Privacy Policy
This policy explains what information the HANKO: Client Approvals app (the "App"), operated by Koshi Osaki ("we", "us"), handles when you use it with monday.com, and what your approval recipients see. Questions: k.osaki@dokokichi.com.
Who this applies to
- Customers: people and organizations that install the App in a monday.com account.
- Recipients: people who open an approval link a customer sent them. Recipients do not need an account.
Information we process
| Data | Why |
|---|---|
| monday.com account ID and the ID of the user who created a request or saved settings | Keep each account's data separate and attribute actions. |
| Approval requests: board and item IDs, item name, recipient name you enter, your message, names and IDs of the files you include, status, expiry, and the response (approve or request changes, the comment, timestamp) | Show the approval page to the recipient, record the answer, and list requests for you. |
| Settings: status column ID, labels, brand name, accent color, default expiry | Write results back to your board and style the recipient page. |
| An OAuth access token for your monday.com account, stored encrypted | Update the item's status and post an update when a recipient responds, when no monday.com user is present. |
| Technical data such as IP address and request logs | Rate limiting and operating the service securely. Our hosting provider may also log requests. |
We do not collect the recipient's name, email address or any account details. The only text a recipient provides is the optional or required comment they type, and any identifying information they choose to include in it. We read only the items and files that a customer explicitly includes in a request; the rest of the board is not shown to recipients.
Payment is handled by monday.com. We do not receive or store payment card details.
How we use information
Only to provide the App: displaying approval pages, recording responses, updating your board, enforcing plan limits, preventing abuse, and giving support. We do not sell personal information, do not use it for advertising, and do not use it to train AI models.
Contact: We do not send marketing emails. We may contact you only about your use of the App, such as support replies, security or service notices, and changes to these policies.
Approval links and recipients
- Each link contains a long random token. Anyone who has the link can view that one request and answer it, so customers should send it only to the intended recipient.
- Links expire (14 days by default, set by the customer), can be withdrawn by the customer, and stop working after the request is answered.
- The App does not send any email. Customers deliver links themselves.
- Recipient pages are marked so search engines do not index them and do not send the link to other sites as a referrer.
- Attached files are fetched from monday.com through short-lived URLs when the page is viewed; we do not copy files to our own storage.
Where data is stored and who processes it
The App is hosted on monday.com's monday code platform, and data is stored in its managed database. monday.com therefore acts as our infrastructure provider, and your use of monday.com is covered by monday.com's own terms and privacy policy. We do not share data with other third parties, except where required by law.
Security
Requests to the customer-facing part of the App are verified using signatures issued by monday.com. Data is scoped to the monday.com account that created it, the stored OAuth token is encrypted, and traffic uses HTTPS.
Retention and deletion
- When a customer uninstalls the App, we delete that account's approval requests, settings and stored OAuth token. Approval links stop working at the same time. Deletion is triggered by monday.com's uninstall notice and happens well within 10 days.
- Cancelling a paid plan alone does not delete data.
- Customers can ask us to delete data earlier by emailing k.osaki@dokokichi.com. Recipients can email the same address to request deletion of a response, including the link they received.
- Server logs are kept only as long as needed for security and troubleshooting.
Your rights
Depending on where you live (for example under the GDPR or CCPA), you may have rights to access, correct, delete or export your data and to object to certain processing. Email us and we will respond within 30 days. For data entered by a customer about its own recipients, the customer is the controller and we act as its processor; we will help customers meet their obligations.
Children
The App is intended for business use and is not directed to children.
Changes
We may update this policy. The effective date above shows the latest version, and material changes will be notified through the App or by email to the account contact.
Contact
Koshi Osaki · k.osaki@dokokichi.com