Privacy

Last updated: 3 October 2026

What MoncoWork stores, why, for how long, and how to leave. No advertising, no audience measurement.

Data controller

MoncoWork is operated by YUKARI LABS, a private limited company (SRL/BV) registered in Belgium with the Crossroads Bank for Enterprises under number 1033.402.366 (VAT BE1033402366), with its registered office at Cantersteen 47, 1000 Brussels, Belgium.

Waitlist

• What we store: your email address, what you choose to give (kind of place, organization name), the page's language, which form you used, when you agreed, and a one-way fingerprint of your IP address, never the address itself.
• Against abuse (legitimate interest): the page computes a technical fingerprint of your browser (graphics rendering, screen, language, time zone) and sends only a one-way hash of it, never the details; we keep only a salted version, with your sign-up and in the anti-abuse traces, to spot bulk sign-ups.
• Why: to write to you when your organization can open its space, and to limit abuse of the form.
• Legal basis: your consent, which you can withdraw at any time by leaving the list.
• For how long: at most 12 months after the last contact, after which the entry is deleted automatically. The list may also be deleted earlier, once the invitations are sent. Anti-abuse traces are erased after two days.
• How to leave: leave the waitlist. Your address is marked as removed and everything else is erased; it is only kept so that we never write to it again. To have it deleted entirely, contact us.

The app

• What we store: your name, email address, password (hashed), language and theme preferences, your email notification choices, and your organization's data: rooms, equipment, members and bookings.
• Why: to run the schedule. Each organization only sees its own data.
• Support: the platform team can open an organization to help. Every intervention is logged, and a booking made on someone's behalf says so.
• Emails, when sending email is turned on: verification and password reset codes, and notifications about your bookings (confirmations, decisions, changes made by someone else, reminders and, for administrators, new requests). You choose which notifications you receive in your notification settings, and each one has a link to unsubscribe in one click.
• For how long: as long as your account exists. To have it deleted, contact your organization's administrator or us.
• Booking history: for each booking, we record who created, changed, approved, rejected or cancelled it, when, and through which channel (the app, the API or an AI assistant), with its time and its rooms or equipment before and after each change. We never copy the booking's description, only the fact that it changed. The person who booked and the organization's administrators see all of it. Other members see only what happened and when, without any names, and nothing more than the calendar shows until the booking is approved. It is kept for 12 months after the booking ends (or is cancelled), then deleted.
• Administration log: for each organization, we record what its administrators and our platform team do in its space: members invited, joined, removed or given another role or access, groups, rooms and equipment, settings, appearance, custom domain and integrations (webhooks, chat channels, API keys) created, changed or deleted. Each entry says who did it, when, through which channel (the app, the platform console, the API, an AI assistant or automatically) and what changed (old and new values of settings, names and roles). We never record passwords, secrets, tokens or full webhook addresses, nor the free text members write (a room's description is only noted as changed). Only the organization's administrators can see it, including the names of our team members who acted. It is kept for 24 months, then deleted.

In your browser

The page keeps your language and theme choice, your session, and your organization's colours on your device so they show without delay. None of it is shared. Only the anti-abuse fingerprint hash, kept for the visit, goes with your requests to join or leave the waitlist.

Service providers

These providers process data on our behalf:

• Convex, Inc.: database and server for the app and the waitlist (privacy policy).
• Vercel: hosting of the website (privacy policy).
• Resend: sending codes and booking notifications by email, only when sending email is turned on (privacy policy).
• Cloudflare, Inc.: the anti-bot check (Turnstile) of the waitlist forms, when it is turned on. It runs once you start filling in a form and receives your IP address and technical details of your browser, only to tell people from bots (Turnstile privacy addendum).

Your rights

You can ask to access your data, to have it corrected or erased, to restrict its processing or to receive it in a portable format, and you can object to its processing. Where processing is based on your consent, you can withdraw it at any time. To exercise these rights, write to us (see Contact below); we answer within one month.

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, Belgium: www.dataprotectionauthority.be.

Contact

For any question or request: contact@monco.work.