Privacy Policy

Last updated: November 5, 2026

This Privacy Policy explains how Kusterer & Müller GbR, doing business as Gorilla Apps (“Gorilla Apps,” “we,” “us” or “our”), processes Personal Data when you visit our websites, contact us or use one of our applications or services.

It applies to all websites and applications operated by Gorilla Apps unless a product-specific notice says otherwise. These Services include the Gorilla Apps website, Client Portal Builder, Spreadsheet Gorilla, Board to Website Widget, Exported Excel Cleaner and our public system-status page.

1. Who we are

The responsible business is:

Kusterer & Müller GbR (Gorilla Apps)
Hagbergstrasse 11
70188 Stuttgart
Germany
Email: hello@getgorilla.app

For processing where Gorilla Apps determines why and how Personal Data is used, Gorilla Apps is the Controller.

2. When we are a Controller and when we are a Processor

Our role depends on the processing activity:

• Gorilla Apps as Controller. We act as Controller for our website, business contacts, support communications, app-installation and subscription administration, billing, security, fraud prevention, and product analytics used for our own business purposes
• Gorilla Apps as Processor. When a customer uses a Gorilla Apps product to process content from its monday.com account or another connected service, the customer normally determines the purposes and means of that processing. The customer is the Controller and Gorilla Apps processes that Customer Data on the customer's instructions
• Customer-selected platforms. Customers maintain their own relationships with platforms such as monday.com. Those platforms may process data under their own terms and privacy notices. A platform may also act as our Subprocessor for a specific hosting or developer-storage operation

If you use a customer-configured portal, widget, report or other service and want to exercise rights concerning Customer Data, contact the relevant customer first. We will assist that customer as required by our agreement and applicable law.

The Client Portal Builder Data Processing Addendum describes the data-processing terms that apply when Gorilla Apps processes personal data on a Customer's behalf.

3. Personal Data we process

The data we process depends on the product, its configuration and how you interact with us.

3.1 Information you provide directly

We may process:

• Your name, email address, organization and job role
• Support requests, messages, feedback and related correspondence
• Account, billing and transaction information
• Preferences for product, service and Subprocessor communications
• Any other information you choose to provide to us

Please do not include sensitive or unrelated Personal Data in support messages.

The forms on getgorilla.app collect the following information:

• Contact form: first name, last name, email address, monday.com account slug, selected app and subject, and the message
• Partner application form: first name, last name, email address, company name, company website, monday.com slug, and what you tell us about your work with monday.com
• Service request form: first name, last name, work email address, monday.com account slug and the description of your use case
• Export troubleshooting form: name, email address, monday.com account slug, affected board ID, when the problem first occurred, your description of the problem, and a diagnosis report file (.json or .zip)

The diagnosis report is created by the Board Diagnose Tool in Spreadsheet Gorilla. It contains test results such as the board ID, item counts, timings, error messages and log entries, and it may include the ID and name of an item on the board. The export troubleshooting form also offers an optional consent to in-depth board checks. We carry out these checks only if you tick that box and where the necessary permissions were granted. You can withdraw this consent at any time.

Every form also records that you accepted our Privacy Policy and Terms of Service. Our website does not store a copy of the submission or of any uploaded file. It sends them through Cloudflare Email Sending to the hello@getgorilla.app mailbox hosted by ALL-INKL.COM.

Pages with a form use Cloudflare Turnstile to protect the form from spam and abuse. Turnstile runs in your browser and processes signals such as your IP address, TLS fingerprint, user agent and browser characteristics. It may set cookies needed for this check. It does not read what you enter in the form. We use it based on our legitimate interest in protecting our website. Cloudflare processes these signals for us to detect bots, and as an independent controller to improve its bot detection, as described in its Turnstile Privacy Addendum.

The domain clientportalbuilder.com is also operated by Gorilla Apps and redirects to getgorilla.app. When you open it, ALL-INKL.COM processes the website and technical information described in Section 3.2 to perform the redirect.

