, BC, Canada