Privacy Policy
Effective date: October 12, 2026 · Version: 1.0
This Privacy Policy explains what Column Clone & Sync for monday.com (the "App") accesses, stores and shares, and why. The App is provided by Lupo Digital Ltd., trading as LupApps ("LupApps", "we", "us"), Haprahim 48, Ra'anana, Israel. This policy applies to the App only. The lupapps.io website has its own privacy policy. Capitalised terms not defined here have the meaning given in the App's Terms of Service at https://legal.lupapps.io/column-clone-sync/terms/.
1. Summary
- The App copies values from one column into another on your monday.com boards, once or as an ongoing sync, as you configure.
- It runs entirely on monday.com's own app-hosting infrastructure (monday code). We operate no separate servers or databases for it.
- Column values pass through the App while a copy or sync runs. A changed value waiting to be synced is held for up to 10 minutes and then deleted. Column values are not written to the App's logs.
- We store only what is needed to operate the App: account identifiers, subscription status, user IDs, OAuth tokens, your sync rules and short-lived activity records.
- The name and email address of users who install or authorise the App go to our customer-messaging providers so that we can send service emails.
- We never sell your data, show advertising, or train AI models on it.
2. Data we access from monday.com
Granted by an administrator at install time, and by each user who authorises the App, through monday.com's OAuth flow. Access can be revoked from monday.com at any time.
| Scope | Why the App needs it |
|---|---|
| boards:read, boards:write | Read the source column and write the target column on the boards where you set up a copy or sync |
| me:read, account:read | Identify the user and the account, and the account's plan |
| users:read | Turn user IDs into names and email addresses when the source column holds people |
| webhooks:read, webhooks:write | Register the board events that trigger a sync: a change in a source column, or a new item |
| notifications:write | Send in-app notifications, for example when a sync needs attention |
The App acts with the permissions of the user who authorised it and reaches only boards that user can reach. Viewers and guests cannot use the App.
3. What we store and what only passes through
3.1 Processed in transit
Column values and item identifiers on the boards where you set up a copy or sync. The App reads them from monday.com and writes them to the target column.
When a source value changes, the changed value is held in a processing buffer for up to 10 minutes and deleted once it has been written to the target column.
The App's operational logs (section 8) record technical events such as identifiers, status and errors. They do not contain column values and are used only to troubleshoot the App.
3.2 Stored
All of the following is held in monday code's storage services:
- Your monday.com account ID and account URL name, and the plan, trial and subscription status that monday.com sends with its billing events
- The monday.com user IDs of users who authorise the App or start a copy or sync
- OAuth tokens for monday.com, encrypted at rest
- Sync rules: board, column and webhook identifiers, column types and the options you chose
- Copy job records: identifiers, progress, and the item IDs and error text of any items that failed
- Activity records: which copy was run, by which user ID, on which board and columns, and with which options
The App does not store user names or email addresses in its own storage. Section 6 lists the providers that receive them.
4. How we use the data
We use the data described above only to:
- run the copies and syncs you configure;
- authenticate your users with monday.com;
- check that the account has an active trial or subscription;
- notify your users when a sync needs attention;
- provide support;
- secure, monitor, debug and improve the App;
- send service and onboarding emails to the users who install or authorise the App (marketing emails only where permitted, always with an unsubscribe link); and
- comply with legal obligations.
We do not sell personal data, use it for advertising, or use Customer Data to train machine-learning models.
5. AI features
The App offers a skill to monday.com's AI assistant. When a user asks the assistant, the skill returns the list of sync rules configured on a board. The App itself does not send data to any AI model provider.
