Privacy Policy — 1Inbox

Welcome to Inbox – Emails and Messages App, an application available on the monday.com Marketplace, which enables you (the "User", "you") view, send, and manage your Gmail Conversations directly through monday.com boards (the "Boards") (the "Application"). Through the Application, you can enter your email address in the designated Email column or field on your Board. Once configured, the Application uses the Gmail API to retrieve in real time your Gmail Conversations, displaying them directly within the corresponding Board view, and allowing you to send new Email Messages directly from monday.com, in accordance with your configurations and preferences (the Application and the related features and functionalities it provides are referred to collectively as the "Services"). The Application and the Services are operated under the brand Pioneera.io, which is owned and operated by Alayof Digital Ltd. (the "Company", "we", "us").

This document constitutes the privacy policy (the "Policy") which governs the use of the Application and the Services and describes our practices regarding the collection, storage, use, processing, disclosure and securing of the information we collect from and relating to you when you use the Application and the Services. This Policy applies to the Application and the Services, as well as to any related communications exchanged between you and us with respect thereto.

Please read this Policy carefully and make sure that you fully understand it and agree to its contents. By accessing, installing, or using the Application and the Services, you agree to be bound by this Policy. You may not use the Application and the Services if you do not agree to the Policy.

This Policy supplements the Application's general End User Terms of Use (the "Terms of Use") available at: https://www.pioneera.io/apps/1inbox/terms-of-use. Unless otherwise defined herein, all capitalized terms defined in the Terms of Use shall have the same meaning herein.

General

We will not collect or use personal data for purposes other than those described in this Policy.

You are not legally required to provide us with any personal data and may do so (or avoid doing so) with your own free will. If you do not wish to provide us with your personal data or to have it processed by us or any of our third-party Service Providers (as defined below), please avoid any interaction with us including using our Services. Without providing us with the requested data, you will not be able to use the Application.

Note that those aspects of this Policy which are mandated by the EU General Data Protection Regulation (the "GDPR"), in particular any rights (such as Data Subject rights detailed below) and duties conferred by GDPR, will apply only to the extent that the GDPR applies. Capitalized terms not otherwise defined herein take their meaning in GDPR.

For the purposes of this Policy, 'personal data' shall mean any information relating to a natural person who can be identified by reference to such data, or as defined by applicable privacy laws. Such personal data does not include anonymized data kept in such a manner that it may not, under reasonable means, be used to identify its subject(s).

What kind of data do we collect, and how do we collect it?

Information collected during your use of the Application

To enable the Application to function correctly and provide you with the Services, we require access to certain information contained on your monday.com Boards and on your Gmail Conversations (including their related Email Threads and Email Messages), which may contain personal data, as explicitly approved by you when installing and activating the Application through the monday.com Marketplace and when you first authorize the Application to connect to your Google Account, including through the Google OAuth authorization screen.

When you use the Application to access, manage, and view your Gmail Conversations directly within your Boards, and subject to your granting us the requisite authorizations (including the standard authorization flows provided by monday.com authorization flow and the Google OAuth authorization flow presented by Google LLC), we access, collect, and process the following information from your monday.com Account and Gmail Account:

Information accessed from Gmail/Google Account

• Any data and metadata connected to your Gmail Conversations you access through your Board such as: messages metadata (message ID, thread ID, labels, timestamps); message sender and recipient fields; message subject; Message body content (plain text or HTML); system labels and user labels; and thread structure (conversation hierarchy), including, without limitation, updates and changes to such data.
• Google user identifiers, such as user ID, username, or display name.
• OAuth tokens issued through your Google Account that enable the Application to access and update your Gmail Conversations.
• Any other general metadata required to link the Application with your Google Account. For clarity, while the Application has the technical ability to access attachments through the Gmail API authorization scope, it does not display, store, or otherwise use any attachment data or content. Accordingly, attachment information (including file names, MIME types, content, or metadata) may technically appear in Gmail API responses but is not used, stored, or made visible or accessible within your monday.com workspace via the Application.

