Privacy Policy for Multi-Level Board Dependencies

Effective date: October 12, 2026
Last updated: October 12, 2026

This Privacy Policy explains how Matthew McVay, an individual developer (“Developer,” “we,” “us,” or “our”), processes information when you install or use Multi-Level Board Dependencies (the “App”) with monday.com.

What the App does

The App provides hierarchy-aware automation for monday.com boards. Depending on the automation you configure, it can monitor Status changes, evaluate item hierarchies and Dependency relationships, update dependent items, write fixed text or numeric values, and optionally use monday's native AI gateway to generate text for dependent items.

Information the App processes

Account and authorization information

The App may process the monday.com account ID and OAuth credentials needed for asynchronous trigger processing. Stored OAuth data can include an access token, refresh token, expiration information, granted-scope information, and connection timestamp. These records are stored in monday Code SecureStorage.

The App is not designed to persist the authorizing user's name, email address, monday user ID, account name, or account slug.

Board and automation information

To configure and execute requested automations, the App may temporarily process board IDs, item and subitem IDs, parent/child hierarchy relationships, column IDs and definitions, Status values, Dependency relationships, item names, textual column representations, workflow callback URLs, and monday webhook identifiers. It is not designed to persist copies of complete boards.

Trigger subscription information

For active hierarchy-aware triggers, the App stores the minimum technical configuration needed to receive and clean up the trigger, such as the monday account ID, automation subscription ID, board ID, source Status column/value, workflow callback URL, monday board webhook IDs, and timestamps.

Updates and activity history for optional AI actions

If you use the AI dependent-text action, the App may temporarily read recent Updates/comments and item-specific activity-log events for the triggering item. It also reads relevant current values from the triggering item and the dependent item being processed. The App bounds this context before sending it through monday's AI gateway and does not intentionally persist those Updates, activity events, AI instructions, generated prompts, or generated output in App storage.

Subscription and usage information

The App uses monday's Marketplace subscription APIs to determine the current App subscription plan and monday's native operation counter to measure monthly usage. The App does not maintain a separate 30/31-day history of individual billable events for this purpose. One operation means one dependent item selected for processing by one of the App's dependent-item actions.

How information is used

Information is used to authenticate requests, populate automation configuration choices, create and maintain requested webhooks, evaluate Status and hierarchy conditions, find dependent items, update configured columns, generate optional AI output, enforce Marketplace plan limits, troubleshoot failures, maintain security, and fulfill uninstall/data-deletion obligations.

We do not sell monday.com customer data or OAuth credentials, and we do not use monday.com customer data for behavioral advertising or data brokerage.

Your instructions and consent

The App processes monday.com customer data only to perform features you or an authorized account user configure or request. By enabling and configuring an App automation, you instruct and explicitly consent to the App accessing, using, and transmitting the monday.com data reasonably necessary to perform that automation as described in this Policy.

When you choose the optional AI action, you specifically instruct and consent to the App sending the bounded context described above through monday's native AI service to generate the requested output. You can stop future processing by disabling or deleting the relevant automation or uninstalling the App.

monday.com permissions

AI processing

The optional AI action uses monday's native AI gateway. The App does not require you to provide a separate OpenAI or Anthropic API key. For each dependent item, the App may send the user's AI instructions together with bounded triggering-item context, recent Updates/comments, recent activity-log excerpts, dependent-item context, and target-column information through monday's AI service. monday controls the underlying AI routing and its upstream model-provider relationships.

Authentication and security

The App retrieves secrets from monday Code secret-management facilities rather than embedding them in public source files. OAuth tokens are stored in monday Code SecureStorage. Signed monday requests are verified before sensitive operations are performed. OAuth state is protected with authenticated encryption and expiration controls. User-controlled identifiers and outbound URLs are validated and bounded.

Logging and retention

The App is designed not to intentionally log OAuth tokens, secrets, raw item names, raw column contents, AI instructions, AI prompt contents, or generated customer content in ordinary diagnostic logs. Operational logs primarily contain event categories, counts, error categories, and short process-local pseudonymous references where correlation is useful.

Developer-controlled exported, downloaded, or copied diagnostic logs are deleted within 3 days. The App is hosted on monday Code, which also produces platform-managed logs whose underlying retention is governed by monday.com's platform controls. We do not separately archive those platform logs beyond the stated developer-controlled retention period.

Storage and deletion

OAuth and active-trigger records are retained only while needed to operate the App. When an individual automation is removed, the App deletes its local trigger record and attempts to delete the related monday board webhooks.

When monday sends an authenticated uninstall lifecycle event, the App deletes the account's indexed app-controlled trigger records, account subscription index, and stored OAuth credentials, clears relevant process caches, and attempts to remove related monday board webhooks. The App is designed to perform this deletion immediately after the authenticated uninstall event is processed.

Service providers and third-party products

The App does not intentionally use external advertising networks, behavioral analytics providers, or a separate external database for monday customer data.

Website cookies and analytics

The public website is designed without Developer-operated analytics, advertising trackers, or authentication cookies. Cloudflare and other infrastructure providers may process ordinary web-request metadata under their own platform policies for security, routing, reliability, and service operation.

Your choices and rights

You can stop future App processing by disabling or deleting automations that use the App, revoking the App's monday authorization where applicable, or uninstalling the App. Depending on applicable law, you may also have rights to request access to, correction of, or deletion of personal data associated with you. Requests can be sent to the contact address below.

International processing

Because the App uses monday.com's platform and supporting infrastructure providers, information may be processed in locations supported by those providers and subject to their applicable data-transfer arrangements.

Children's privacy

The App is intended for business and organizational use with monday.com and is not directed to children.

Changes to this policy

We may update this Privacy Policy when the App, its data practices, applicable law, or supporting platform services change. Material changes will be communicated where required by law. The “Last updated” date will be revised when changes are made.

Contact

Developer: Matthew McVay
Privacy/Support email: support@multilevelboarddependencies.com
Website: https://multilevelboarddependencies.com