Privacy Policy

1. Introduction

This Privacy Policy describes how CodeStack Consulting Limited ("the Company", "we", "us") collects, uses, and protects your information when you use our WorkBack Scheduler application ("the App"), a monday.com Board View application. We are committed to protecting your privacy and handling your data responsibly.

2. Information We Collect

We collect the following information to provide the service:

• monday.com Account ID — Your unique monday.com account identifier, used to associate your subscription and usage data.
• OAuth Access Token — A token provided by monday.com during authentication, used to access your board data on your behalf. Stored securely server-side.
• Board Data — Item names and column values from the board where the App is installed. This data is read temporarily to generate schedules and is not permanently stored.
• Usage Data — Generation counts for analytics purposes.

3. How We Use Your Information

• Board data is used solely to generate workback schedules and write timeline dates to your board. It is processed in real-time and not stored after the request completes.
• Account identifiers are used to manage your subscription, track generation limits, and authenticate API requests.
• AI scheduling — when using the AI schedule feature, your board item names and project description are sent to a third-party AI provider (Anthropic) to generate schedule suggestions. No personally identifiable information is included in these requests.

4. Data Storage and Security

Your data is stored in a secure Supabase (PostgreSQL) database. Access tokens are stored server-side and are never exposed to the browser. All communication between the App, monday.com, and our servers is encrypted using HTTPS/TLS.

We follow security best practices including server-side JWT verification on every iframe load, server-side-only API calls, and no client-side token exposure.

5. Third-Party Services

We use the following third-party services:

• Anthropic Claude API (api.anthropic.com) — AI schedule generation.
• monday.com API (api.monday.com) — board data access.
• Resend (api.resend.com) — transactional support emails only.
• Supabase (supabase.co) — installation tracking database.

No advertising, analytics, or tracking third parties are used.

6. Data Retention

Account and subscription data is retained only for as long as the App is installed on your monday.com account. Board data (item names, column values) is processed in real-time and is not permanently stored.

When you uninstall, deactivate, or de-authorize the App, monday.com notifies us via webhook and we permanently delete all End User Data and associated metadata (including OAuth tokens, account identifiers, and usage records) from our database. Deletion occurs immediately on receipt of the uninstall event, and in all cases within 10 days, in accordance with the monday.com Developer Terms.

7. Your Rights

You have the right to:

• Request access to the personal data we hold about you
• Request correction or deletion of your data
• Withdraw consent by uninstalling the App from monday.com
• Request a copy of your data in a portable format

8. Cookies and Local Storage

The App uses browser localStorage to store your theme preference (light/dark mode) and onboarding state. No tracking cookies or third-party analytics are used within the App.

9. Children's Privacy

The App is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes through the App or via the monday.com marketplace listing. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact

For questions about this Privacy Policy or to exercise your data rights, please contact us at pratik.garg@codestackconsulting.co.uk.

Website: https://workback-scheduler.vercel.app.