3.2 Website and technical information

When you visit our website or use our applications, we and our infrastructure providers may process:

• IP address and approximate location derived from it
• Browser, device and operating-system information
• Requested pages or application routes, date and time
• Referrer information
• Request, trace and error identifiers
• Response status, duration and diagnostic information
• Security events and information used to prevent abuse

We do not use Google Analytics on getgorilla.app or clientportalbuilder.com.

We use Cloudflare Web Analytics to measure how many people visit getgorilla.app and how quickly its pages load. A script from Cloudflare runs in your browser on each page view and reports the page visited, the referrer and performance measurements such as load times. Query strings are not recorded. We see this information only as aggregated reports, including figures such as visits by country, browser and device type.

The script does not set cookies or store anything in your browser, and it does not use a persistent identifier. According to Cloudflare, it does not fingerprint visitors or track individuals across websites, and your IP address is discarded at the nearest Cloudflare data center instead of being stored. We use this information based on our legitimate interest in understanding how our website is used and keeping it fast. You may object as described in Section 10.

When you open a page of getgorilla.app from a search engine's results, a script of ours measures whether the page answered your search. It records how long the page was visible before you left it or switched tabs, how far you scrolled, whether you then opened another page of ours or followed a link to another site, and whether your screen is phone-sized. When you leave the page or switch tabs, it sends these values once to our own server, together with the address of the page (without query string) and the name of the search engine. They are stored in Cloudflare Workers Analytics Engine. We do not record your IP address, browser details, search terms or any identifier, the script does not set cookies or store anything in your browser, and a measurement cannot be linked to other visits. It runs only on visits that come from a search engine. We use this information based on our legitimate interest in improving our pages for the searches that lead to them. You may object as described in Section 10.

We do not use this information to make decisions that produce legal or similarly significant effects about you.

3.3 monday.com app installation and lifecycle information

When a Gorilla Apps monday.com app is installed, used, subscribed to or uninstalled, we may process:

• monday.com account and user identifiers
• Installer name and email address
• Account name, slug, country and plan or tier
• App installation, uninstall, trial and subscription events and dates
• Subscription and billing-status information supplied through monday.com

Event payloads stored in our application database are encrypted at the application layer. Account identifiers, event types and timestamps are not encrypted at that layer.

3.4 Customer Data accessed through connected services

Depending on the product and the customer's configuration, our applications may access or otherwise process:

• monday.com board, workspace, item, column, update, comment and file data
• Names, contact information, roles and other information placed in Customer Data
• Board and report configuration, filters and templates
• User and account identifiers and authorization tokens
• Content selected for display, export, transformation or delivery

The customer controls which data it places in the connected platform and makes available to the product. Gorilla Apps does not require customers to submit Special Category Data or criminal-conviction data. Customers should not use a product for such data unless the processing is lawful and any required safeguards have been agreed.

3.5 Client Portal Builder

Client Portal Builder may process:

• Client name, email address, password hash, account status and an optional account comment
• Portal settings, content, filters and client-access rules
• Portal, client-item and pseudonymous account identifiers
• Optional Google Sign-In identity information
• Signed session claims and authentication timestamps
• Temporary uploads and cached image thumbnails
• Request analytics containing paths, identifiers, method, duration and response status

Client names, email addresses and password hashes are stored in the customer's own monday.com account. Gorilla Apps does not maintain a separate application-database copy of those client account records.

3.6 Spreadsheet Gorilla

Spreadsheet Gorilla may process:

• Board and template identifiers
• Spreadsheet and report templates, formulas, filters and configuration
• monday.com account, user, integration and automation identifiers
• Encrypted monday.com authorization tokens
• Automation names, status, timing and result information
• Board data used to generate a spreadsheet or table
• The name and email address of an automation creator
• Recipient email addresses and generated spreadsheet or table content when a customer configures email delivery

Automated spreadsheet jobs run on Google Cloud infrastructure. When email delivery is selected, the message and any generated attachment are sent through Twilio SendGrid. We also use Twilio SendGrid to deliver transactional application emails, such as an introduction email after Client Portal Builder is installed.

