Privacy policy for Fortnox Connect

This policy explains what the Fortnox Connect app for monday.com does with personal data. Version dated 2026-11-07.

1. Who we are

The app is provided by Aldorock AB, a company registered in Sweden. Contact: support@aldorock.com. Company site: aldorock.com.

2. Roles under GDPR

The organisation that installs the app in its monday.com account (the customer) decides which customers to invoice and which data to send to Fortnox. The customer is the controller. Aldorock AB processes personal data only on the customer's behalf and instructions and is the processor (Article 28 GDPR). A data processing agreement is available on request from support@aldorock.com.

Fortnox is the customer's own accounting system, provided by Fortnox AB under the customer's agreement with Fortnox. monday.com Ltd provides the monday.com platform under its own terms. This policy covers the app only.

3. What the app reads

On the boards where the app has been set up, it reads:

• The values of the columns the customer has mapped: typically a customer name, organisation number, email, address, references and the description, quantity, unit price and VAT rate of invoice rows. Which columns these are is entirely the customer's choice.
• Item and subitem names, and the status column used by the automation.
• Names and user ids of account users, to show who created an invoice.

From Fortnox, the app reads the connected company's name and organisation number, the customers it looks up or creates, and the status and payment information of the invoices it created.

4. What the app stores

The app stores, per monday.com account:

• The monday.com access token the app receives when a user authorises it, and the Fortnox access and refresh tokens received when the customer connects Fortnox. Both are stored encrypted in monday code secure storage and used only for the calls described in the how-to page.
• Board column mappings: which monday column corresponds to which Fortnox field.
• Links between monday items and Fortnox invoice numbers, with the Fortnox customer number, the time of creation, the user who created the invoice and the last known status and paid date.
• A counter of invoices created per calendar month, used for plan limits.

The app does not store copies of invoices, invoice rows or customer records. Those live in Fortnox and on the customer's boards.

5. What the app sends to Fortnox

Only the customer and invoice fields that the customer has mapped are sent to Fortnox, and only when a user presses Create invoice or an automation the customer set up runs. Fortnox processes this data under the customer's agreement with Fortnox and Fortnox's own privacy terms. The app also calls Fortnox to look up customers and to check whether invoices it created have been paid.

6. Where the data is stored

All app data is stored in monday code, monday.com's own infrastructure for apps, in the data region of the customer's monday.com account. Aldorock AB does not copy the data to its own servers or to any other provider.

Apart from Fortnox, nothing is sent to any third party. The app has no analytics, no tracking, no cookies of its own and sends no emails.

The address apps.aldorock.com/fortnox/callback, which Fortnox uses to return the browser after authorisation, is a redirect served by Cloudflare on our behalf. It forwards the authorisation code to the app and stores nothing.

7. Legal basis

Aldorock AB processes the data on the customer's documented instructions, given by installing and configuring the app. The legal basis for the customer's processing is for the customer to determine. For invoicing, it is typically the performance of a contract with the invoiced customer (Article 6(1)(b) GDPR) and the legal obligation to keep accounting records (Article 6(1)(c)).

8. Retention and deletion

• Data is kept while the app is installed in the customer's account.
• When the customer disconnects Fortnox in the app, the Fortnox tokens are deleted at once.
• When the app is uninstalled, all data stored for that account is deleted automatically within 10 days.
• The customer can ask for earlier deletion, or for a copy of the stored data, by emailing support@aldorock.com.
• Deleting the app's data does not delete customers or invoices in Fortnox, nor values written to the customer's boards. Those are under the customer's control and may be subject to accounting retention rules.

9. Security

• Fortnox is connected with OAuth 2.0 with PKCE. The app never sees the customer's Fortnox password.
• Tokens are kept in monday code secure storage, which encrypts them at rest. Fortnox is only ever called from the app's server, never from the browser.
• All traffic between the browser, monday.com, the app and Fortnox is encrypted with HTTPS.
• Requests from monday.com to the app are verified with monday's signed tokens before anything is read, stored or sent to Fortnox.
• Aldorock AB staff do not have routine access to customer data. Access happens only to resolve a support request from the customer and only to the extent needed.

10. Sub-processors

• monday.com Ltd, as the provider of monday code, hosts the app and its storage.
• Cloudflare, Inc. serves this website and the callback redirect. It does not receive or store customer data beyond the ordinary connection logs of a web request.

Fortnox AB is not our sub-processor. It is the customer's own provider, chosen and contracted by the customer.

11. Your rights

If your data is on a board invoiced through this app, for example as a contact person at an invoiced company, you have the rights under GDPR to access, rectify, erase, restrict and object to processing, and to data portability, towards the controller (the organisation that runs the monday.com account). Please contact them first. Aldorock AB helps the controller to answer such requests. If you contact us directly at support@aldorock.com, we will forward your request to the controller unless you ask us not to.

You also have the right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY), imy.se.

12. Support correspondence

If you email us, we process your name, email address and the content of your message to answer you. We keep the correspondence as long as needed to resolve the matter and to show what was agreed. The legal basis is our legitimate interest in providing support (Article 6(1)(f)).

13. Changes to this policy

We may update this policy when the app changes. The current version is always at apps.aldorock.com/fortnox/privacy with its date at the top. Material changes are announced in the app's marketplace listing.

14. Contact

Aldorock AB, Sweden. support@aldorock.com.