Legal

Boardfeed privacy policy

Effective date: 2026-09-12

Last updated: 2026-09-18

Who we are

Boardfeed (“we”, “us”) is a monday.com marketplace app that imports data into monday.com boards on a schedule. It is operated by Uhalid Abou El Kheir (sole proprietorship — ditta individuale, Italy), Via Galileo Galilei, 47039 Savignano sul Rubicone (FC), Italy. For anything in this policy, write to privacy@boardfeed.co.

We are the controller of the account and usage data described below. monday.com is not our processor: monday.com operates the platform you installed the app on, under its own privacy policy. We are not affiliated with, endorsed by, or sponsored by monday.com.

What we collect

Your monday.com account. The account and user identifiers monday.com sends us when you install the app, the name and e-mail address of the installing user (read from monday.com once, at install, so that we can write to you about the app), and the account’s plan state for the app (which of our plans you are on).
An access token. When you install, monday.com gives us an OAuth access token that lets the app read and write the boards you have approved. It is stored encrypted (AES-256-GCM) and never written to logs.
Import configuration. What you configure: the source (for example a file, a Google Sheet or an API endpoint), the credentials for that source if you supplied any, the column mapping, the schedule, and the e-mail address that import’s notifications are sent to.
A file you upload. When the source of an import is a CSV or Excel file, the file itself is stored on our server so that the import can read it — for up to seven days, then it is deleted (see “How long we keep it”).
Run records. One record per import run: when it started and finished, how many rows were created, updated, skipped or failed, and the per-row error messages. An error message contains the source row reference and the reason it failed, for example “row 412 — ‘date’ is not a valid date”. For a row that failed, the record also holds the value of the column you chose to match rows on, so that “re-import the failed rows” can find that row again.
Items the app marked on your board. If you switch on “mark the items the source no longer has” for an import, the app keeps, for each item it marked, the item’s monday.com id, the value it matched the item on, and the previous value of the marked column — so that it can put the value back when the row returns and never mark the same item twice. Nothing else from your board is kept.
Support correspondence. Whatever you send to support@boardfeed.co, including the diagnostics you choose to include.

What we do not collect

We do not keep the rows we import. Values from your source are written to your monday.com board and are not stored on our side once they are there. What we do hold, and only for the periods listed below: a file you uploaded, until it is deleted; and, for a row that failed, the value quoted inside its error message (at most 40 characters of the cell) and the value of its match column — so that you can see which row failed, why, and import it again.
We do not read or store boards, items or columns that your import does not target.
We do not sell data, we do not use it for advertising, and we do not run analytics or tracking scripts on the app’s pages. We do not build profiles.

Why we are allowed to process it

To run the app you asked for (performance of a contract, GDPR Art. 6(1)(b)): the token, the configuration and the run records exist so that your imports can run and so you can see what happened.
To support you and to keep the service secure (legitimate interests, Art. 6(1)(f)): answering your e-mails, detecting abuse and diagnosing failures.
Because the law requires it (legal obligation, Art. 6(1)(c)): invoices and tax records.
With your consent (Art. 6(1)(a)) where we rely on it, for example if you ask us to keep data after you uninstall. You can withdraw consent at any time.

We use a small number of service providers (sub-processors). Each one is bound by a data processing agreement and only processes data on our instructions:

Provider	Purpose	Data it can see
netcup GmbH	Hosting the app, its database and its backups (servers in Nuremberg, Germany, EU)	Everything stored by the app, in encrypted form for tokens and source credentials
OVH SAS (France, EU)	Off-site storage of encrypted database backups (Object Storage, Standard Multi Zone, Paris region — three availability zones, EU)	Encrypted backup files only — encrypted with a key OVH does not hold; OVH cannot read them
Resend (Plus Five Five, Inc., USA)	Sending every e-mail the app produces: a failed import, a run that left rows out, the daily digest, and the account e-mails (welcome, first-import follow-up, reminder)	Your e-mail address and the text of the message — including the error list attached to a “rows left out” notification (`row_number,field,message`). Never an access token or a source credential; an error message can quote up to 40 characters of the cell that failed
monday.com Ltd	The platform the app runs on and the billing provider for subscriptions	Governed by monday.com’s own privacy policy; monday.com is an independent controller
monday.com Ltd (same entity as the row above)	Marketplace monetization (subscriptions and invoices)	Payment is handled by monday.com; we do not receive or store card details

