Last updated: May 14, 2026
ChipMonkeys Inc. ("we," "our," or "the Company") operates the Monkey Business Manager platform ("MBM" or "the Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.
When you create an account, we collect your name, email address, phone number, and organization details. If you are an operator, we also collect business information such as your company name, EIN, and billing address.
We use Plaid Inc. to connect your bank accounts for transaction monitoring and financial reporting within the platform. When you link your bank account through Plaid, we receive access to your account balances and transaction history. We do not store your bank login credentials. Our use of Plaid is governed by the Plaid End User Privacy Policy.
Payment processing is handled by Stripe Inc. We do not directly store credit card numbers or bank account numbers for payment purposes. Stripe's handling of your data is governed by their privacy policy.
We collect vehicle information (VIN, make, model, year, color), inspection photos, damage assessments, repair records, and paint match data as part of normal platform operations.
With your permission, we collect GPS location data for mileage tracking, technician routing, and NFC tag scan geolocation. Location is captured at the time of specific actions (clock-in, scan, mileage log) and we do not perform continuous background location tracking.
We automatically collect information about how you interact with the platform, including pages visited, features used, timestamps, device type, browser information, action breadcrumbs (job logged, photo captured, invoice marked paid, etc.), canvas dispatch logs (event-driven workflow walks on your blueprint), and standard service logs (request metadata, errors, performance metrics).
If you choose to connect a Facebook Page so MBM can publish before/after photos on your behalf, we receive and store: your Facebook Page ID and name, a list of Pages you administer, a long-lived Page access token, and a long-lived User access token used to refresh the Page token before it expires. Both tokens are encrypted at rest with AES-256-GCM before being written to our database. We never receive your Facebook password, your personal newsfeed content, your Messenger conversations, or any data about your Facebook friends. We use these tokens solely to publish posts you have explicitly initiated from inside MBM (clicking the "Post to {Page Name}" button on a before/after slider). We do not post on your behalf automatically or without your direct action in MBM. You can disconnect at any time; see "Facebook / Meta Data Deletion" below.
When you use AI-assisted features (transaction categorization, dashboard summaries, draft customer communications, paint-match suggestions, and similar tools), we transmit the relevant inputs (transaction details, business records, prompts) to third-party AI providers including Anthropic and OpenAI to generate the output. Some AI features may also use Google Cloud services. Each provider operates under its own terms and privacy policy. We configure providers to process your data without using it to train public foundation models where commercially reasonable, but we do not guarantee any provider's data-handling practice.
We do not sell your personal information. We may share data with:
We do not sell your personal information.
We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest, role-based access controls, and row-level security policies at the database level. All API keys and secrets are stored securely as environment variables and are never exposed in client-side code. We offer TOTP-based multi-factor authentication (MFA) and may require it for accounts with elevated privileges, financial access, or admin functions.
We retain your data for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods by data category, our disposal procedures, and our anonymization policy are set forth in our Data Retention and Disposal Policy. Notable retention periods: financial transaction records are retained for 7 years for IRS compliance, Monkey Match paint-match data is retained indefinitely in anonymized form, location/GPS data is retained for 2 years for mileage reporting, and usage/analytics data is retained for 1 year. You may request deletion of your account and associated data by emailing the contact below; data required for legal or tax compliance is retained but access-restricted for the remainder of the applicable retention window.
Depending on your jurisdiction, you may have the right to:
To exercise any of these rights, contact us at the email below. We respond to verified requests within 30 days. We may request additional information to verify your identity before fulfilling a request.
We use first-party cookies and similar technologies to maintain your authenticated session, remember your preferences, and operate the platform. We do not use third-party advertising cookies. Essential cookies cannot be disabled without breaking core platform functionality.
We are based in the United States. If you access the platform from outside the United States, your information will be transferred to and processed in the United States. By using the platform, you consent to this transfer.
The platform is intended for use by adults operating businesses. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us and we will delete it.
In the event of a data breach affecting your personal information, we will notify you and applicable regulatory authorities consistent with applicable law and within the timeframes required by your jurisdiction (generally within 72 hours of discovery for breaches affecting EU/UK residents under GDPR, and per the timeline required by the relevant state law for US residents).
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date and, for material changes, by email or in-app notice with at least 30 days' advance notice.
If you have connected a Facebook Page to MBM and want us to delete the data we received from Meta (your encrypted Page access token, the encrypted User access token, your Page ID and name, and the list of Pages you administer), you have two options:
To request explicit deletion of all data MBM holds that originated from Meta (including backups, log entries, and audit history), email brandon@chipmonkeysinc.com with the subject "Facebook Data Deletion Request." We will confirm receipt within 5 business days and complete the deletion within 30 days, subject to any active legal holds.
If you have questions about this Privacy Policy, contact us at:
ChipMonkeys Inc.
Email: brandon@chipmonkeysinc.com