Privacy Policy
Secure Approvals for monday.com · Last updated: October 12, 2026
This policy explains what data the Secure Approvals app (“the app”) processes, why, where it is stored and for how long. The app is provided by Aleksandr Vorontsov, trading as Devrok (“we”, “us”). Contact: support@devrok.com.
Our role
The app works on data in your monday.com account. For that data, your organization decides what is processed and we process it on your behalf, only to provide the app.
What we process and why
| Data | Why |
|---|---|
| monday.com account ID and slug, board, item and column IDs | To know which approvals belong to which account, board and item, and to build links to items. |
| User IDs, names and email addresses of requesters and approvers (from monday.com) | To show who requested and who decided, to notify approvers and, if enabled, to email them a link to decide. |
| Email addresses of external approvers that you enter | To send them the approval email. External approvers get no access to your account. |
| Item and board names, notes and comments entered in the app, approval decisions and their time | To run the approval, show its progress and keep its history. |
| The account’s OAuth access token for monday.com | To change the approval status column, protect it from manual changes, send notifications and post to Updates on your behalf. |
| The account’s subscription plan (from monday.com) | To enable the features of your plan. |
We do not sell data, do not use it for advertising and do not use it to train AI models. The app sets no cookies and uses no tracking or analytics.
Where data is stored
- monday code (monday.com) hosts the app’s server in the EU region. Approval records, board settings and templates are kept in monday.com’s app storage, separated per account. The OAuth token is kept in monday.com’s secure storage, separated per app.
- Resend (Plus Five Five, Inc., USA) sends approval emails. To send an email it receives the recipient’s address and the email content (item name, requester name, note and decision links). Resend stores account data, including email metadata and logs, in the United States, and keeps email data for 30 days. Transfers are covered by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework (Resend DPA).
- monday.com itself processes your account data under its own privacy policy.
How long we keep data
- Approval records and settings are kept while the app is installed, so the history stays available. The latest 200 history entries are kept per item.
- Links in approval emails expire after 30 days.
- When the app is uninstalled, we delete the account’s access token right away. Without it we can no longer read or change data in your account or in its app storage.
- Server logs contain technical information (for example account and item IDs and error messages) and are kept by monday code for a limited time. We do not log email content.
Security
- Every request to the app is verified: requests from monday.com carry tokens signed with the app’s secrets, and email links are signed and tied to one approval round.
- All connections use HTTPS. Secrets are kept in monday code’s secret storage, never in code.
- Data of one account is never accessible to another account.
Your choices and rights
Account admins can uninstall the app at any time. To access, correct or delete data processed by the app, or for any privacy question, email support@devrok.com. Depending on where you live (for example under the GDPR) you may have further rights, including the right to complain to a data protection authority.
Contacting you
We do not send marketing emails. The app sends approval emails only when a user of your account requests an approval. We may contact the account admin who installed the app about important changes to the app, security or this policy.
Changes
We will post changes to this page and update the date above. Significant changes will be announced to account admins in advance.