Information accessed from monday.com

• Any content of all monday.com Boards accessible from your monday.com Account.
• The names and technical identifiers of all monday.com Boards accessible from your monday.com Account, such as board name and ID, workspace name and ID, items name and ID, and similar technical identifiers used to link your Gmail Conversations and Boards.
• Metadata required for linking and displaying your Gmail Conversations within your Boards, such as Board ID, workspace ID, user ID, and webhook configuration, retrieved from monday.com to establish and maintain the connection between your Gmail and the selected Board.
• User and account-level information to the extent required to operate the Services, which may include: user ID, name, username, account slug, account ID, whether the user is an admin, the number of users in the account, the account tier level, the user's country, and other general account metadata necessary to link the Application with your monday.com workspace.

The information described above is accessed and processed by us solely to enable the Application to display your Gmail Conversations as a Board-level view within monday.com, to facilitate the sending of your Email Messages, and to provide you with the Services, according to your configuration, preferences, and instructions.

Temporarily processed data: The following data is not stored by us, but processed temporarily only as needed to retrieve and display your Gmail Conversations within your Boards and to enable sending of your Email Messages:

• From monday.com: Board names, Board configuration (columns), item names, workspace metadata, and any other Board content.
• From Gmail/your Google Account: metadata, Email Message content, and Email Thread data.

All Gmail data is accessed in real time via the Gmail API solely while you are using the Application. When you perform actions within the Application (such as viewing, replying to, or sending Email Messages), the relevant Gmail information is transmitted securely through our systems and temporarily processed only for the time needed to complete that action. This processing allows the Application to function properly but does not involve saving or storing any Gmail content. For more information regarding temporary storage mechanisms used to improve performance (such as cache), please see the "Cache" section below.

No Gmail Conversation content is stored or retained on our systems.

Stored Technical Data: We store only the minimum amount of technical data necessary for such purpose, such as:

• From monday.com: monday.com account ID, monday.com user ID, user country, user role, user subscription scheme, plan ID, account tier, account slug, account max users, timestamp, renewal data, is trial plan, billing period, pricing version, and uninstall data.
• From Gmail/your Google Account: Full name (AES-256-GCM encrypted), Identity (Email address - AES-256-GCM encrypted), Email address hash; Google API access token (AES-256-GCM encrypted), and Google API refresh token (AES-256-GCM encrypted) from your Google Account.

Information collected upon installation

• When you install the Application through the Marketplace, we collect the following personal data from monday.com: your name, email address, monday.com Account URL, and monday.com Account ID, whether or not the user that installed the Application is an admin, your monday.com username, the number of users in the account and the account tier level and any other general metadata required to link the Application with your monday.com workspace. Additionally, we collect non-personal data such as whether you are an admin on the monday.com Account and, if applicable, the number of users on the admin account.
• When you first activate the Application you will be required to connect and verify your Google Account and we will collect the following personal data from your Google Account and Gmail: your Google user ID, username or display name, primary email address, full name as available via the Google 'profile' scope, the tokens or credentials issued when you authorize the Application to access the Gmail Conversations. We also collect any other general metadata required to link the Application with your Google Account. Additionally, we may collect non-personal data such as whether your Google Account is part of a managed Google workspace domain and related account configuration information.

Please note that if the Boards' name, Gmail Conversations subject, Gmail Conversations and/or any metadata or User data collected as part of the Services contain personal data of your end-users and/or clients and/or any of your employees, contractors, or representatives and/or any other person (the "Associated Individuals"), you hereby represent and warrant to us that: (i) you possess the requisite authority to provide and grant access to information regarding Associated Individuals; (ii) you have obtained all necessary consents, permissions, and authorizations from Associated Individuals for our access to and use of their personal data as described herein.

For the avoidance of doubt, other than the aforementioned information, we don't have access to any other information contained within your monday.com Account, Google Account, Boards, or Gmail correspondence.

While we have access to the monday.com Account information specified above to enable the Application's functionality, we do not retain or store any data beyond what is necessary for the Application to perform its intended functions and provide you with the Services.

While we have access to your Google Account information specified above to enable the Application's functionality, we only retain the minimal technical identifiers and OAuth tokens necessary to operate the Services, and no Gmail Conversations is permanently stored.