6. Sharing and subprocessors
We share data only with the providers below, each of which processes it on our instructions.
| Provider | Purpose | Location | Data it receives |
|---|---|---|---|
| monday.com (monday code) | Application hosting, storage, queueing and logs | monday code regions: European Union, United States, Australia, Israel | All data listed in section 3 |
| Twilio Segment | Passes install and subscription events to our email provider | United States | Name and email address of the user who installs or authorises the App, whether that user is an administrator, the account ID, name and URL name, the account's monday.com plan and seat tier, and the App's plan, billing period, trial status and region. No board content |
| Klaviyo | Service and onboarding email | United States | The same details, received through Segment |
| Crisp | In-app support chat | European Union | Chat messages and any name or email you provide in the chat, plus browser and page metadata |
| Google Workspace | Support mailbox | European Union / United States | Support correspondence |
Beyond these, we disclose data only to public authorities where legally required, and to a successor in a merger or acquisition with prior notice to you. We update this table at least 14 days before adding or replacing a subprocessor.
7. Hosting and security
- Hosting. The App's backend and interface run on monday code, monday.com's hosting infrastructure for marketplace apps, and are deployed to its European Union, United States, Australia and Israel regions.
- Encryption. All traffic uses HTTPS (TLS). OAuth tokens are encrypted at rest.
- Access. The App never collects or stores user passwords. Requests from the App's interface are authenticated with monday.com's signed session token, and events from monday.com are verified by signature. Access to monday.com is by OAuth tokens that you can revoke at any time. Access to the App's production environment is limited to named LupApps staff.
- Review. The App has passed monday.com's marketplace app review, which covers privacy and security.
- Incidents. If we confirm a security incident affecting your data, we notify the installing account's administrator contact by email without undue delay and no later than 72 hours after confirmation, describing what happened, the data involved and the steps taken.
- Not held. We do not currently hold SOC 2 or ISO 27001 certification.
8. Retention, deletion and revoking access
| Data | Kept for |
|---|---|
| Changed values waiting to be synced | Up to 10 minutes |
| Copy job records | 1 hour |
| Activity records | 30 days |
| Operational logs | About 60 days (the monday code platform's log retention) |
| Account record, user IDs, sync rules and tokens | While the App is installed |
| Contact details held by our email providers | Until you ask us to delete them |
| Support correspondence | Up to 24 months |
When you uninstall the App, monday.com notifies us and the App removes the board webhooks it created, deletes your sync rules and activity records, deletes its monday.com tokens (revoking them first where monday.com supports it) and deletes the account record. Contact details already held by our email providers are kept until you ask us to delete them: email support@lupapps.io and we delete them within 30 days.
You can revoke access at any time: a monday.com administrator can uninstall the App from the account's installed apps, and deleting a sync rule in the App stops that sync.
9. International transfers
The App is hosted on monday.com's infrastructure. LupApps is established in Israel, which holds an adequacy decision from the European Commission. Where personal data originating in the EU/EEA, the United Kingdom or Switzerland is transferred to a subprocessor in the United States, the transfer is made under an appropriate safeguard, such as the EU–US Data Privacy Framework where the provider is certified, or the EU Standard Contractual Clauses.
10. Your rights
Depending on where you are, you may have the right to access, correct, delete, restrict or port your personal data, and to object to certain processing, under laws such as the GDPR, the UK GDPR, the California Consumer Privacy Act and Israel's Protection of Privacy Law. To exercise a right, email support@lupapps.io. If you are an Authorized User of a customer's monday.com account, we may refer your request to that customer, which controls the data in its account. You may also lodge a complaint with your data-protection authority.
11. Children
The App is intended for business use and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
12. Cookies and similar technologies
The App runs inside monday.com and does not set cookies or use browser storage of its own. The Crisp support chat widget described in section 6 may store its own identifiers in your browser. The App does not use advertising cookies or trackers.
13. Changes to this policy
We may update this policy from time to time. The effective date at the top shows the current version. For material changes, we notify the installing administrator by email or through the App at least 14 days before the change takes effect, and for a new or replaced subprocessor we follow section 6.
14. Contact
Lupo Digital Ltd. (LupApps) · Haprahim 48, Ra'anana, Israel
Support and privacy requests: support@lupapps.io · Privacy contact: idan@lupapps.io · https://lupapps.io