Privacy policy: Kayabyte Client View
Last updated: 13 October 2026
This policy explains what data the app “Kayabyte Client View” (the app), published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway, processes when it is installed on a monday.com account.
What the app does
The app lets a team publish “client pages”: web pages that show a chosen subset of a monday.com board’s items to people outside the account (the team’s clients), and lets those clients optionally comment on or approve items.
Roles
For the data in the customer’s monday.com account, the customer is the controller and Kayabyte acts as a processor that handles the data only to provide the app. monday.com (and the Google Cloud infrastructure monday code runs on) is a sub-processor for hosting and storage.
Services the app uses
- monday.com (monday.com Ltd.): the app runs on monday code and stores its data in monday code storage, EU region.
- Anthropic (Anthropic PBC, USA), only if a customer adds their own Anthropic API key and a team member clicks “Draft with AI”: the items and columns shown on that client page (and, if the team member chooses, the latest comments on those items) are sent to Anthropic’s API with the customer’s key to write a draft. This happens under the customer’s own agreement with Anthropic. The app has no Anthropic account of its own for customer data.
The app uses no analytics, advertising or tracking.
Data the app stores
All stored data stays in monday code storage: - Connection token for monday.com and the customer’s Anthropic API key, if added, in monday code secure storage (encrypted). The key is never shown again after it is saved. The name of the admin who authorized the app. - Client page settings: client name, page title, which items and columns are shown, options, an optional password (stored only as a salted scrypt hash), an optional last day, and the published update text with its author’s name. - Branding: company name, accent color and logo link. - Recent activity: up to 200 short messages for the team, such as “Kari (Acme) commented on ‘Homepage design’”, including the names clients type when they comment or approve. - Counters used for rate limits (expire automatically) and AI drafts per month.
Data the app processes but does not store
Board items, column values and files shown on a client page are read from monday.com when the page is opened and kept in memory for a few minutes. Comments and approvals that clients send are written to the customer’s monday board as updates; the app keeps only the activity message described above.
Client page visitors
People who open a client page are not asked to create an account. The
app sets these strictly necessary cookies on the page’s domain: -
cv_b: a random browser identifier used to protect forms
against forgery (90 days). - cv_u_<page>: remembers
that the correct password was entered for a password-protected page (7
days). - cv_n_<page>: remembers the name a visitor
typed when commenting, so they don’t have to type it again (90 days). -
cv_oauth: used only during the admin’s authorization step
(at most 10 minutes). Visitors’ IP addresses are used in memory for rate
limiting and are not stored.
Logs
The app writes operational logs through monday.com’s logger (account, board, page and item IDs, error messages). Logs never contain tokens, passwords or client comments.
Retention and deletion
Data is kept while the app is installed. When the app is uninstalled, all client links stop working immediately, the token and API key are deleted immediately, and all other stored data is deleted at once or, if that fails, within 10 days. Customers can ask for deletion at any time at support@kayabyte.dev.
Access
Only the app’s own code accesses the data. Kayabyte does not sell, share or use customer data for any other purpose.
Your rights
For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev.
Changes
We will update this page if the app’s data handling changes. The date at the top shows the latest version.