Privacy Policy

Last updated: October 10, 2026

Introduction

Innova Apps ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Email to monday Outlook add-in and its companion monday.com marketplace app ("Service"). This policy describes the monday marketplace configuration hosted on monday code.

Information We Process

When you use Email to monday, the Service processes:

• Your monday.com profile: Your name and email address, read when you connect or restore your session so we can confirm the connection and show who is signed in.
• Your monday.com workspace data: Workspace, board, group, column, and user information belonging to your account, read to populate the pickers you choose from when creating an item.
• The email you select: The subject, body, sender and recipient details, message identifiers, and whether the selected email has attachments. This content can include personal data of third parties, such as the names and email addresses of senders and recipients.
• Your monday.com OAuth access token and session data: Used to act on your behalf. The token is encrypted before it is stored in monday code SecureStorage, together with its scope, creation and expiry timestamps, and monday account identifier when available. Your Outlook client keeps a separate session identifier in browser localStorage.
• Diagnostic information: Error messages, performance data, browser and Outlook host details, and diagnostic user context as described below.

Information We Do NOT Collect

• Email content or attachments are never retained on our servers — they are processed in transit only while your item is being created.
• Your monday.com password or personal API tokens entered by you. We use the OAuth access token issued by monday.com after you authorize the app.
• Payment or card data — payment is handled entirely by monday.com's native billing and never reaches the Service.
• Personal information beyond what is required to perform the action you request.

How We Use Your Information

• Turn an Outlook email you select into a monday.com item, on the board and group you choose.
• Attach a copy of the selected email as an .eml file and post its description as an update.
• Show the originating email inside monday.com through the "Email context" item view.
• Confirm your subscription status and respond to your support requests.

We do not build user profiles, do not track usage for advertising, and do not use your data to train AI models.

AI Processing

The add-in uses Google Gemini through Firebase AI Logic to suggest an item title and description and to check submitted content:

• The selected email's subject and body are sent from your Outlook client to Google to generate a suggested title, description, and action items. This processing can begin when the selected email is loaded after you connect.
• You review and edit the result before anything is created.
• You can edit the suggestions or use the raw email body as the description. Unchecking "Use AI-generated description" changes the description used for the item; it does not undo AI processing or disable the content check.
• When you create an item, its title and description may also be sent to Google for a content-safety check. Google processes this data under the applicable Firebase AI Logic and Gemini service terms, including their data-use and retention provisions. We do not use your email content to train our own models.

Where Data Is Stored

• Your access token is encrypted with AES-256-GCM before storage in monday code SecureStorage. An account index links stored sessions to the monday account identifier when it is available.
• Your device stores the monday app session identifier, cached monday sign-in information, and add-in preferences in browser localStorage. Microsoft sign-in may also cache identity and session data in browser sessionStorage. The session identifier authorizes requests to our backend; it is not the monday.com OAuth token.
• Email content is processed in transit only: it passes through our backend while the item is created and its .eml file is attached to monday.com, and is not retained afterward.
• Our backend runs on monday code (monday.com's hosting). In the monday marketplace configuration, subscription status is obtained from monday.com. The backend retains encrypted authentication records and operational logs, but does not create a separate database of your email bodies or attachments.

Sharing, Transfer, and Disclosure of User Data

We are transparent about how your data may be shared with the service providers ("subprocessors") that make the Service work:

• monday.com: Hosts our backend, encrypted token storage, and operational logs, and provides OAuth and workspace APIs. When you click "Create Item," the item title, description, and an .eml copy of the selected email are transferred to your monday.com workspace.
• Google: Receives the selected email content for AI suggestions and the submitted title and description for content checking, as described under AI Processing. Google also serves fonts on our public policy page.
• Microsoft: Provides the Outlook / Microsoft 365 platform, Office.js runtime, and Microsoft identity services. Microsoft Azure hosts our public website, including this policy page.
• Sentry: Receives client error and performance diagnostics, including browser and Outlook host details, error context, your Outlook display name (or email address when a display name is unavailable), and a hashed email identifier. On errors, the add-in can send a replay of its interface with text masked and media blocked. The task pane redacts title, description, and summary request fields; the OAuth callback redacts authorization-code and state parameters from reported URLs and navigation breadcrumbs. Backend error reporting is enabled only where configured.

