1. Who we are (data controller)
Menofly is operated by Human First AI Labs LLC ("Menofly", "we", "us"), a limited liability company. For the personal information described in this notice, Human First AI Labs LLC acts as the data controller. You can reach us at privacy@menofly.ai.
2. Who this applies to
Menofly is intended for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
3. Personal data we collect
- Account information — email address, display name, authentication identifiers (Supabase user ID, OAuth provider ID), hashed password (if you sign up with email + password), time zone, and consent choices.
- Health tracking you enter — symptom logs (hot flashes, sleep, mood, energy, brain fog and similar), journal entries, notes to your doctor, medications or HRT you choose to record, onboarding responses. You control what you enter.
- Conversations with Grace — the messages you send the AI companion and the responses generated, so we can maintain conversation history and improve the experience for you.
- Payment metadata — subscription status, plan, billing cycle, and a Paddle customer/subscription identifier. Full card details are collected and stored by Paddle, not by us.
- Device and usage data — IP address, device and browser type, referring page, pages visited, features used, and error diagnostics. This includes limited analytics via the Meta Pixel on the marketing site (see "Cookies and analytics" below).
- Support communications — messages you send us by email or in-app.
4. How and why we use personal data
- Provide the service — create your account, run the tracker, generate insights and doctor-ready summaries, host your conversations with Grace. Legal basis: performance of a contract with you, and your explicit consent for health-related data.
- Billing — process subscriptions and payments through Paddle. Legal basis: performance of a contract; legal obligations (tax, accounting).
- Security and fraud prevention — rate limiting, abuse detection, credential protection. Legal basis: legitimate interests in keeping the service safe.
- Product improvement — analyze aggregated, de-identified usage to improve Menofly. We do not use your health data to train third-party AI models. Legal basis: legitimate interests.
- Marketing to you — service emails always; product announcements or launch emails only where you have signed up or otherwise consented. Legal basis: consent, which you can withdraw at any time.
- Legal compliance — respond to lawful requests, enforce our Terms, and defend our rights. Legal basis: legal obligations, legitimate interests.
5. What we do NOT do
- We do not sell your personal information.
- We do not share your health data with advertisers or data brokers.
- We do not use your health data to train third-party AI models.
- We do not provide diagnosis, treatment, or medical advice.
6. Who we share personal data with
We share personal data only with the following categories of recipients:
- Infrastructure and hosting — Supabase / Lovable Cloud (managed database, authentication, storage and edge functions), Cloudflare (edge network and hosting).
- AI providers — Google (Gemini) and Perplexity, via the Lovable AI Gateway, to power Grace responses and citations. Your messages and any relevant memory context are sent to these providers strictly to generate a response.
- Merchant of Record for the sale of the product — Paddle (Paddle.com Market Ltd / Paddle.com Inc.), which handles subscription management, payments, tax compliance and invoicing on our behalf.
- Email delivery — Resend, for transactional and authentication emails sent from notify.menofly.ai.
- Analytics and marketing — Meta (Facebook Pixel) on the marketing site to measure ad performance, subject to your cookie choices. Not used inside the signed-in app.
- Professional advisers — lawyers, accountants and auditors, under confidentiality obligations.
- Authorities — where required by law or to protect rights, property or safety.
7. International transfers
Human First AI Labs LLC is based in the United States, and several of our processors are US companies. If you are in the UK, the EEA or Switzerland, your personal data may be transferred outside your country. Where required, we rely on appropriate safeguards such as the Standard Contractual Clauses and equivalent mechanisms offered by our processors.
8. Retention
We keep your personal data for as long as your account is active. If you delete your account, we delete your data within 30 days, except where we must keep records to comply with law (for example, tax and payment records, retained by Paddle for the period required by applicable regulation). We may keep de-identified, aggregated data that can no longer be linked back to you.
9. Your rights
Depending on where you live you may have rights to access, correct, delete, restrict, port, or object to certain processing of your personal data, and to withdraw consent. You can exercise most of these from Privacy choices in the app, or by emailing privacy@menofly.ai. We respond within one month.
If you are in the UK or EEA you also have the right to lodge a complaint with your local supervisory authority. If you are in California, Washington, Colorado, Connecticut, Virginia, or other US states with a comprehensive privacy law, you have the specific rights that law gives you; Washington's My Health My Data Act applies to consumer-health data collected in the app.
10. Security
We apply appropriate technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, row-level access control so that only you can read your own records, least-privilege service credentials, and audit logging on privileged operations. No system is perfectly secure. If we learn of a personal data breach affecting you, we will notify you in line with applicable law, including the FTC Health Breach Notification Rule where it applies.
11. Cookies and analytics
On the marketing site we use a small number of cookies and similar technologies:
- Essential — sign-in, session, consent choices, CSRF. Always on; the site cannot function without them.
- Analytics and advertising — Meta Pixel, only if you consent, to measure ad performance and improve the site.
You can manage or withdraw consent at any time from Privacy choices or by clearing cookies in your browser. Inside the signed-in app we do not run third-party advertising cookies.
12. Changes
We may update this Privacy Policy. When we do, we update the "last updated" date at the top and, for material changes, notify you in the app or by email.
13. Contact
Privacy questions and rights requests: privacy@menofly.ai. Billing and refund questions are handled by Paddle at paddle.net; see our Refund Policy.
See also our Terms of Service, Refund Policy, and Medical Disclaimer.