Monday.com Privacy Policy

This is the privacy policy governing how monday.com Ltd. handles personal data for users of its work management platform, site visitors, prospective customers, and technology partners. The policy authorizes collection of identifiers, device data, approximate geolocation, usage activity logs, call and video conference recordings, screen recordings, and professional profile information, and permits disclosure to a broad range of third parties including session recording services, call transcription services, advertising networks, and named data enrichment providers such as ZoomInfo, Clearbit, Cognism, and Lusha. The policy also discloses that Account Admins may access content submitted to private boards and may monitor, process, and analyze user activity within the platform on behalf of the Customer organization.

This Privacy Policy, published by monday.com Ltd. and last updated June 28, 2026, governs the collection, storage, use, and disclosure of four categories of personal data: Customer Data (processed as data processor on behalf of business customers), User Data (platform users and account contacts), Prospect Data (site visitors and marketing contacts), and Technology Partner Data (developer and partner ecosystem participants), with legal bases asserted as performance of contract, legitimate interests, legal obligation, and consent. The policy states that monday.com collects identifiers, device and connectivity data, approximate geolocation derived from IP addresses, professional and employment information, usage and activity logs, call and video conference recordings, screen recordings, and written correspondence, and authorizes disclosure to service providers spanning hosting, analytics, billing, fraud detection, session recording, call recording and transcription, advertising networks, data enrichment providers (naming LinkedIn, ZoomInfo, Clearbit, Cognism, and Lusha), business partners, resellers, application providers, event sponsors, and other platform users including Account Admins. The policy asserts that continued use of the services after policy amendments constitutes acceptance of changes, and separately clarifies that monday.com is a data processor for Customer Data submitted to the platform, placing compliance obligations for that data category on the Customer as data controller. The policy engages GDPR, UK GDPR, Swiss Federal Data Protection Act, Israel Protection of Privacy Law, CCPA, and the EU-US Data Privacy Framework, with monday.com Inc. certified under the EU-US DPF and its UK and Swiss extensions, and with Standard Contractual Clauses cited for transfers to non-adequate third countries. Material compliance considerations include the breadth of third-party data enrichment sourcing for Prospect Data, the scope of session and call recording practices, the policy's treatment of consent in non-GDPR jurisdictions where terms acceptance is deemed consent, and the allocation of data subject rights responsibilities to Customers for Customer Data processed as a processor.

The agreement authorizes monday.com to collect call and video conference recordings, screen recordings, written correspondence, and usage activity logs for analytics, quality control, training, and record-keeping purposes. Under these terms, Account Admins employed by the Customer organization may access content submitted to boards designated as private, monitor user activity within the platform, and receive user personal data including profile information. You can opt out of promotional communications by emailing privacy@monday.com, updating communications preferences in your User Profile settings, or following unsubscribe instructions in received messages.