MeshBoard Privacy Policy

This policy describes the data we process for the MeshBoard monday.com app, why we process it, how long we keep it, and where to find supporting legal and technical evidence.

Data We Process

Account and user identifiers from monday.com context and lifecycle events, including `account_id`, `user_id`, and `account_name`.
Webhook payload fields such as `user_email` when monday sends them as part of installation or lifecycle events.
App state needed to operate the service: `accounts`, `users`, `monday_tokens`, `saved_pivots`, `scheduled_syncs`, and operational logs.
Operational audit data such as `usage_logs`, `pivot_target_audit_logs`, and `mcp_invocation_audit_logs`.
Transient cache and job metadata in Redis, including prefetch payloads and job status entries with TTL controls.

We do not persist raw monday board row data as a long-lived database copy. Row-level content is processed transiently for the user-requested job and written only in aggregated form where the workflow requires it.

Why We Process It

Authenticate the monday account and user.
Read source boards requested by the user.
Join, transform, aggregate, and write summary outputs.
Support billing, account state, uninstall handling, and security investigations.

Legal Basis and Scope

Contract performance for the core app workflow.
Legitimate interests for security, abuse prevention, and operational logging.
Consent or user action when monday or the customer triggers an install, writeback, or schedule.

Retention

Account-scoped state needed to operate the app is retained until uninstall, account closure, or a user-triggered delete action. That includes `accounts`, `users`, `monday_tokens`, `saved_pivots`, and `scheduled_syncs`.

Derived operational and audit records that are not required for active product operation, billing, legal retention, or security investigations are purged on a rolling 90-day basis. The cleanup scope covers `usage_logs`, `pivot_target_audit_logs`, and `mcp_invocation_audit_logs`.

Transient Redis records are TTL-bound: prefetch payloads use a short-lived cache window and job status entries expire automatically.

See the retention policy for the cleanup task path and verification notes.

Cookies and Tracking

We do not use cookies for authentication. Session validation is handled through monday session tokens and request headers, not browser-stored auth cookies.

We do not use tracking cookies or behavioral advertising cookies on this app site. Any analytics or observability tooling is limited to operational error and performance monitoring.

Subprocessors and Transfers

We use third-party providers for hosting, cache, observability, secrets management, and monday.com API access. The current baseline inventory lives in the subprocessor inventory.

Rights and Contact

For access, deletion, correction, or questions about this policy, contact info@overwhelmingtech.com.

Policy owner: OverWhelming Tech. This page is the publication path for the review submission baseline.