Privacy Policy
Effective Date: September 30, 2026 | Last Updated: September 30, 2026
This Privacy Policy explains how Montai Therapeutics, Inc. (“Montai,” “we,” “our,” or “us”) collects, uses, shares, and protects information about you when you visit www.montai.com (the “Site”). It also describes your rights and choices regarding your personal information.
We are committed to protecting your privacy. Please read this policy carefully. If you have questions, contact us using the details in Section 13.
1. Who We Are (Data Controller)
Montai Therapeutics, Inc. is the data controller responsible for the personal information collected through this Site.
| Contact Detail | Information |
| Company | Montai Therapeutics, Inc. |
| Address | 26 Landsdowne St, Cambridge, MA 02139, USA |
| General inquiries | partnerships@montai.com |
| Privacy inquiries | privacy@montai.com |
2. Information We Collect
We collect the following categories of personal information when you use the Site:
2.1 Information you provide
- Contact and identity data: your name, email address, company name, and job title when you contact us by email.
- Communications data: the content of emails you send to partnerships@montai.com or press@montai.com.
2.2 Applicant data (collected via Greenhouse)
- When you apply for a position at Montai through our applicant tracking system (Greenhouse Software, Inc.), we collect:
- Resume/CV, cover letter, and employment history.
- References and LinkedIn profile URL.
- EEO data (voluntary): provided at your option to support equal employment opportunity reporting.
Providing this information is necessary for us to evaluate your candidacy for the applicable position. We may be unable to consider you without the required information. You may withdraw your application at any time by contacting us at the address in Section 13.
2.3 Information collected automatically
When you visit www.montai.com, we automatically collect:
- Online identifiers: IP address, browser type and version, operating system, device type.
- Usage data: pages visited, time on site, referring URL, and general location (city/region).
- Cookie and tracking data: cookie identifiers and session IDs. See Section 4 for the full list of cookies we use.
We do not intentionally collect sensitive personal information beyond voluntary EEO applicant data.
3. How We Use Your Information
The table below sets out each purpose, the data categories used, and — for visitors from the EU/UK — the GDPR lawful basis.
| Purpose | Data Categories Used | GDPR Lawful Basis (EU/UK) |
| Respond to partnership, press, and general inquiries | Contact & Identity Data; Communications Data | Legitimate interest (Art. 6(1)(f)) — to respond to and manage inquiries you initiate. |
| Operate and improve the Site (analytics, performance monitoring) | Usage & Analytics Data; Cookie & Tracking Data | Consent (Art. 6(1)(a)) for cookie-based analytics; legitimate interest (Art. 6(1)(f)) for server-side analytics not requiring device storage. |
| Comply with legal obligations (e.g., respond to legal process, enforce rights) | Any data we hold | Legal obligation (Art. 6(1)(c)); and legitimate interest (Art. 6(1)(f)) in establishing, exercising, or defending legal claims. |
| Recruitment and applicant evaluation | Applicant Data | Steps prior to entering a contract (Art. 6(1)(b)) for evaluating your application; legitimate interest (Art. 6(1)(f)) for post-decision retention to defend legal claims; voluntary EEO data processed only with your explicit consent (Art. 9(2)(a)). |
We do not sell your personal information, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects on you.
4. Cookies & Tracking Technologies
4.1 What Are Cookies?
Cookies are small text files stored on your device. We also use similar technologies such as web beacons, pixels, and local storage. Together, we call all of these “cookies” in this policy.
4.2 Cookies We Use
| Category | Purpose | Default Behavior |
| Strictly necessary | Site security, load balancing, and CDN routing | Always on — cannot be disabled |
| Functional | None currently used | — |
| Analytics | Aggregate usage measurement of montai.com | Off until consent in EU/UK/Swiss visits; on in US visits until you opt out |
| Advertising / cross-context | Not used on this Site | Not applicable |
We honor Global Privacy Control (GPC) signals where required by applicable law.
5. How We Share Your Information
We share information only with:
- Service providers acting under written contract on our behalf, including our hosting and CDN provider (Amazon Web Services / AWS), analytics and tag management providers (Google Analytics, Google Tag Manager), and applicant tracking system (Greenhouse Software, Inc.). These providers are restricted to using information only as needed to provide services to us.
- Marketing and social platforms, including LinkedIn, to the extent required for social widgets you interact with.
- Flagship Pioneering, Inc., our founding and affiliated company, for corporate oversight and shared services under an intra-group data processing agreement.
- Professional advisors, including attorneys, auditors, and accountants, when reasonably necessary for legal, financial, or compliance purposes.
- Corporate transactions, in connection with a merger, acquisition, financing, or sale of assets, under appropriate confidentiality protections.
