Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal data may be retained for as long as reasonably needed for service delivery, legal and contractual compliance, and dispute protection, with retention periods determined at monday.com's reasonable discretion and in accordance with an internal data retention policy.
This analysis describes what Monday.com's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision does not specify fixed retention periods for any category of personal data, instead reserving retention duration determinations to monday.com's reasonable discretion and an internal policy document not reproduced in the Privacy Policy.
Under these terms, personal data including identifiers, usage logs, recordings, and profile information may be retained beyond the period of active service use for purposes including potential dispute resolution. The agreement does not specify maximum retention periods for any data category, but states that data subject erasure requests may be submitted by emailing support@monday.com.
Cross-platform context
See how other platforms handle Data Retention at monday.com Discretion and similar clauses.
Compare across platforms →Monitoring
Monday.com has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may retain your personal data for as long as it is reasonably needed to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (e.g. as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with our data retention policy and at our reasonable discretion.Excerpt from Monday.com's Privacy Policy
1. REGULATORY LANDSCAPE: GDPR's data minimization and storage limitation principles require that personal data be retained no longer than necessary for the specified purpose. The absence of defined retention periods in the public policy may require evaluation against GDPR Article 5(1)(e). The CCPA does not impose specific retention period requirements but requires disclosure of retention practices. UK GDPR imposes equivalent storage limitation requirements. 2. GOVERNANCE EXPOSURE: Medium. The policy references an internal data retention policy that is not published alongside the Privacy Policy, meaning external auditors and data subjects cannot independently assess compliance with the storage limitation principle without requesting additional documentation. 3. JURISDICTION FLAGS: EU and UK supervisory authorities have scrutinized the absence of specific retention period disclosures in privacy policies. Organizations processing data subject to GDPR should assess whether monday.com can provide specific retention schedules upon request, including through the Data Processing Addendum. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should request monday.com's internal data retention schedule as part of vendor due diligence and confirm that retention periods for Customer Data are addressed in the Data Processing Addendum. Post-termination data deletion timelines should be explicitly agreed. 5. COMPLIANCE CONSIDERATIONS: Legal teams should request the referenced internal data retention policy document and assess its alignment with applicable regulatory requirements in relevant jurisdictions. Data mapping exercises should document expected retention periods for each category of data processed through the platform.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision does not specify fixed retention periods for any category of personal data, instead reserving retention duration determinations to monday.com's reasonable discretion and an internal policy document not reproduced in the Privacy Policy.
Under these terms, personal data including identifiers, usage logs, recordings, and profile information may be retained beyond the period of active service use for purposes including potential dispute resolution. The agreement does not specify maximum retention periods for any data category, but states that data subject erasure requests may be submitted by emailing support@monday.com.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Monday.com.