Privacy Policy

1. Introduction & Scope

Monlok (monlok.mn) is a unified ecosystem for Mongolia's local businesses, comprising the consumer app (MonLok), the business owner app and web (MonLok Business), and the marketing site (monlok.mn). This Privacy Policy applies to the monlok.mn website and its business management section.

This policy is drafted to comply with Mongolia's Law on Protection of Personal Data (PDPL, in force from 1 May 2022).

2. Information We Collect

2.1 Marketing site visitors (anonymous)

• Vercel Analytics — page load metrics, page views, device type, country code, unique visitor counts (uses cookies / local storage).
• Fonts — Unbounded and Rubik are served from our own domain, so your browser never contacts Google to load them.
• Clicking "Contact" opens mailto:help@monlok.mn or tel:+97699165040; we receive whatever you send via email or phone.

2.2 Business owner authentication

When you create or sign in to a business account in /business, or claim a business via UUID, we collect:

• Email address — used by Supabase Auth to send a 6-digit email OTP.
• Business UUID — entered manually in claim mode. To obtain a UUID you must request it from help@monlok.mn (see Section 4).

2.3 Public business listing data

The /app/business/[id] page loads publicly available business information from Supabase (name, city, photos). This is not personal data; it is information voluntarily submitted by business owners or aggregated from DataForSEO / Google Places API.

3. Purposes of Processing

• Improve site quality (Vercel Analytics).
• Verify and connect business owners with their listings.
• Display public listings.
• Security and anti-fraud.
• Compliance with legal obligations.

4. Special Notice for Business Owners — UUID Claim

If you are the owner of a business and want to control or delete your listing:

1. Email help@monlok.mn or call +976 9916-5040.
2. Include your business name, address, and proof of ownership.
3. After verification we issue you the unique UUID for your business.
4. Use the UUID to log in to MonLok Business (mobile app) or to /business on the web to manage your listing.
5. Alternatively, you can request that we permanently delete the listing.

5. Third Parties

6. Cookies

• Vercel Analytics may use cookies / local storage for site analytics.
• Supabase Auth may set session cookies after successful login.
• We do not use marketing or third-party tracking pixels.

7. Cross-Border Data Transfers

Vercel and Supabase data centers are located in the US, Singapore, Tokyo, or other regions, so your data is transferred outside Mongolia. Under PDPL we:

• Obtain your specific consent at signup.
• Use providers meeting international standards (SOC 2, ISO 27001).
• Limit transfers to what is strictly necessary.

8. Data Retention

• Vercel Analytics — per Vercel's policy (typically 12 months).
• Business owner accounts — for as long as active, plus 30 days.
• UUID login logs — 12 months (security audit).
• Business listings — until the owner deletes them.

9. Security

• HTTPS (TLS 1.2+) encryption.
• Supabase Row-Level Security (RLS) policies.
• Email OTP codes stored hashed.
• Restricted-access admin sections.

10. Your Rights (PDPL)

• Right of access — to know what data we hold.
• Right to rectification — to correct inaccurate data.
• Right to erasure — to delete your account or business listing.
• Right to portability — request a JSON/CSV export.
• Right to object — opt out of notifications and marketing.
• Right to lodge a complaint — with the National Human Rights Commission of Mongolia or the courts.

We respond to requests within 30 business days. Send all requests to help@monlok.mn.

11. Children's Privacy

The Service is not intended for children under 13.

12. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify users via site banner and email.

13. Contact