In all cases, our use of Google user data obtained via Gmail or related Google API Services is strictly limited to providing and improving the user-facing features of the Application, as configured by you. We do not sell Google user data, do not use it for advertising purposes, and do not allow human access to such data except where reasonably necessary for providing support at your request, for security or fraud-prevention purposes, or to comply with applicable law.

Information provided by you

• You may give us personal data about you when you provide us your contact details or when you communicate with us by phone, e-mail, live chat (via our website, available at: https://www.pioneera.io/) (the "Website"). The information you give us may include your name, address, e-mail address, phone number, occupation, company name, and other personal data you choose to provide. We may monitor and record phone calls, e-mails, live chats, or other communications between you and our representatives.
• You may grant us full access to your Boards or Gmail Conversations (including their associated Email Threads and Email Messages), so that we can provide you with Application support. This access is granted solely by your explicit affirmative action through your monday.com Account or Google Account.
• For the avoidance of doubt, you are not legally required to provide us with this data and may do so (or refrain from doing so) with your own free will. Without providing us with this data, we will not be able to support you.

Information we collect about you

• When you use the Application or the Services, we may automatically receive and record information from your device and browser, including your Cache information, country, regional and language settings, device model, operating system, mobile carrier and other software and hardware attributes.
• In addition, we may automatically collect and store the following information for statistical purposes: technical information, including the Internet protocol (IP) address used to connect your computer or device to the Internet, browser type and version, time zone setting, operating system and Application; information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our Services (including date and time); page response times, download errors, length of visits to certain pages, page interaction information.
• To operate and bill for the Services, we collect limited usage data, such as the number of Email Messages you send through the Application each month and the date your current monthly usage period began. This information is linked to your user account for billing and service management purposes only.
• Information collected via Cache: We use Cache on the Application. For more information, see the Cache section below.
• We may also collect non-personal data consisting of technical and aggregated usage information. We may gather non-personal information solely to examine our customers' interactions with the Services, and to ensure proper operation of the Application.
• Sensitive personal data: We do not intentionally collect sensitive personal data (for example, information revealing race, ethnic origin, political opinions, religion, medical data, etc.), and we require our customers not to provide us with such information. In particular, as further specified in the Terms of Use, you are prohibited from uploading, transferring, or processing any Protected Health Information ("PHI") subject to the Health Insurance Portability and Accountability Act, as amended ("HIPAA"), through the Application and the Services, unless you first obtain our prior written consent.

Limitation of Personal Data Collection

The personal data we collect in connection with the Application and the Services is strictly limited to the information described above. We do not access or collect personal data beyond what is explicitly outlined herein.

However, you hereby acknowledge and understand that your personal data is also collected, stored, and processed by monday.com on which our Application operates, and by Google LLC, which operates Gmail and the Google APIs. The collection, use, and storage of personal information by monday.com and Google LLC are not under our control or responsibility and are subject to monday.com's and Google LLC's privacy policy and any other relevant policies of monday.com or Google LLC. We expressly disclaim any responsibility for the collection, use, or storage of personal information by monday.com or Google LLC beyond the scope of the Services provided by our Application. For information regarding the collection, use, and storage of personal information by monday.com, please refer to the monday.com privacy policy. For information regarding the collection, use, and storage of personal information by Google LLC, please refer to https://policies.google.com/privacy.

We do not sell any personal data or any Google user data. We do not share Google user data with third parties for advertising, profiling, or similar purposes. Our use of Google user data obtained via Google API Services is limited to providing and improving user-facing features that you configure. We do not build, maintain, or use independent user profiles unrelated to your configuration of the Application. We do not allow human access to Google user data except (i) when strictly necessary to provide support at your request, (ii) to investigate security issues, or (iii) to comply with applicable law.

The Legal Bases for Data Processing

We process personal data on different legal bases:

• Consent; e.g., by using the Application and the Services, you consent to the collection and processing of your personal data by us.
• Where we have a legitimate interest, e.g., managing our business, or defending ourselves from claims, subject to such processing not overriding your own rights and freedoms.
• As necessary to comply with laws or regulations that apply to us.
• Exceptionally, when necessary, in the public interest, for example, when law enforcement agencies request information to investigate a crime.

For what purpose do we collect data?

