Privacy notice

Provider and contact

Claervo provides the service. Privacy and data-rights requests can be sent to support@claervo.com.

Data we process

The application uses minimum read-only monday.com permissions.

• Account and user profile metadata, including name, email, role, status and last activity when the API provides it.
• Board metadata including name, workspace, owners, visibility, update time, item count, columns, groups and status labels.
• Standards, deterministic findings, scores, report metadata and application audit events.
• Encrypted OAuth credentials and secure session identifiers. OAuth tokens are never included in exports or logs.
• The current product does not retrieve item bodies, updates or file contents.

Purpose

We process data to provide requested governance analysis, maintain security, diagnose failures, meet contractual obligations and respond to account-owner requests. Customers are responsible for the appropriate legal basis and notices for their monday.com users.

Retention and deletion

Administrators can configure board snapshot, report and audit retention within documented safety minimums. Account owners can export tenant data and schedule deletion with a 14-day cancellation period. Uninstallation removes local OAuth credentials and schedules permanent tenant-data deletion no later than 10 days after uninstall.

Processors and transfers

The service uses Vercel for application hosting and Neon for PostgreSQL storage. monday.com remains the source platform. These providers process data under their documented regions and data-protection terms.

Security and rights

Controls include encryption in transit, encrypted OAuth credentials, tenant-scoped access, HTTP-only sessions, CSP, rate limiting, audit logs, dependency scanning and least-privilege scopes. Individuals may contact their customer organization or support@claervo.com for applicable access, correction, objection, restriction or deletion requests.