Kayabyte

Privacy policy: Kayabyte Expiry Tracker

Last updated: 1 November 2026

This policy explains what data the app “Kayabyte Expiry Tracker” (the app), listed on the monday.com marketplace as “Expiry & Compliance Tracker” and published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway, processes when it is installed on a monday.com account.

What the app does

The app tracks the expiry dates of documents such as certificates of insurance, licenses, contracts and permits on monday.com boards, shows which are valid, expiring soon, expired or missing, and sends monday notifications as they approach their dates. It can create renewal links that a vendor opens without a monday.com account to upload a renewed document, and it lets the customer’s reviewers approve or reject the upload. It can write item states into a status column the customer chooses.

Roles

For the data in the customer’s monday.com account, the customer is the controller and Kayabyte acts as a processor that handles the data only to provide the app. monday.com (and the Google Cloud infrastructure monday code runs on) is a sub-processor for hosting and storage.

Services the app uses

The app uses no other services, and no analytics, advertising or tracking.

Data the app stores

All stored data stays in monday code storage: - Connection token for monday.com, in monday code secure storage (encrypted), and the name of the admin who authorized the app. - Account settings: time zone, weekly digest settings, branding (company name, logo and colour), and the monday user IDs of the people who manage them. - Board configuration: document types (names, the IDs of the date, file, link and status columns, warning windows, reminder offsets, what each type is required for), the people column, the monday user IDs of watchers and reviewers, and the language of the manager who last saved it (for notifications). - Renewal link records: a random link ID, the board, item and document type it belongs to, its expiry, whether it was used or revoked, and the last rejection reason. The signed link itself is not stored. - Waiting renewals: the proposed expiry date, the vendor name and the note the vendor typed (up to a length limit), the name of the uploaded file, timestamps, and a salted hash of the uploader’s IP address, which cannot be turned back into the address. The vendor name and note are kept until a reviewer approves or rejects the renewal. - Reminder and state records: which reminders were sent for which document date, the last known state per item and document, the week each watcher’s digest was last sent, and up to 200 short activity messages. - Rate limit counters: short-lived counters per link and per account, used to limit abuse of the vendor page. - Job records: the time and outcome of the last hourly run (account IDs and error messages), used to operate the service.

The vendor page and uploaded files

A vendor who opens a renewal link visits a page served by the app. The uploaded file is not kept by the app: it is held in memory only while it is checked and sent, and goes straight to the file column of the item in the customer’s monday.com account. After that it exists only in the customer’s account. The vendor’s IP address is used to limit abuse, and only a salted hash of it is stored with a waiting renewal.

Data the app processes but does not store

Item names, People, Date, Status and other column values are read from monday.com when the board view is opened or by the hourly check, and kept in memory for up to one minute (up to 24 hours if monday.com is unreachable). The CSV export is built on request and not stored.

Cookies

The app sets two kinds of strictly necessary cookies. During the admin’s authorization step it sets one short-lived cookie (at most 10 minutes). The vendor page sets one functional cookie containing a random browser ID, used to protect the upload form against cross-site request forgery. It lasts 90 days, applies to the path /r only, and is not used for tracking or advertising. There are no tracking cookies.

Logs

The app writes operational logs through monday.com’s logger (account, board and item IDs, error messages). Logs never contain tokens, uploaded files or document contents.

Retention and deletion

Data is kept while the app is installed. When the app is uninstalled, all stored data is deleted at once, the access token is revoked, and renewal links stop working. If monday.com’s storage is unavailable at that moment, the app keeps only the encrypted token to retry the deletion every hour, and deletes the token as soon as the data is gone. If the data still can’t be deleted after 10 days, the token is deleted anyway; the remaining records can then no longer be read by the app, and you can ask us to follow up with monday.com. Files already attached to items stay in the customer’s monday.com account. Customers can ask for deletion at any time at support@kayabyte.dev.

Access

Only the app’s own code accesses the data. Kayabyte does not sell, share or use customer data for any other purpose.

Your rights

For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev. A vendor who used a renewal link should contact the customer who sent it, who is the controller of that data.

Changes

We will update this page if the app’s data handling changes. The date at the top shows the latest version.