Beacon
Privacy Policy
Beacon is an SLA-tracking app for monday.com, published by Zolvus. This policy explains what data Beacon processes, why, and the choices you have. We designed Beacon to hold as little of your data as possible — only the identifiers needed to count down your service targets.
On this page
1. Who we are
Beacon is operated by Cyril Protat EI, a sole trader (entrepreneur individuel) registered in France under SIREN 512 867 730 (SIRET 512 867 730 00016, VAT FR 66 512 867 730), trading as Zolvus ("Zolvus", "we", "us") — an independent developer of focused apps for monday.com.
Cyril Protat EI is the data controller for the personal data described in this policy. We are not affiliated with, or endorsed by, monday.com Ltd. You can reach us — including to exercise any of your rights — at contact@zolvus.dev.
2. What data we collect
Beacon is installed on your monday.com account through monday's OAuth flow. Once installed, Beacon processes:
- monday identifiers — your monday account (workspace) ID, and the board and item IDs Beacon is configured to track.
- User identifiers — the monday user IDs of item assignees and of the people you designate as escalation recipients, so Beacon can notify the right person when a target is at risk or breached. When admins pick recipients in settings, Beacon reads the list of users on your account (name and user ID) to populate the picker.
- SLA configuration — the settings you enter: column mappings, business-hours calendar, timezone, holidays, per-priority durations, pause/resolution statuses and escalation rules.
- SLA event history — records of thresholds crossed, pauses, breaches and resolutions for tracked items, kept as a compliance log.
- OAuth access token — the token monday issues when you install Beacon, used solely to call the monday API on your account's behalf.
What we deliberately do not store. Item names and board content are resolved live in your browser and are not persisted on our servers. Beacon does not read your item descriptions, updates or files beyond the columns you map for SLA tracking, and it never processes payment-card data — billing is handled entirely by monday.
3. How we use your data
We use the data above only to run the SLA engine you configured:
- compute SLA deadlines in your business hours and count them down;
- write SLA status, deadline and remaining-time values back to your board;
- notify assignees and escalation contacts when a threshold is crossed;
- send each user an optional daily digest of their at-risk and breached items;
- keep a breach history for your own reporting and compliance;
- identify your account and the installing user during OAuth install.
We do not sell your data, we do not use it for advertising, and we do not use it to train machine-learning models. Beacon's engine is fully deterministic and uses no AI or LLM.
4. Legal basis (GDPR)
Where the EU/UK GDPR applies, we process your data on the basis of the performance of a contract (providing the Beacon service you installed and, where applicable, subscribed to) and our legitimate interests in operating, securing and supporting the app. For your organisation's own employees whose IDs are processed, your organisation is the controller and Zolvus acts as a processor on its instructions.
5. Who we share data with
We share data only with the parties needed to run Beacon:
- monday.com — Beacon runs on the monday platform; all board reads and writes, notifications and billing flow through monday's API under monday's own privacy policy.
- Infrastructure providers — reputable cloud hosting and database providers that store Beacon's configuration and event data on our behalf, bound by data-processing agreements.
We may disclose data if required by law, or to protect the rights, safety and security of Zolvus, our users or the public. We do not otherwise transfer your data to third parties.
6. Data retention
We retain your configuration and SLA history for as long as Beacon is installed on your account, so the service keeps working and your compliance history stays available. When you uninstall Beacon, your configuration, SLA history and stored access token are deleted immediately and automatically, and in any case within 10 days; the same applies when you ask us to delete your data. We keep nothing afterwards, except where we must retain limited records to meet a legal obligation.
7. How we protect your data
- All traffic to and from Beacon uses HTTPS/TLS.
- Data is strictly isolated per account — one account can never read another account's data.
- Access tokens are kept server-side and are never exposed to client-side code.
- We retain only the minimal data required to operate the SLA engine.
No method of transmission or storage is completely secure, but we work to protect your data using industry-standard safeguards and continue to harden them over time.
8. International transfers
Your data may be processed in countries other than your own, including within the monday.com platform and our hosting providers' regions. Where data leaves the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
9. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email contact@zolvus.dev. If Zolvus acts as a processor for your organisation, we will refer your request to that organisation (the controller). You also have the right to lodge a complaint with your local data-protection authority.
10. Changes to this policy
We may update this policy as Beacon evolves. We will change the effective date at the top and, for material changes, provide notice through the app or by email. Continued use of Beacon after a change means you accept the updated policy.
11. Contact us
Questions or requests about privacy? Email contact@zolvus.dev and we'll get back to you.