Privacy policy
Last updated: 7 November 2026
1. Who we are
MonoPbx is a self-hosted business phone system. MonoPhone is its mobile, watch and desktop app. Both are published by ILINAYA, S.A. de C.V., with registered address at Calle 2 No. 135, Piso 5, Col. Industrial Benito Juárez, 76120 Querétaro, Querétaro, Mexico ("ILINAYA", "we", "us"). This policy explains how personal data is handled when you visit this website, use the MonoPhone app or a MonoPbx installation, and how to exercise your rights.
Contact for privacy matters: alexey@vinoc.mx.
2. Two roles: your organisation and ILINAYA
MonoPbx runs on a server operated by your employer or organisation (the "organisation"). Therefore:
- The organisation is the data controller (in Mexico, the responsable) for everything its MonoPbx stores about you: call records, voicemail, call recordings, messages, contacts, account and extension data. That data stays on the organisation's own server; ILINAYA does not host it and cannot access it.
- ILINAYA is the controller only for the data described in sections 4 and 5: this website and the push relay that wakes mobile devices for incoming calls and messages, and the licence service that installations contact to check their licence.
For anything stored in a MonoPbx installation, please contact your organisation's administrator first.
3. What the MonoPhone app handles
| Data | Where it is kept | Purpose |
|---|---|---|
| Sign-in details and server address | Secure storage on your device | Connect to your organisation's MonoPbx |
| Calls and voice audio | Sent to your organisation's server, encrypted (TLS and SRTP); recordings only if the organisation enables them | Make and receive calls |
| Call history, voicemail, messages, chat | Your organisation's server | Calls, messaging and voicemail |
| Device contacts | Stay on your device | Show names and dial from your contacts |
| Push token and an opaque device reference | ILINAYA push relay (section 5) | Deliver incoming call and message alerts |
| Microphone, camera, notifications, local network | Device permissions you grant | Calls, video, scanning the setup code, alerts |
The camera is used for video calls and to scan the setup code; scanned images are not stored or sent.
4. This website
This website does not use advertising, tracking cookies or third-party analytics. Our hosting provider processes technical data needed to deliver the pages (IP address, browser type, date and time of the request) in standard server logs, kept for a short period for security and troubleshooting. If you write to us by e-mail, we use your message and address only to answer you.
5. Push relay and licence service
Mobile operating systems wake an app only through Apple Push Notification service or Firebase Cloud Messaging. To send these wake-up messages, installations use a relay operated by ILINAYA. The relay stores:
- an opaque random reference and a hash of the device identifier;
- the push token issued by Apple or Google and the platform;
- delivery records (identifier, kind of alert, result, attempts), kept for 30 days and then deleted automatically.
The relay stores no phone numbers, names, message contents or organisation identity. The alert text shown on your lock screen passes through the relay and Apple or Google to reach your device; the organisation may replace it with a generic text. Tokens are deleted when the device is unregistered or reported invalid.
The licence service receives from each installation its installation identifier, licence identifier, software version and usage counts (for example the number of users and simultaneous calls). It receives no personal data of the installation's users.
To buy or manage a licence, the installation's administrator creates a licence account with an e-mail address and a password (stored only as a secure hash). Payments are processed by Stripe; ILINAYA does not receive or store card numbers. We keep billing records for as long as tax law requires.
6. What we do not do
- We do not sell or rent personal data.
- We do not show advertising or track you across apps or websites.
- The app contains no advertising, profiling or analytics SDKs.
7. Retention
- Data in a MonoPbx installation: for the period set by your organisation.
- On your device: until you sign out or uninstall the app.
- Push relay: delivery records 30 days; tokens until the device is removed.
- E-mail correspondence: as long as needed to handle your request and meet legal obligations.
8. Sharing
Personal data handled by ILINAYA is shared only with Apple and Google for push delivery, with Stripe for licence payments, and with infrastructure providers that host our services on our instructions. We disclose data when required by law or by a competent authority.
9. Your rights
Under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) you may exercise your ARCO rights: access, rectification, cancellation and opposition, and you may revoke your consent or limit the use of your data. Where the GDPR or similar laws apply, you also have the rights to restriction, portability and to lodge a complaint with a supervisory authority.
- For data in a MonoPbx installation, contact your organisation, which is the controller. We assist organisations when they ask us to.
- For data held by ILINAYA, write to alexey@vinoc.mx with your name, the right you wish to exercise and a description of the data concerned. We answer within 20 business days. We may ask you to verify your identity.
You can withdraw any device permission in your device settings at any time; some features then stop working.
10. Security
Calls and API traffic are encrypted (TLS and SRTP), credentials are kept in the device's secure storage, and relay requests are signed. To report a security issue, write to alexey@vinoc.mx.
11. Children
MonoPbx and MonoPhone are business tools and are not directed at children. We do not knowingly collect data from children.
12. International transfers
A MonoPbx installation runs where your organisation decides. Our relay, licence service and push providers may process data in other countries; such transfers are made under the safeguards provided by applicable law.
13. Changes
We may update this policy. The current version is always published on this page with its date; material changes are also announced in the app or release notes.
14. Contact
ILINAYA, S.A. de C.V.
Calle 2 No. 135, Piso 5, Col. Industrial Benito Juárez, 76120 Querétaro, Querétaro, Mexico
alexey@vinoc.mx.