Last updated: 2026-10-16
Who we are
Word Templates to PDF & DOCX, Board to PDF & Excel Reports, Required Fields & Approvals, Recurring Tasks & Templates, Paste from Excel & Bulk Edit, Dashboard Formulas & Pivot, Inventory with QR Codes are monday.com apps made by Red Moso Chrystian Schütz, Poland (ul. Stefana Czarnieckiego 30 lok. 8, 53-651 Wrocław, NIP 8971864233) (“we”). For the data described here we act as a processor on behalf of the monday.com account that installed the app, and as a controller for support correspondence and billing records. Contact: contact@crimsonfern.com.
Scope
This policy covers the Crimson Fern apps on monday.com (Word Templates to PDF & DOCX served from docs.crimsonfern.com, Board to PDF & Excel Reports served from reports.crimsonfern.com, Required Fields & Approvals served from guard.crimsonfern.com, Recurring Tasks & Templates served from recurring.crimsonfern.com, Paste from Excel & Bulk Edit served from paste.crimsonfern.com, Dashboard Formulas & Pivot served from dashboards.crimsonfern.com, Inventory with QR Codes served from inventory.crimsonfern.com) and this website (crimsonfern.com).
What we process
| Data | Details | Stored? |
|---|---|---|
| Board data | Item names, column values, subitems, board and group names of the items the apps work on | Not kept. Read when an app needs it (a document, a report, a rule check, a dashboard refresh, a paste, a scheduled run) and then discarded, except where the rows below say otherwise |
| Generated files (Word Templates to PDF & DOCX, Board to PDF & Excel Reports) | PDF, DOCX and XLSX files | No. Uploaded to your item’s file column on monday.com or downloaded by you; previews kept in memory for 10 minutes |
| Templates (Word Templates to PDF & DOCX) | .docx files you upload | Yes, encrypted, until you delete them or uninstall |
| Saved reports and schedules (Board to PDF & Excel Reports) | Report settings (board, columns, filters, layout), schedules and the item that receives the files; a logo if you upload one | Yes, until you delete them or uninstall |
| Rules and activity log (Required Fields & Approvals) | Rules per board; for each checked status change: item id and name, the status change, the user id of the person who made it, the missing columns and the result | Yes: rules until you delete them or uninstall; the log keeps the last 500 checks per board |
| Templates and run logs (Recurring Tasks & Templates) | Templates (the column values and subitems copied from your template item or group), schedules, the run log of each schedule (last 100 runs), run records of finished runs (a few days) and automation results (at most 500) | Yes, until you delete them or uninstall |
| Paste records (Paste from Excel & Bulk Edit) | For each applied paste: the changed cells before and after, the new items, the rows with errors and the user id of the person who applied it; a pasted table waits in memory for up to 30 minutes | Yes: the last 50 pastes (undo is possible for 30 days); the pasted table: 30 minutes in memory only |
| Widgets and snapshots (Dashboard Formulas & Pivot) | Widget settings (boards, filters, metrics, formulas, targets, pivot layout); snapshot links: the frozen numbers and KPI cards, the pivot and item rows only if the creator opted in, and only a hash of the link secret | Yes: widgets until you delete them or uninstall; snapshots until they expire (1 to 90 days) or are revoked, then removed after at most 30 more days. Board reads are cached in memory for 5 minutes |
| Stock journal and scanner links (Inventory with QR Codes) | Per products board: opening balances and every movement (SKU, location, type, quantity, time, user id or scanner link name, scan id, refusal reason); settings and column mapping; scanner links (a name you choose, expiry, and only a hash of the link secret). A phone keeps its unsent scans in its browser until the server has answered | Yes, until uninstall (the journal is not compacted or trimmed while the app is installed). The movements are also written to a Movements board in your monday account |
| Account identifiers | monday account id, user id of the person who connected the app | Yes, while installed |
| Access token | OAuth token issued by monday.com | Yes, encrypted, while installed |
| Usage & plan | Documents, reports, rule checks, created items, applied rows, widget refreshes or movements per month (as the app’s plan counts them), automation run ids, current plan | Yes, while installed |
| Support e-mails | Your e-mail address and message | Yes, up to 24 months after the conversation ends |
Templates and board data can contain personal data (for example names of people assigned to items). We process it only to provide what you ask the apps to do. We do not sell data, show ads, profile users or use your data to train AI models.
Why (legal bases)
- To provide the app you installed (performance of a contract, GDPR Art. 6(1)(b)), on behalf of your monday.com account.
- To apply plan limits and prevent duplicate automation runs (legitimate interest, Art. 6(1)(f)).
- To answer support requests (legitimate interest) and keep billing records (legal obligation, Art. 6(1)(c)).
Third parties
We use the following providers, and no others, on the front end and back end:
| Provider | Domain | Purpose |
|---|---|---|
| monday.com Ltd. | monday.com, api.monday.com, auth.monday.com | The platform the app runs in; reading boards, saving files, sign-in (OAuth), billing |
| Cloudflare, Inc. | docs.crimsonfern.com, reports.crimsonfern.com, guard.crimsonfern.com, recurring.crimsonfern.com, paste.crimsonfern.com, dashboards.crimsonfern.com, inventory.crimsonfern.com, crimsonfern.com | Network delivery, TLS and protection against abuse (data in transit only) |
The app’s scripts, fonts and styles are served from our own domain. The document engine runs on our servers in the EU; documents are not sent to external conversion services. Billing is handled by monday.com; we never see card details.
Retention and deletion
- Previews: 10 minutes. Pasted tables (Paste from Excel & Bulk Edit): 30 minutes, in memory.
- Paste records: the last 50 pastes per account. Run logs: the last 100 runs per schedule. Snapshot links: until expiry or revocation. Stock journal: until uninstall.
- Templates, tokens, usage and run records: until uninstall. When monday.com notifies us that the app was uninstalled, we delete all data for that account immediately, and in any case within 10 days, unless you have asked us in writing to keep it.
- Technical error logs: capped at 30 MB per app and rotated, without document or board contents.
- Support e-mails: up to 24 months; billing records as required by law.
Security
Encryption at rest (AES-256-GCM) for Word templates and for the monday access tokens of every app. The other data listed above (settings, run logs, paste records, widget settings, stock journals) is stored in files with restricted permissions on our server and is not separately encrypted by the apps. HTTPS for all traffic, signature checks on every request and strict account isolation. Details on our Security page.
Your rights
You can ask for access, correction, deletion, restriction, portability or object to processing by writing to contact@crimsonfern.com. If the request concerns data in your monday.com account, we may forward it to that account’s admin. You can also complain to your data protection authority (in Poland: the President of the Personal Data Protection Office, UODO).
Contact and future contact
Write to contact@crimsonfern.com. We contact users only to answer their requests and, if needed, about service matters (security notices, changes to these terms or the app). We do not send marketing e-mails unless you ask for them.
This website
This website is a set of static pages. It sets no cookies and loads no analytics, advertising or third-party scripts. Fonts are served from this site. Our host processes standard request data (such as IP address) to deliver pages and protect against abuse.
Changes
We will update the date above when this policy changes and, for material changes, notify account admins in the app or by e-mail before they apply.