We collect and process your data for the following purposes:

• To facilitate, operate, and provide you with the Application and Services, and to carry out our obligations arising from any contracts entered into between you and us.
• To communicate with you for the purpose of allowing you to use the Application and/or Services or in connection therewith.
• To technically facilitate and execute the retrieval and display of your Gmail Conversations within your Boards, and to facilitate the sending of your Email Messages, as per your configuration and instructions.
• To operate the Services and provide the Services and guarantee their use and improvement, including responding to support requests and other inquiries about our Services, sending notifications about changes to our Services and providing information that is relevant to the use of the Services.
• To develop, improve the performance of, and secure our Services.
• To detect, prevent, and otherwise thwart any malfeasance to the Services.
• As necessary to comply with legal obligations that we or you are or may be subject to under any applicable law.
• To make aggregated usage statistics on Users of the Services.
• Protect and enforce our rights, privacy, and security, safety, systems, and property, or those of other persons, and resolve disputes.
• To notify you about changes to our Services and provide information that is relevant to your use of the Services.
• To support and enhance our data security measures, including for the purposes of preventing and mitigating the risks of fraud, error or any illegal or prohibited activity.
• Notifications and Promotional Communications: we may send you notifications, messages, and other promotional updates about new services, features, and offerings, or any other information we think you may find valuable. We may provide such notices via pop-up messages through the Application or via email. If you do not wish to receive such promotional communications, you may notify us at any time by sending an e-mail to support@pioneera.io, or by following the "unsubscribe" instructions contained in the promotional communications you receive. You hereby confirm and agree that in the event of your unsubscribing as described herein, we may send you additional notifications, solely for the purpose of requesting feedback regarding your use of the Application.
• In order to exercise our rights, and to defend ourselves from claims, and to comply with laws and regulations that apply to us or third parties with whom we work.

With respect to data obtained through Google API Services, our use is further limited to providing and improving the specific user-facing features of the Application that you configure (such as displaying your Gmail Conversations within your Boards and enabling the sending of your Email Messages directly from monday.com). We do not use such data for advertising, profiling, or independent analytics unrelated to your use of the Application.

Recipients of personal data

We may disclose certain personal data to the following recipients:

• Third party service providers for operational and business purposes with respect to the Application or the Services, to enable the operation of the Application or Services, and with other service providers who provide functions such as: customer management applications, hosting service providers, analytics partners and security. Such service providers will be bound by law or contract to protect the personal data and only use it in accordance with our instructions.
• Other third parties, when it is required to satisfy applicable laws or to respond to a lawful request for information, such as in response to a subpoena, including to law enforcement agencies and courts.
• Our affiliated companies, which may use it only for the purposes listed in this Policy.
• In the event that we go through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of the Company's assets, your personal data may be among the assets transferred, subject to restrictions similar to those contained herein or as otherwise required by applicable law.
• Where needed to support external auditing, compliance, and corporate governance functions.

We may also use and disclose information that is not personal data. For example, we may publish reports that contain anonymized and statistical data about our Services. These reports will not contain any identifiable information. We may also use third-party analytics tools regarding such non-personal data in order to create analytics and reports and examine our customers' usage patterns.

To the extent we use or store any Google user data obtained via Google API Services, we will not make that data available to third parties who do not also abide by equivalent data protection and data portability obligations.

Data Storage and Retention

We may retain communications with you in order to process your inquiries, respond to your requests, and improve the Services. We will retain your personal data only for as long as is reasonably necessary to fulfil the purposes outlined in this Policy and to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e. as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use).

Please note that we do not store or retain any content retrieved from your monday.com Boards or Gmail Conversations, via the Application (such as task data, Email Messages content, or files), beyond what is technically required to perform the reflection of your Gmail Conversations as a Board-level view and to enable the sending of your Email Messages, as described above. All data from Gmail Conversations (including related Email Threads and Email Messages) is accessed in real time via the Gmail API solely while you are using the Application. When you perform actions within the Application (such as viewing, replying to, or sending Email Messages), the relevant Gmail information is transmitted through our systems and temporarily processed only for the time needed to complete that action. This processing allows the Application to function properly but does not involve saving or storing any Gmail content. For more information regarding temporary storage mechanisms used to improve performance (such as cache), please see the "Cache" section below. No Gmail Conversation is stored or retained in our systems.