We do not share your data with anyone else, except where we are legally required to, or where you explicitly ask us to. Your data is hosted in the European Union and is not transferred outside the EEA by us, with one exception: Resend (Plus Five Five, Inc.) is established in the United States and stores its account data, e-mail metadata and API records there, so the address a notification is sent to, the message itself and its delivery metadata are processed outside the EEA. That transfer is covered by the European Commission’s Standard Contractual Clauses, incorporated into Resend’s data processing addendum, and by Resend’s commitments under the EU-U.S. Data Privacy Framework recorded in that addendum. We select Resend’s EU region (Ireland, eu-west-1) for our sending domain, so that the messages themselves are despatched from inside the EU — a routing choice, not European residency: Resend stores the account data, the e-mail metadata and the API records in the United States whichever sending region is selected, which is the transfer described above.

How long we keep it

OAuth tokens and source credentials: deleted when you uninstall the app, when you de-authorise it, or when you delete the connection — within 10 days of that event. This is the deadline monday.com sets for marketplace apps; we have committed to it and it is stricter than our own internal target.
Import configuration, the items the app marked for it, and the installing user’s name and e-mail address: deleted with the token on uninstall, within the same 10 days. Deleting a single import deletes its credentials and its run history at once, and the rest of it within 10 days.
Uploaded files: deleted automatically seven days after the upload, or with everything else when you uninstall (within the same 10 days). The file is not part of our database backups.
Run records, per-row errors and the match values of failed rows: 90 days on a paid plan, 7 days on the free plan, then automatically deleted.
Support e-mail: 24 months from the last message in the thread.
E-mails sent by the app (copies held by Resend): Resend keeps the message and its delivery metadata for 30 days on its plans, then deletes them (Resend’s published quotas and limits, read 2026-09-13).
Invoices and billing records: as long as tax law requires (up to 10 years).

Backups are taken daily and rotated, and a second copy of each encrypted backup is stored with OVH SAS (Paris, EU) as described above; data removed from the live system disappears from the backups within 30 days.

Your rights

You have the right to be told what we hold about you, to get a copy of it, to have it corrected, to have it erased, to restrict how it is used, to object to processing based on legitimate interests, and to receive what you gave us in a portable format. Write to privacy@boardfeed.co and we will answer within 30 days.

You can also complain to your national data protection authority — in our case the Garante per la protezione dei dati personali (Italy, https://www.garanteprivacy.it). If you are not satisfied with how we handled a request, tell us first and we will try to put it right.

Removing the app from your monday.com account is the fastest way to stop processing: uninstalling triggers deletion of your token and configuration, and monday.com also notifies us when you or they revoke access.

Security

Data is encrypted in transit with TLS 1.2 or higher, and the OAuth access token and source credentials are encrypted at rest with AES-256-GCM using a key held in the application environment, not in the source repository. Access to production data is limited to the people who operate the service, is authenticated, and is logged. Tokens, API keys and row values are never written to application logs. Our servers and the app’s domains are scanned before the marketplace review and on an ongoing basis.

No system is perfect. If we ever suffer a personal data breach that affects you, we will tell you and the competent supervisory authority without undue delay.

Cookies

The app runs inside an iframe on monday.com and authenticates with the session token monday.com hands to the embedded view, so we do not set any cookies of our own today. If a later version needs one to keep you signed in to the app’s own backend, it will be a strictly necessary, HttpOnly cookie used only for that, never for advertising or cross-site tracking, and this policy will be updated before it ships. monday.com’s own cookies are covered by monday.com’s privacy policy. We set no tracking cookies and we load no third-party scripts on the app’s pages.

Children

The app is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

If we change this policy in a way that affects you, we will update the “Last updated” date and, for material changes, tell account admins by e-mail or in the app before the change takes effect. The version published at https://boardfeed.co/privacy is always the current one.

Contact

Uhalid Abou El Kheir (sole proprietorship, Italy), Via Galileo Galilei, 47039 Savignano sul Rubicone (FC), Italy — privacy@boardfeed.co, support@boardfeed.co. Privacy and incident contact: Uhalid Abou El Kheir, e-mail only (no telephone number is published).