Privacy Policy
How Candor apps handle personal data — for the monday.com accounts that install them and the people who use those accounts.
Last updated: 24 September 2026
Candor is a suite of monday.com apps operated by datadir s. r. o. ("Candor", "we", "us"). This policy explains what personal data we process, why, and the rights you have. It covers our apps and this website.
1. Who we are
datadir s. r. o., Bauerova 1205/7, 040 23 Košice, Slovakia (IČO 57 582 904; registered at the Municipal Court Košice, section Sro, insert no. 65729/V). Full company details are on our Legal notice. For any privacy question or to exercise your rights, contact support@candor.datadir.co.
2. The two relationships
We process personal data in two distinct roles:
- As a processor, on behalf of a monday.com account that installs one of our apps. The account is the controller of its board, item, and user data; we act on its documented instructions. This is governed by our Data Processing Agreement.
- As a controller, for the account's own administrative and billing data, and for visitors to this website.
3. What we process
| Category | Examples | Role |
|---|---|---|
| Account | monday account and user identifiers, admin contact, plan and billing status (via monday's billing) | Controller |
| Board & item data | Boards, items, subitems, columns and metadata accessed via the monday API to provide the app's function | Processor |
| End-user data | Where an app needs it — an approver's identity, a signer's email, a ticket contact — the minimum required to deliver that feature | Processor |
| Usage & logs | App events, audit-log entries, and technical logs used to operate and secure the service | Controller / Processor |
| Website | Standard request logs; no advertising or cross-site tracking cookies | Controller |
4. Why, and on what legal basis
- To provide the service you or the account asked for — performance of a contract.
- To secure and improve it — our legitimate interest in a reliable, safe product.
- To meet legal obligations — tax, accounting, and responding to lawful requests.
5. Where data lives, and international transfers
Our apps run on monday code, monday.com's own cloud platform, and any data an app stores is held within that infrastructure, in your account's region (US, EU, or AU). We operate no third-party analytics, advertising, or cross-site tracking — we do not send your data to analytics or error-tracking vendors — so we ourselves transfer no personal data outside your account's region. monday.com is our platform sub-processor; its own data-residency and transfer safeguards apply to the hosting. Where you connect an e-signature provider in e-Sign Status, that provider handles the document and applies its own transfer safeguards (for EU data, typically the EU Standard Contractual Clauses). Sub-processors are listed in our DPA; our use of cookies is described in our Cookie notice.
6. Retention
Board, item, and end-user data processed on an account's behalf is retained only while the app is installed, and is deleted after uninstall (see section 8 for the timeline). Billing records are kept for 10 years as required by the Slovak Accounting Act. Technical logs are retained for up to 90 days. Audit-log entries (e.g. Approval Flows' decision log) are retained for the account's chosen retention period, to preserve the record.
7. Your rights
Subject to your role and applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. Account end users should contact their account admin (the controller); we will assist that account. Admins and website visitors can contact us directly at support@candor.datadir.co; we respond within one month. You may also complain to the Slovak supervisory authority — the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), dataprotection.gov.sk — or to the authority in your own country.
8. Uninstall & deletion
When an app is uninstalled or deauthorized, we delete the personal data we process for that account within 10 days, and in any event within 30 days of termination, except where the law requires us to keep certain records (e.g. billing). You can also request deletion at any time.
9. Where we offer the service
Our apps are offered to business customers that use monday.com. datadir s. r. o. is established in the European Union and we are not currently established in, or targeting, the United Kingdom; if that changes we will appoint a UK representative as required under the UK GDPR. This policy is written to meet EU GDPR, which we apply as our baseline for all users.
10. Changes
We'll post any changes here and update the date above. Material changes affecting accounts will be notified by email.