Privacy Policy - Data Bridge

1. Introduction

This Privacy Policy describes how Data Bridge ("we," "our," or "us") collects, uses, and protects your information when you use our monday.com marketplace application. This policy applies to all users of our application and is designed to comply with applicable privacy laws and monday.com's marketplace requirements.

2. Information We Collect

2.1 User Information

• monday Identifiers: We store your monday.com account ID (account_id), user ID (user_id), and install ID (install_id) so app data is scoped to the correct account and install.
• Support Request Data: If you submit a support request or request a new source, we may store the request text and the identity information you provide so we can respond.

2.2 Import Configuration Data

• OAuth Credentials: We store the OAuth credentials required for supported integrations, including monday and Google credentials, in monday Secure Storage.
• Import Settings: We store template name, source settings, field mappings, board and group IDs, and schedule settings.
• Import Run Metadata: We store status, counts, timestamps, and error messages so imports can be tracked and reviewed for troubleshooting.

2.3 Source Data Used for Imports

• Google Sheets Data: We fetch the Google Sheets values selected by the customer to execute the import.
• Excel Data: Excel data may be staged temporarily in chunks for background processing and then removed.

3. Data Storage and Security

3.1 Storage Infrastructure

• monday Infrastructure: Data is stored on monday infrastructure, including Document DB and Secure Storage.
• Account Isolation: Data is scoped by monday account so each account's data remains separate.

3.2 Data Encryption and Security

• Access Control: Access is restricted through authenticated requests and session validation.
• Token Protection: Tokens and secrets are never exposed in the frontend and are not written to logs.
• Transport Security: Data is transmitted over HTTPS.
• Temporary Data Cleanup: Temporary staged Excel payloads are deleted after processing or cancellation, with a TTL fallback.

5. How We Use Your Information

• Authentication: Authenticate supported integrations.
• Import Operations: Execute and resume imports reliably.
• App Experience: Show progress and import history in the user interface.
• Scheduling and Support: Support scheduling and customer support requests.
• No Model Training: We do not use customer data for model training, profiling, or marketing.

6. Third-Party Services and Dependencies

Our application uses the following services and libraries:

6.1 monday.com Services

• monday.com Platform Services: For board, item, storage, and app operations

6.2 Connector and Integration Services

• Google APIs: For Google Sheets access using read-only spreadsheet permissions for sheets you choose to connect

6.3 Support and Website Services

• Resend: Support request email delivery only
• Crisp: Website support chat

7. Data Logging and Retention

7.1 Data Retention

• Import Data: Import configuration data and run metadata are retained as needed to operate the service and support the app.
• Temporary Excel Data: Staged Excel data is removed after processing or cancellation, with a TTL fallback.

7.2 Account Data Deletion

• Automatic Data Clearing: When Data Bridge is uninstalled, account data cleanup is triggered for that account's Document DB and Secure Storage records.

8. Data Sharing and Disclosure

• No Third-Party Sale or Trade: We do not sell, trade, or market customer data to third parties.
• Service Providers: Data may be processed by the services described in this policy to provide the application.
• Legal Compliance: Data may be disclosed if required by law or legal process.

9. Your Rights and Data Control

9.1 Access and Control

• monday Authorization: You can manage app access through monday.com's app management controls.
• Google Access: You can revoke Google access through your Google account permissions.
• Data Deletion: You can request deletion through support or by uninstalling the app.
• Connector Controls: There is currently no dedicated in-app disconnect control.

10. Cookies and Tracking

10.1 Essential Cookies Only

Our website uses essential cookies required for basic functionality:

• Session Cookies: Temporary cookies for website operation and navigation
• Preference Cookies: Store user interface settings and preferences
• Functional Cookies: Enable core website features and functionality
• No Advertising Tracking: We do not use cookies for advertising purposes

10.2 Third-Party Website Services

• Support Chat: We use Crisp chat on the website for support conversations
• No Social Media Tracking: We do not use social media pixels or advertising trackers

10.3 Cookie Management

• Essential Cookies: Cannot be disabled if required for website operation
• Browser Control: Users can manage cookies through browser settings

10.4 App vs Website Cookies

• Separate Systems: Our monday.com app and website use different systems. Website chat and cookie behavior are separate from app data processing.

11. Children's Privacy

Our application is designed for business use and is not intended for children under 13. We do not knowingly collect information from children.

12. International Data Transfers

Data processing may occur through monday.com's global infrastructure and connected service providers, subject to their applicable safeguards and commitments.

13. Changes to This Privacy Policy

We will notify users of material changes by updating the "Last Updated" date and posting notifications within the app where appropriate.

14. Contact Information

For privacy-related questions or concerns:

• Email: support@lenoapps.com
• Domain: lenoapps.com

15. Compliance and Certifications

This privacy policy is designed to align with:

• monday.com marketplace privacy and security requirements
• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)
• Google API Services User Data Policy requirements