Privacy policy for Timesheet Approvals

This policy explains what the Timesheet Approvals app for monday.com does with personal data. Version dated 2026-11-07.

1. Who we are

The app is provided by Aldorock AB, a company registered in Sweden. Contact: support@aldorock.com. Company site: aldorock.com.

2. Roles under GDPR

The organisation that installs the app in its monday.com account (the customer) decides why and how working time is tracked and approved. The customer is therefore the controller. Aldorock AB processes personal data only on the customer's behalf and instructions and is the processor (Article 28 GDPR). A data processing agreement is available on request from support@aldorock.com.

monday.com Ltd is the customer's processor for the monday.com platform under monday.com's own terms and privacy policy. This policy covers the app only.

3. What the app reads

When a user opens the app, it reads the following from the customer's monday.com account through monday's API, limited to the boards where the app has been added:

• Entries in the chosen time-tracking column: the user who tracked, start and end time, duration, and the item they belong to.
• Item names, group names and the board's structure, so the timesheet can show what the time was spent on.
• Names and user ids of the people in the account who appear in the entries or are chosen as approvers.

The time-tracking column is read-only through monday's API. The app cannot and does not create, change or delete tracked time.

4. What the app stores

The app stores, per monday.com account:

• Approval states for each person and week (open, submitted, approved, rejected), with the user id of the person who changed the state, the time of the change and any rejection reason.
• Billable flags per time entry.
• Approved snapshots: for each approved week, the item id, entry id, user id and number of seconds of every entry, used to detect later changes.
• Board settings: the chosen time-tracking column, week start and approvers.
• The monday.com access token the app receives when a user authorises it, stored encrypted in monday code secure storage and used only to read the boards and store the data above.

The app does not store time entries beyond the snapshot fields listed, does not store email addresses, and does not read columns other than the ones named above.

5. Where the data is stored

All app data is stored in monday code, monday.com's own infrastructure for apps, in the data region of the customer's monday.com account (for example the EU region for EU accounts). Aldorock AB does not copy the data to its own servers or to any other provider.

Nothing is sent to any other third party. The app has no analytics, no tracking, no cookies of its own and sends no emails.

6. Legal basis

Aldorock AB processes the data on the customer's documented instructions, which are given by installing and configuring the app. The legal basis for the customer's processing is for the customer to determine. Typically it is the customer's legitimate interest in recording, checking and invoicing working time (Article 6(1)(f) GDPR) or the performance of the employment or service contract with the person whose time is tracked (Article 6(1)(b)).

7. Retention and deletion

• Data is kept while the app is installed in the customer's account.
• When the app is uninstalled, all data stored for that account is deleted automatically within 10 days.
• The customer can ask for earlier deletion, or for a copy of the stored data, by emailing support@aldorock.com.
• Deleting the app's data never affects the tracked time in the customer's boards, which remains in monday.com.

8. Security

• Data is stored in monday code storage, which is scoped to the customer's account and reachable only with that account's token.
• Access tokens are kept in monday code secure storage, which encrypts them at rest.
• All traffic between the app, monday.com and the browser is encrypted with HTTPS.
• Requests from monday.com to the app are verified with monday's signed tokens before anything is read or stored.
• Aldorock AB staff do not have routine access to customer data. Access happens only to resolve a support request from the customer and only to the extent needed.

9. Sub-processors

monday.com Ltd, as the provider of monday code, hosts the app and its storage. No other sub-processor is used.

10. Your rights

If your time is tracked in a monday.com account that uses this app, you have the rights under GDPR to access, rectify, erase, restrict and object to processing, and to data portability, towards the controller (your employer or the organisation that runs the account). Please contact them first. Aldorock AB helps the controller to answer such requests. If you contact us directly at support@aldorock.com, we will forward your request to the controller unless you ask us not to.

You also have the right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY), imy.se.

11. Support correspondence

If you email us, we process your name, email address and the content of your message to answer you. We keep the correspondence as long as needed to resolve the matter and to show what was agreed. The legal basis is our legitimate interest in providing support (Article 6(1)(f)).

12. Changes to this policy

We may update this policy when the app changes. The current version is always at apps.aldorock.com/timesheet/privacy with its date at the top. Material changes are announced in the app's marketplace listing.

13. Contact

Aldorock AB, Sweden. support@aldorock.com.