Kayabyte

Privacy policy: Kayabyte Change Requests

Last updated: 2 November 2026

This policy explains what data the app “Kayabyte Change Requests” (the app), listed on the monday.com marketplace as “Change Requests & Change Orders” and published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway, processes when it is installed on a monday.com account.

What the app does

The app lets a customer log change requests (change orders) on monday.com boards, price them, and send the customer’s client a link to approve or reject each one. It records the client’s decision, keeps a running contract value per project, sends monday notifications, and can write statuses, decisions and project totals into columns the customer chooses. The client opens the link without a monday.com account.

Roles

For the data in the customer’s monday.com account, the customer is the controller and Kayabyte acts as a processor that handles the data only to provide the app. monday.com (and the Google Cloud infrastructure monday code runs on) is a sub-processor for hosting and storage.

Services the app uses

The app uses no other services, and no analytics, advertising or tracking. The app sends no email.

Data the app stores

All stored data stays in monday code storage: - Connection token for monday.com, in monday code secure storage (encrypted), and the name of the admin who authorized the app. - Account settings: currency, hourly rate, how long approval links are valid, branding (company name, logo and color), language, and the monday user IDs of the people who manage them. - Register configuration: the IDs of the register board and its columns, the project board and roll-up columns, the sequence counter for reference numbers, the monday user IDs of watchers, and the language of the manager who last saved it (for notifications). - Approval link records: a random link ID, the board, item and terms version it belongs to, its expiry, and whether it was used or revoked. The signed link itself is not stored. - Decision records: the full name the client typed, the time of the decision, a keyed hash of the client’s IP address, which cannot be turned back into the address, a hash of the terms shown, and, for a rejection, the reason the client typed (up to a length limit). A decision record is deleted when its approval link has ended and 90 more days have passed; the decision itself stays on the customer’s board (status, approver, date and an update on the item). - Reminder and state records: which reminders were sent for which request, the last known state per request and project, the week each watcher’s digest was last sent, and up to 200 short activity messages. - Rate limit counters: short-lived counters per link and per account, used to limit abuse of the approval page. - Job records: the time and outcome of the last hourly run (account IDs and error messages), used to operate the service.

The approval page and the change requests

The change requests themselves (titles, descriptions, amounts, hours, schedule impact and the client contact name and email) are items on the customer’s monday.com board, and stay there. A client who opens an approval link visits a page served by the app, which shows the data of that one change request and its project summary. The client’s IP address is used to limit abuse, and only a keyed hash of it is stored with the decision record. The printable approval record is available while the link lives plus 90 days.

Data the app processes but does not store

Item names, People, Number, Status and other column values are read from monday.com when the board view is opened or by the hourly check, and kept in memory for up to one minute (up to 24 hours if monday.com is unreachable). The CSV export is built on request and not stored.

Cookies

The app sets two kinds of strictly necessary cookies. During the admin’s authorization step it sets one short-lived cookie (at most 10 minutes). The approval page sets one functional cookie containing a random browser ID, used to protect the decision form against cross-site request forgery. It is not used for tracking or advertising. There are no tracking cookies.

Logs

The app writes operational logs through monday.com’s logger (account, board and item IDs, error messages). Logs never contain tokens or the content of change requests.

Retention and deletion

Data is kept while the app is installed, except decision records and expired link records, which the hourly check deletes 90 days after their link ends. When the app is uninstalled, all stored data is deleted at once, the access token is revoked, and approval links stop working. If monday.com’s storage is unavailable at that moment, the app keeps only the encrypted token to retry the deletion every hour, and deletes the token as soon as the data is gone. If the data still can’t be deleted after 10 days, the token is deleted anyway; the remaining records can then no longer be read by the app, and you can ask us to follow up with monday.com. Change requests on the customer’s boards stay in the customer’s monday.com account. Customers can ask for deletion at any time at support@kayabyte.dev.

Access

Only the app’s own code accesses the data. Kayabyte does not sell, share or use customer data for any other purpose.

Your rights

For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev. A client who used an approval link should contact the customer who sent it, who is the controller of that data.

Changes

We will update this page if the app’s data handling changes. The date at the top shows the latest version.