We may, however, store certain technical identifiers and authentication data (specifically, Board ID, User ID, and AES-256-GCM encrypted OAuth token) necessary to maintain the authorized connection to your Google Account for as long as your use of the Application requires such connectivity. These identifiers are retained solely to maintain the reflection of your Gmail Conversations as a Board-level view, sending your Email Messages and ensure reliable operation of the integration. Such OAuth tokens are stored using appropriate technical and organizational security measures and are used solely to operate the Services in accordance with this Policy and the Terms of Use.

You may at any time revoke the Application's access to your Google Account by visiting your Google Account permissions page at https://myaccount.google.com/permissions. Upon revocation or deletion of the integration, all retained identifiers and OAuth tokens associated with your Google Account will be deleted within a reasonable period.

Please note that, except as required by applicable law or our specific agreements with you, we are not obligated to retain your data for any particular period, and we reserve the right to securely delete it or restrict access to it for any reason and at any time, with or without notice to you.

Cross-Territorial Data Transfers

We may store and process information in various locations worldwide, including through cloud services. The laws in such other countries may provide different data protection rights than the laws of your own country. In such cases, we will take steps to ensure a proper level of protection of personal data as required by applicable law. You agree to the transfer of your personal data to such other countries for the purpose of the processing as described in this Policy, including through cloud services.

Cache

The Application may use cache and the browser's LocalStorage – small data files that are stored in your electronic device through your web browser – to enhance its functionality and performance ("Cache"). Cache helps to load previously accessed data more quickly, improving your experience in using the Application.

We use Cache to ensure the Application operates efficiently and to improve your experience while using it, and only for the minimal amount of time needed for this purpose. You can clear the Cache in your device's or browser's settings, depending on how you access the Application. However, please note that clearing the Cache may impact on your experience while using the Application and can affect the functionality and performance of the Application.

By continuing to browse the Application, you acknowledge and accept the use of Cache as described in this Policy.

Information Security

We implement measures to reduce the risks of damage, loss of information and unauthorized access or use of information. These measures do not provide absolute information security. We therefore cannot guarantee, and you may not expect, that the Application and the Services will be immune to information security risks.

Your Privacy Rights

Where applicable under the provisions of the applicable privacy protection laws, you may have certain rights in connection with your personal data and how we handle it. Some of these rights may be subject to certain exceptions or limitations in accordance with applicable law. The following is a non-exhaustive list of certain privacy rights you may exercise:

• Right to access your information – a right to obtain a copy of your personal data retained with the Company. You may contact the Company as provided below, and request access to the personal data we hold about you.
• Rectification – a right to rectify inaccurate or incomplete personal data or erase it, where applicable.
• Deleting or restricting access to your personal data. You may request to delete or restrict access to your personal data. We may postpone or deny your request if your personal data is in current use for providing services or for other legitimate purposes, in which case we will let you know if we are unable to do so and why.
• Right to data portability.
• Right to object to processing.
• Right to lodge a complaint with a supervisory authority.

If you have any concerns and/or questions about how we process your data, you are welcome to email us at support@pioneera.io. We will look into your request and endeavor, as reasonable, to resolve any concerns you may have.

Children

The Services and the Application are not intended for or directed towards children ("Minors", the definition of which may vary depending on applicable law). We do not knowingly collect personal data from Minors. If a parent or guardian believes that his or her child has provided us with personal data, they should contact us using the details provided hereunder.

Changes to the Policy

This Policy may be amended from time to time. In such a case, we will notify you and publish the amended Policy in all official locations where this Policy appears, including: (i) the listing page of the Application in monday.com Marketplace; (ii) our Website; and (iii) the Google authorization screen presented when you connect the Application. Your continued use of the Services and the Application after the effective date of the amended Policy constitutes your consent to the amended Policy. Upon the effective date of the amended Policy, the previous version of this Policy will cease to apply. If you do not accept the amended Policy, you may not continue to use the Application and the Services. Without derogating from the generality of the foregoing, if we make any material changes to the way we access, use, store, or share Google user data obtained through Gmail or related Google API Services, we will provide you with clear notice of such changes and, where required under applicable law or Google's Terms, obtain your affirmative consent before applying them.

Contact Us