What applies to ImageForm in addition to the general terms of AppTool15.
This is an English courtesy translation. The German version of this page is the legally binding text; in case of any discrepancy, the German version prevails.
Version 1.4, in effect from 18 February 2024
This supplement applies together with the general terms of service of AppTool15. Where the two differ, this supplement prevails for ImageForm. Terms defined there have the same meaning here.
ImageForm lets you build forms in which images serve as answer options, publish them as a public link, and have each response written to a board in your monday.com account as an item. The app creates the columns a form needs, in the type that matches the question, and never renames or overwrites columns you already have.
ImageForm runs on our servers and communicates with monday.com through their API, using the access you grant during installation. It is not a product of monday.com, and monday.com does not endorse it.
Installing the app and granting it access are two separate steps. Until you grant access, ImageForm cannot read or write your board. The permissions we ask for are limited to reading your profile, reading your boards, and writing to your boards.
People filling in your forms need no monday.com account and never see your board. Anyone holding a form link can submit a response unless you protect the form with a password, close it on a date, or switch it off — all three are in the app.
Users with view-only permissions in monday.com cannot use the app, because monday.com does not grant them API access.
Every new account starts with a 14-day trial. When the trial ends, the account continues on the free plan; nothing is deleted and nothing is charged.
What separates the plans is the number of forms you may run at the same time. Every paid plan has the same features, so moving to a smaller plan never costs you a capability. One board holds one form, so the number of forms is really the number of boards you collect responses on. The figures that apply are shown in the account menu inside the app and on our documentation page.
The free plan also limits how many responses you may collect per calendar month. Paid plans carry a generous ceiling that normal use does not reach; it exists to prevent misuse, not to meter your work. The same applies to storage.
Only responses that reached your board are counted. If a response could not be delivered — a deleted board, a withdrawn permission, an outage at monday.com — it does not count against your quota.
If your account holds more forms than your plan covers — after moving to a smaller plan, for instance — the oldest forms stay active and the rest are put on hold. Nothing is deleted: a form on hold can still be opened, edited, and saved to a file, it simply stops accepting responses. It becomes active again as soon as you move to a larger plan or delete an older form.
Where you obtained the app decides how it is billed. Through the monday.com marketplace, plans are sold and billed there under their terms, and you cancel there. Booked directly with us from inside the app, section 6 of our Terms of Service applies.
If you booked directly with us, you change your plan in the customer portal, which you reach through the account menu in the app. A larger plan takes effect immediately; the difference for the rest of the current period is calculated pro rata and charged at once. Moving to a smaller plan, or from yearly to monthly billing, takes effect once the period you have paid for has run out — you keep what you paid for until then.
While ImageForm is not listed in the monday.com marketplace, paid plans are booked directly with us. Once it is listed, we will move existing contracts to billing through monday.com; the notice period, your right to terminate, and the credit for fees already paid are set out in section 6 of our Terms of Service.
We store what the app needs to work: your forms and their design, the images you upload, the responses you collect, and the link between a question and the board column it writes to. Your monday.com access token is stored encrypted.
Where your forms collect personal data, you are the controller and we act on your behalf. You decide what your forms ask for, and you are responsible for informing the people who fill them in.
Images you remove from a form are kept for two weeks before they are deleted, so that undoing a change brings them back.
If you pay for a plan directly with us, you enter your payment details directly with our payment provider Stripe. We never see them and do not store them. From Stripe we receive only what we need for billing and activation: your plan, the payment status, invoices, and a short description of the payment method, such as the card brand and last four digits.
When you uninstall ImageForm or withdraw its permissions, your monday.com access token is deleted immediately. Your forms, uploaded images, and stored responses are deleted permanently within ten days.
Items already written to your monday.com boards belong to you and remain untouched — they are in your account, not ours. The columns the app created stay as well. Export anything else you still need before you uninstall.
If you booked a plan directly with us, uninstalling cancels it automatically at the end of the period you have paid for; nothing is charged after that. There is no refund for the rest of the period.
ImageForm is built on the API and SDK of monday.com. All rights in those remain with monday.com. Nothing in these terms transfers any of them to you.
You may not reverse engineer, decompile, or disassemble ImageForm or the monday.com components it contains, except where mandatory law expressly allows it.
monday.com gives no warranty for ImageForm. The app is not a product of monday.com, is not endorsed by monday.com, and is provided by us alone.
monday.com is not liable for any damage arising from your use of ImageForm, on any legal basis. Claims concerning the app are directed to us, not to monday.com.
This section is agreed for the benefit of monday.com, and monday.com may rely on it directly.
This section is the data processing agreement between you and us. It applies as soon as you use ImageForm to collect personal data, and it runs for as long as your account exists. No separate document is needed; if your data protection officer wants one signed, write to us and you get this text as a PDF.
Subject and purpose. We host ImageForm and process the data your forms collect, for the sole purpose of operating the app for you: storing your forms and images, accepting responses, writing them into your monday board, and making them available again in the response view and as a PDF.
Types of data. Whatever your questions ask for. Typically names, email addresses, phone numbers, free text, quantities and selections. Files that respondents upload are passed straight to monday and are not stored on our server. We also hold your monday account id, the id of the authorising user, and the access token issued by monday.
Categories of data subjects. The people who fill in your forms — depending on what you use them for, your employees, customers, suppliers or applicants.
Instructions. We process the data only on your documented instructions. Building a form and publishing it is such an instruction. If we believe an instruction breaches data protection law, we will tell you and may refuse to carry it out.
Confidentiality. Only the developer has access to the systems, and he is bound to confidentiality. There are no other staff with access.
Security measures (Art. 32). Responses and access tokens are encrypted at rest with XSalsa20-Poly1305; the key is held outside the database. All traffic runs over TLS 1.3 or 1.2 with HSTS. The database is not reachable from the internet. The server stands in a data centre in Germany with physical access control. Access logs are kept for 90 days. We do not store the IP addresses of respondents, only a one-way hash used to limit automated submissions.
Sub-processors. One: dream-soft GmbH, Buchenweg 73, 48268 Greven, Germany, which operates the server in the NTT Global Data Centers EMEA facility in Frankfurt am Main. You consent to this sub-processor. We will tell you before adding another, and you may object. Our payment provider Stripe does not process form data and is not a sub-processor under this section. monday.com is your own provider, not ours.
Place of processing. Germany. No data is transferred to a third country.
Your rights as controller, and our support. We assist you in answering requests from data subjects and in meeting your obligations under Articles 32 to 36 GDPR, as far as the app allows. We notify you without undue delay of any personal data breach affecting your data.
Deletion. When you uninstall the app, everything belonging to your account is deleted within ten days, as set out in section E. You can delete individual forms and responses yourself at any time. What the app already wrote into your monday boards is in your account and is not ours to delete.
Evidence and audits. On request we provide the information you need to demonstrate compliance with Art. 28. You may audit us, after reasonable notice and during business hours, in a way that does not disrupt operations; evidence we supply in writing comes first.
Instructions for installing and using ImageForm are at docs.apptool15.com/imageform. For anything not covered there, write to rnd@apptool15.com. We answer within two business days.