Kayabyte

Privacy policy: Kayabyte Portfolio Roadmap

Last updated: 3 November 2026

This policy explains what data the app “Kayabyte Portfolio Roadmap” (the app), listed on the monday.com marketplace as “Portfolio Roadmap & Timeline” and published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway, processes when it is installed on a monday.com account.

What the app does

The app reads the monday.com boards a customer chooses and shows them on one timeline, in a board view, a dashboard widget, a printable page and an optional read-only share page. It has no write permission and doesn’t change boards.

Roles

For the data in the customer’s monday.com account, the customer is the controller and Kayabyte acts as a processor that handles the data only to provide the app. monday.com (and the Google Cloud infrastructure monday code runs on) is a sub-processor for hosting and storage.

Services the app uses

The app uses no other services, and no analytics, advertising or tracking. The app sends no email.

Data the app stores

All stored data stays in monday code storage: - Connection token for monday.com, in monday code secure storage (encrypted), and the name of the admin who authorized the app. - Account settings: a time zone, taken from the admin who authorized the app. - Roadmap settings: name, the monday user ID of its owner, chosen board, workspace and folder IDs, name filter, column choices, view settings, and share link settings (a random value, expiry date, the monday user ID of who created it). - Manual order: IDs of items, groups and boards in the saved order. - Baselines: for each item at the time of the baseline: its ID, name, board and group IDs, and start and end dates; plus the baseline’s label, time and the monday user ID of who took it. At most 24 per roadmap. - View choices: which roadmap a view or widget shows. - Job records: the time and outcome of the last hourly run (account IDs and error messages), used to operate the service.

Data the app processes but does not store

Item names, dates, statuses and owners, board, workspace and folder names, board owners and subscribers, and team and workspace membership are read from monday.com when needed and kept only in the app’s memory, for as long as they are in use. The CSV export is built in the browser.

The share page

If a customer creates a share link, anyone who has the link can see, with no login, the item names, dates, statuses, board names, any workspace, folder, group or column values the saved view groups by, and (unless hidden) owner names, of the boards the person who created it can open. The customer decides whether to create a link and who receives it. A visitor’s IP address is held in memory for about a minute to limit abuse, and isn’t stored. The page sets no cookies.

Cookies

During the admin’s authorization step the app sets one short-lived, strictly necessary cookie (at most 10 minutes). There are no tracking cookies.

Logs

The app writes operational logs through monday.com’s logger (account and board IDs, error messages). Logs never contain tokens or item content.

Retention and deletion

Data is kept while the app is installed. Baselines beyond the limit of 24 are deleted, and a customer can delete roadmaps and baselines at any time. When the app is uninstalled, all stored data is deleted at once, the access token is revoked, and share links stop working. If monday.com’s storage is unavailable at that moment, the app keeps only the encrypted token to retry the deletion every hour, and deletes the token within 10 days.

Access

Only the app’s own code accesses the data. Kayabyte does not sell, share or use customer data for any other purpose.

Your rights

For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev.

Changes

We will update this page if the app’s data handling changes. The date at the top shows the latest version.