We do NOT share, sell, rent, or disclose your data to:

• Advertisers or ad networks
• Data brokers
• Information resellers
• Any other third parties for their own marketing purposes

Third-Party Services and Domains

The following services and domains support the add-in, its backend, or this policy page. Provider-controlled services may use additional infrastructure domains. These integrations provide the functions listed below; we do not use them for advertising or cross-site attribution.

• Microsoft Office: appsforoffice.microsoft.com and res-1.cdn.office.net serve the Office.js runtime and Office UI assets required by the Outlook add-in. login.microsoftonline.com supports Microsoft sign-in and signing-key verification; monday marketplace subscription checks use monday.com. Microsoft Privacy Policy
• monday.com: auth.monday.com handles OAuth authorization and token exchange; api.monday.com handles profile, subscription, workspace, board, item, update, and file requests. *.us.monday.app hosts our backend, Outlook add-in assets, and Email context view on monday code. monday.com Privacy Policy
• Google Firebase AI Logic: firebasevertexai.googleapis.com receives requests for Gemini suggestions and content checks from the Outlook client. fonts.googleapis.com and fonts.gstatic.com serve the fonts used by this public policy page. Google Privacy Policy
• Sentry: browser.sentry-cdn.com serves the error-reporting script on the OAuth callback page; o4510388721876992.ingest.de.sentry.io receives client diagnostics and masked error replays. Sentry Privacy Policy
• Our public website: innovaapps.ai and app.innovaapps.ai provide product, help, and legal pages hosted on Microsoft Azure Static Web Apps. Loading web pages and third-party resources sends ordinary connection information, such as IP address and browser details, to their hosts.

Data Security

• Our backend and add-in assets are served over HTTPS from monday code; the public website is hosted on Microsoft Azure.
• Authentication uses OAuth 2.0 — we never see your monday.com password.
• OAuth tokens are encrypted before server-side storage. The add-in presents its session identifier to the backend, which resolves the stored token to carry out authorized monday.com requests.
• We request the OAuth scopes used to read your profile and workspace data and to create items, updates, and attachments. monday.com defines the capabilities of each permission.
• GraphQL requests use variables where supported; file-upload identifiers are strictly validated before inclusion.

Data Retention and Deletion

• Email content: Our backend processes it while creating the item and uploading its .eml file, without retaining it in backend storage. Created items, updates, and files remain in your monday.com workspace until you delete them there, subject to monday.com's retention practices.
• Authentication records: App sessions expire after 90 days by default. An expired session is rejected and its encrypted token record is deleted when that session is next used. Expiry is not a scheduled deletion of unused records.
• Disconnect: Disconnecting your monday account in the add-in clears the locally stored monday session and cached monday sign-in information on that device. It does not itself delete the encrypted server record or revoke the authorization in monday.com.
• Uninstall and deletion requests: When our backend receives an authenticated uninstall event from monday.com with an account identifier, it deletes that account's indexed token records, session index, and reserved subscription record. Records without an account identifier cannot be included in that account-based purge. You can revoke the app's access in monday.com and contact support@innovaapps.ai to request deletion of data associated with your account.
• Logs and diagnostics: Operational logs can include event types, account identifiers, status codes, error details, request URLs, IP addresses, and browser or user-agent information. monday code logs and Sentry diagnostics follow the retention settings of those services; disconnecting or uninstalling does not automatically erase those separate records.

Your Rights

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Opt out of marketing communications
• Disconnect your monday.com account at any time

Contact Us

For questions about this Privacy Policy:

• Email: support@innovaapps.ai