Legal

Privacy Policy

Effective September 10, 2026

Invarly is a monday.com app, installed into your own monday.com account. This policy describes what Invarly (operated by Elton Marques A. Castor, an individual developer) collects, stores, and does with data when your organization installs and uses it.

What Invarly stores

• OAuth credentials. When you connect your monday.com account, Invarly receives an OAuth access token and refresh token from monday. These are encrypted before storage and used only to call monday's API on your organization's behalf.
• Guardrail configuration. The rules you define (including guardrail names, configured status labels, board, column and group IDs, timing and enabled state), condition timestamps, and which boards you've enabled monitoring for.
• Violation records. A reference to the affected item's monday ID, the guardrail breached, and timestamps. Item content and field values are not added to the violation record. Item names can be fetched for display and alert delivery but are not persisted in the board record.
• Organization membership. monday's own internal numeric user ID for each person added, and the role assigned (Owner, Admin, Member, Viewer). No names, emails, or other personal identifiers are collected by the app itself.
• Alert configuration. Your selected opening/resolution events and delivery channels, including any external webhook URL configured for the board.

What Invarly does not do

• Does not read or process the values inside your board's columns beyond what's needed to evaluate a guardrail at the moment an event fires.
• Does not sell customer data. If your organization enables an external webhook, Invarly sends incident data to the configured URL. That payload can include account, board, item and guardrail IDs; guardrail and item names when available; the configured rule; status and timestamp; and a formatted text summary.
• Does not use your data for advertising or profiling.

How data is stored

All persisted data is stored using monday code's own secure storage infrastructure, scoped per monday account.

Data retention and deletion

The current implementation has no automatic retention period. Persisted data remains in monday code secure storage until it is manually deleted, and uninstalling the app does not currently trigger deletion. To request deletion of your organization's data, contact [email protected].

Changes to this policy

This policy may be updated as the app evolves. Material changes will be reflected here with an updated effective date.

Contact

Questions about this policy: [email protected]