- Legal compliance and safety, when required by law, court order, or regulator, or to protect the rights, property, or safety of Montai, our partners, our employees, or the public.
We do not sell or “share” personal information for cross-context behavioral advertising. However, de-identified or aggregated information that cannot reasonably identify any individual is not personal information under this Policy and may be used or disclosed without restriction. Where we rely on this exception, we implement and maintain technical safeguards and business processes that prohibit reidentification of the information, use it only in a de-identified or aggregated form, publicly commit to maintaining it that way, and contractually require any recipients to do the same.
6. Data Retention
We keep personal information only as long as necessary for the purpose it was collected, or as required by law. The table below shows our standard retention schedule.
| Data Category | Retention Period |
| Contact & Communications Data (inquiries) | 3 years from last contact, or until the relationship ends |
| Analytics & Cookie Data | Up to 26 months (Google Analytics default); consent records: 3 years |
| Applicant Data — hired candidates | Duration of employment + 7 years (or as required by applicable law) |
| Applicant Data — rejected candidates | 12 months from rejection decision |
| EEO Data (voluntary) | Aggregated/anonymized after application closes; individual data: same as applicant data |
| Legal / Compliance Records | As long as reasonably required. |
When your data is no longer needed, we securely delete or anonymize it.
7. Your Privacy Rights
7.1 Rights for Everyone
Regardless of where you live, you may:
- Ask us what personal information we hold about you.
- Request correction of inaccurate data.
- Ask us to delete your data (subject to legal retention requirements).
- Withdraw consent for non-essential cookies at any time via the Manage Consent link.
- Opt out of marketing communications.
7.2 EU / UK GDPR Rights
If you are in the European Economic Area (EEA) or United Kingdom, you additionally have the right to:
- Data portability — receive a copy of your data in a machine-readable format (Art. 20 GDPR).
- Restrict processing in certain circumstances (Art. 18 GDPR).
- Object to processing based on legitimate interest (Art. 21 GDPR).
- Lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or the relevant EU Data Protection Authority).
7.3 California (CCPA / CPRA) Rights
If you are a California resident, you have the right to:
- Know what personal information we collect and how we use and share it.
- Delete your personal information (with exceptions).
- Correct inaccurate personal information.
- Limit the use and disclosure of sensitive personal information.
- Non-discrimination for exercising your rights.
We do not sell or share personal information, as those terms are defined under California law. To exercise your rights, email us at privacy@montai.com. We will respond within 45 days (CCPA) or one month (GDPR/UK GDPR), with possible extensions as permitted by law.
We may need to verify your identity before processing certain requests.
8. Security
We apply technical and organizational measures appropriate to the risk, including:
- TLS/HTTPS encryption for data in transit.
- Access controls limiting data access to authorized personnel.
- Regular review of third-party sub-processors’ security practices.
- Incident response procedures to address potential data breaches.
No method of transmission over the internet is 100% secure. If you have reason to believe your interaction with us has been compromised, please contact us immediately. If we become aware of a security incident affecting your personal information, we will notify you and/or the applicable regulators to the extent required by applicable law.
9. Children’s Privacy
This Site is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at privacy@montai.com and we will delete it promptly.
10. GDPR / UK GDPR Compliance
10.1 Lawful Bases
Our lawful bases for processing personal data are set out in the table in Section 3, and include consent, performance of (or steps prior to) a contract, compliance with a legal obligation, and our legitimate interests. Where we rely on legitimate interest, we have conducted a Legitimate Interest Assessment (LIA) and concluded that our interests do not override your fundamental rights.
10.2 International Data Transfers
Montai is based in the United States. When we transfer personal data from the EEA or UK to the US, we use one or more of the following safeguards:
- Standard Contractual Clauses (SCCs) adopted by the European Commission (for EEA transfers).
- UK International Data Transfer Addendum (IDTA) issued by the ICO (for UK transfers).
Adequacy decisions where applicable.
11. Links to Third-Party Sites
The Site contains links to third-party websites (e.g., LinkedIn, BusinessWire, NVIDIA). This Privacy Policy applies only to www.montai.com. We are not responsible for the privacy practices of linked sites and encourage you to review their privacy policies.
12. Changes to This Policy
We may update this policy from time to time. When we make material changes, we will update the “Last Updated” date at the top of this page. For significant changes, we may provide additional notice (for example, by adding a banner to the Site). Your continued use of the Site after the updated policy is posted constitutes acceptance of those changes.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
| Channel | Details |
| privacy@montai.com | |
| Post | Montai Therapeutics, Inc., 26 Landsdowne St, Cambridge, MA 02139, USA |
| General inquiries | partnerships@montai.com |