Privacy Policy

This Privacy Policy explains how Monday AI DOD processes information when an authorized user connects a monday.com account and requests an AI-assisted rewrite. Monday AI DOD is operated for authorized users of the connected monday.com account.

Information we process

To generate a requested rewrite and Definition of Done, the service may process:

the update draft the user enters;
a voice recording only when the user deliberately starts the microphone feature, solely to produce a transcript;
the current monday.com item or task title, board and group context;
permitted item fields relevant to the work, such as status, priority, due date, assignee, and configured board columns;
up to five recent text-only updates/comments from the current item, including displayed author and date information;
limited assignee/user information needed to identify a clearly mentioned person; and
account, connection, and authentication information, including the monday.com user ID, account ID, name, email address, and OAuth session/token metadata.

How information is used

We use this information only to authenticate the user, obtain the requested current-item context, generate the requested rewrite/DOD, maintain the connection, apply personal or shared writing guidance, prevent misuse, and provide support. DOD returns a suggestion only; it does not automatically post an update or make changes in monday.com.

What is not included in the rewrite workflow

The service does not intentionally send attachments, uploaded files, complete board history, or content from unrelated monday.com items for a rewrite. Users should not place passwords, API keys, or other secrets in a draft or writing profile.

Service providers and AI processing

To generate the requested rewrite, relevant draft and monday.com context are transmitted over HTTPS to the Monday AI DOD backend and then to OpenAI, the configured third-party AI provider, for inference. If the user starts a voice recording, that audio is also transmitted over HTTPS to the backend and OpenAI for transcription. We do not represent that this information is never shared with third parties: OpenAI receives the content necessary to provide the requested AI response. OpenAI's processing is subject to its applicable Privacy Policy and service terms.

Retention and deletion

The backend keeps an authenticated monday.com session for up to 30 days after the user's last authenticated activity. Signing out revokes the stored monday.com tokens and removes that session. Personal writing profiles and shared company guidance are retained until changed or removed by the authorized account administrator or service operator. Voice audio is held in memory only during transcription and is not saved by the service. The service is designed not to persist ordinary rewrite drafts, item context, transcripts, or generated text after processing, except for short-lived operational processing and security/rate-limit records.

Security

Connections to the service use HTTPS. monday.com OAuth tokens and connection data are stored only on the protected service backend; the Chrome extension stores an opaque session identifier rather than monday.com or OpenAI API credentials. Access is restricted to authorized monday.com accounts and server-side rate limits are applied. No system can guarantee absolute security, so users should avoid submitting sensitive information that is not needed for the rewrite.

Choices and requests

Users can sign out of the extension to revoke their stored monday.com session. For access, correction, or deletion requests relating to an authorized company account, contact the administrator of that monday.com account through the support process below.

Contact

For product support or privacy requests, email support@ossaframes.com. For account-specific access or deletion requests, you may also contact the administrator of the authorized monday.com account.