3.7 Board to Website Widget

Board to Website Widget may process:

• monday.com account and board identifiers
• Widget configuration, presentation settings and filters
• Board metadata, items, files and other content selected for publication
• Widget paths, asset identifiers and execution information

The customer chooses what to publish. Published widget data and assets are stored in Cloudflare R2 so they can be displayed on the customer's selected website.

3.8 Exported Excel Cleaner

Exported Excel Cleaner processes the selected spreadsheet in the user's browser. The spreadsheet content is not uploaded to the Gorilla Apps backend for conversion. We still process limited app-installation, subscription, security and technical information as described elsewhere in this Policy.

3.9 System-status page

Our public system-status page at status.getgorilla.app is hosted by Hetzner and displays service availability, incident information and maintenance notices. It does not require a user account. When you visit it, we and our infrastructure providers may process the website and technical information described in Section 3.2.

4. Why we process Personal Data

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on individuals. You may object to processing based on legitimate interests as described in Section 10.

If we ask for information required to enter into or perform a contract and you do not provide it, we may be unable to provide the relevant Service. Other information is optional unless we say otherwise.

5. Where the data comes from

We receive Personal Data:

• Directly from you
• From the customer or organization through which you use a Service
• From monday.com or another customer-selected platform when an app is installed, authorized or used
• From users who configure portals, widgets, reports, recipients or other workflows
• Automatically from browsers, devices and infrastructure used to access the Services
• From service providers supporting payments, communications, security and service delivery

We do not buy Personal Data from data brokers.

6. Who receives Personal Data

We disclose Personal Data only where necessary for the purposes described in this Policy, on a customer's instructions, or where required by law.

6.1 Company-wide list of service providers, Subprocessors and platforms

The providers relevant to one or more Gorilla Apps products currently include:

Not every provider receives data from every product. We require processors we appoint to protect Personal Data under appropriate contractual terms. Providers identified as customer-selected platforms or independent Controllers process data under their own terms for those activities.

The table above is our current company-wide list of service providers and, where they process Customer Personal Data on our behalf, Subprocessors. It also identifies customer-selected platforms and independent Controllers that are not Subprocessors for the relevant processing activity.

Client Portal Builder customers may subscribe to advance Subprocessor-change notices by emailing hello@getgorilla.app with the subject “Subprocessor change notifications” and identifying their legal name and monday.com account.

6.2 Other disclosures

We may also disclose relevant information:

• To professional advisers subject to confidentiality obligations
• Where necessary to comply with law, a court order or a lawful request from an authority
• To establish, exercise or defend legal claims
• To protect individuals, our customers, Gorilla Apps or the public from material harm
• As part of a merger, restructuring, financing or transfer of all or part of our business, subject to appropriate safeguards

We do not sell Personal Data.

7. International transfers

Gorilla Apps is established in Germany. The public website at getgorilla.app runs on Cloudflare's global network, the redirect from clientportalbuilder.com is hosted by ALL-INKL.COM in Germany, and the public system-status page is hosted by Hetzner in Finland. Some other providers and systems operate outside the European Economic Area.

Portal content and client account data stored in monday.com follow the customer's selected monday.com EU, US, or Israel (IL) region. Cloudflare operates a global network. Render hosts the PostgreSQL lifecycle-event database in Oregon, United States, and Spreadsheet Gorilla automation jobs currently run in Google Cloud's us-central1 region. Hetzner-hosted database backups are stored in Finland.

Where the GDPR restricts an international transfer, we use a lawful transfer mechanism. Depending on the provider and transfer, this may include an adequacy decision, participation in the EU-US Data Privacy Framework where applicable, or the European Commission's Standard Contractual Clauses together with supplementary measures where required.

