Privacy Policy
Pebblenod — Approvals for monday.com · Effective: October 6, 2026
Who we are
Pebblenod is provided by Anicca Holdings LLC, a Delaware limited liability company ("we", "us"). Contact: [email protected].
Our role
For the data that Pebblenod processes inside your monday.com account, the organization that installs Pebblenod is the controller and we act as its processor. For support emails and for this website, we are the controller.
What we store
| Data | Why |
|---|---|
| monday.com account ID, board IDs, item IDs and the ID of the Status column you choose | To link each approval request to its item and keep that column in sync. |
| monday.com user IDs of requesters and approvers | To know who may approve each step and to notify them. |
| Approval flows you create (names, steps, rules, reminder settings), including email addresses of approvers outside monday.com that you enter | To run your approval flows. |
| Decisions and history: approve/reject, optional comments, timestamps, who acted, and manual status changes that were reverted | To provide the history that is a core feature of the app. |
| Monthly usage: number of requests opened and the email addresses of external approvers invited that month | To apply the limits of your plan. |
| An OAuth access token for your monday.com account | To read the items and users the app needs and to write the Status column, notifications and webhooks. |
We read, but do not store, user names, item names and board item lists; they are fetched from monday.com when a page is shown. Pebblenod does not use cookies, analytics, advertising or third-party scripts.
People outside monday.com
When you add an external approver, we store the email address you enter. You share their private link with them. Their approval page shows the item name, flow, step, the requester's name and their own email address. Their decision and optional comment are stored in the history of your request. We use their address for nothing else.
Legal bases
Where data protection laws such as the GDPR apply, we process data to perform our contract with you, on your documented instructions as your processor, and for our legitimate interests in securing, supporting and improving the service.
Where it is stored and who processes it
Pebblenod runs on monday code, monday.com's hosting platform, in its United States region. Approval data is kept in monday code storage, separated per monday.com account; the access token is kept in monday code's encrypted Secure Storage. Data may therefore be processed in the United States; where required, transfers rely on the safeguards offered by our providers, such as Standard Contractual Clauses.
Service providers (subprocessors):
- monday.com Ltd. — hosting (monday code), storage, logs and the monday.com API.
- Cloudflare, Inc. — DNS and hosting for pebblenod.com, and forwarding of email sent to [email protected].
- Google LLC — mailbox where support emails are received and answered.
We will update this list before adding a new provider that processes Customer Data. We do not sell personal data, share it for cross-context advertising, or use it to train AI models.
Logs
Our servers keep technical logs (request type, account and request identifiers, errors) to operate and secure the service. They do not contain comments or approval content and are kept for a limited period by our hosting provider.
Security
- All traffic uses HTTPS (TLS 1.2 or higher) with HSTS.
- Requests from monday.com are verified with monday-signed tokens; identity is never taken from what a browser sends.
- Users only see approval requests of boards they can access in monday.com.
- External approval links are signed, limited to one person and one step, single-use and expire after 7 days.
- The app requests only the permissions it needs: boards:read, boards:write, users:read, notifications:write, webhooks:write, account:read.
If we become aware of a security incident affecting your data, we will notify affected account administrators without undue delay.
Retention and deletion
We keep your data while Pebblenod is installed on your account. When the app is uninstalled, we delete all data collected, created or received for that account, including the access token, within 10 days. You can ask us to delete your data at any time by writing to [email protected]. Support emails are kept as long as needed to handle your request and for up to 24 months afterwards.
Your rights
Depending on where you live, you may have rights to access, correct, delete or export your personal data, to restrict or object to its processing, and to complain to a data protection authority. Write to [email protected] and we will respond within 30 days. Because the organization using Pebblenod controls most of this data, we may forward your request to its account administrator.
Children
Pebblenod is a business tool and is not directed to children under 16.
Changes
If we change this policy in a material way, we will update the date above and notify account administrators through the app or by email before the change takes effect.