For Google Cloud, our contracting entity is Google Cloud EMEA Limited in Ireland. Transfers of Personal Data to Google LLC in the United States are currently covered by Google LLC's participation in the EU-US Data Privacy Framework. Google's Cloud Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses for restricted transfers where an applicable alternative transfer solution is unavailable or does not cover the transfer.

For Twilio SendGrid, our contracting entity is Twilio Ireland Limited in Ireland. Where Twilio Inc. processes Personal Data in the United States, Twilio's Data Protection Addendum gives priority to Twilio Inc.'s participation in the EU-US Data Privacy Framework. The Addendum incorporates the European Commission's Standard Contractual Clauses for restricted transfers where required. Twilio's Binding Corporate Rules do not apply to the SendGrid services.

8. How long we retain data

We retain Personal Data only for as long as necessary for the relevant purpose, contractual relationship and legal obligations. Retention varies by product and data category.

When data in backups cannot reasonably be isolated, it remains protected from ordinary use and is deleted through the applicable backup cycle. We may retain specific information for longer where required by law or necessary to establish, exercise or defend legal claims.

9. Security

We use appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

Measures include access controls, encryption in transit, application-layer encryption for selected stored data, secure secret handling, password hashing, short-lived signed sessions, rate limiting, logging, monitoring, backups, vulnerability management and an approved incident-response process.

No method of transmission or storage is completely secure. More information about Client Portal Builder is available on our Security page.

10. Your rights

Depending on applicable law and the circumstances, you may have the right to:

• Obtain information about our processing and a copy of your Personal Data
• Correct inaccurate or incomplete Personal Data
• Request deletion of Personal Data
• Restrict processing
• Receive data you provided in a portable format
• Object to processing based on legitimate interests or to direct marketing
• Withdraw consent at any time, without affecting processing already carried out
• Lodge a complaint with a Supervisory Authority

These rights may be subject to legal conditions and exceptions.

To exercise a right concerning data for which Gorilla Apps is the Controller, contact hello@getgorilla.app. We may need information sufficient to verify your identity and locate the relevant data.

If Gorilla Apps processes the data only on behalf of one of our customers, we may refer your request to that customer or ask you to contact it directly.

Our competent Supervisory Authority is generally:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Germany
Visit the LfDI Baden-Württemberg website

You may also have the right to contact another Supervisory Authority, particularly in the EEA country where you live or work or where an alleged infringement occurred.

11. Marketing communications

You may opt out of marketing emails at any time by using the unsubscribe mechanism in the message or contacting us. We may still send non-marketing communications needed to provide a Service, administer an account, communicate security matters or comply with law.

12. Children

Our Services are intended for organizations and business users and are not directed to children. We do not knowingly collect Personal Data directly from children through our website for our own purposes.

Customer Data may nevertheless concern individuals of different ages if a customer places that information in a connected platform. For that processing, the customer is responsible for determining whether the processing is lawful and for providing any required notices or obtaining any required authorization.

13. Automated decision-making

Gorilla Apps does not use Personal Data as a Controller to make solely automated decisions that produce legal effects or similarly significantly affect individuals.

Customers may configure filters, automations and other rules in our products or in connected platforms. The customer is responsible for the purpose and configuration of those rules where it acts as Controller.

14. Links and independent third parties

Our website and Services may link to or integrate with third-party services. If you choose to use a third-party service, its provider may process Personal Data under its own privacy notice. This Policy does not govern processing for which that third party independently determines the purposes and means.

Some documentation pages offer videos hosted by YouTube. The YouTube player is not loaded until you choose to load the video. If you do so, your browser connects to YouTube and Google may receive network, device, referrer and usage information under its own terms and privacy notice.

15. Changes to this Policy

We may update this Policy to reflect changes to our Services, processing or legal obligations. We will post the updated version with a revised date. Where required by law or contract, we will provide additional notice of material changes.

16. Contact

Questions, privacy requests and complaints may be sent to:

Kusterer & Müller GbR (Gorilla Apps)
Hagbergstrasse 11
70188 Stuttgart
Germany
Email: hello@getgorilla.app