Privacy Policy
Effective date: September 25, 2026 · Version: 1.0
This Privacy Policy explains what the Google Sheets Connector for monday.com (also listed as Google Sheets Integration for monday.com; the "App") accesses, stores and shares, and why. The App is provided by Lupo Digital Ltd., trading as LupApps ("LupApps", "we", "us"), Haprahim 48, Ra'anana, Israel. This policy applies to the App only. The lupapps.io website has its own privacy policy. Capitalised terms not defined here have the meaning given in the App's Terms of Service at https://legal.lupapps.io/google-sheets-connector/terms/.
1. Summary
- The App moves data between your monday.com boards and your Google Sheets, in the direction and on the schedule you configure.
- Board items and sheet contents pass through the App during a run and are not stored.
- We store only what is needed to operate the App: account identifiers, user email addresses, OAuth tokens, your mappings and schedules, and run status records.
- Everything is hosted in Frankfurt, Germany, encrypted in transit and at rest.
- We never sell your data, show advertising, or train AI models on it.
- The App is assessed every year under Google's Cloud Application Security Assessment (CASA) programme, Tier 2.
2. Data we access
2.1 From Google
When an Authorized User connects a Google account, the App requests the following OAuth scopes:
| Scope | Why the App needs it |
|---|---|
| spreadsheets | Read and write the spreadsheets you connect |
| drive.file | Create spreadsheets from the App, and access only files you open through the App's file picker |
| drive.metadata.readonly | List file names in the picker. No file contents |
| userinfo.email, userinfo.profile | Identify the connected Google account (email address, name, profile picture) |
drive.metadata.readonly is classified by Google as a "restricted" scope, which is why the App undergoes the annual CASA assessment described in section 7.
2.2 From monday.com
Granted by an administrator at install time through monday.com's OAuth 2.1 flow, with short-lived tokens that can be revoked from monday.com at any time:
| Scope | Why the App needs it |
|---|---|
| boards:read, boards:write | Read and update the boards you connect |
| workspaces:read | List workspaces and boards in the board picker |
| me:read, account:read | Identify the installing user and account |
| webhooks:read, webhooks:write | Register the board events that trigger your automations |
| notifications:write | Send in-app notifications, for example when a sync needs attention |
3. What we store and what only passes through
3.1 Accessed in transit only
Board items, column values, sheet rows and cell values for the boards and sheets you connect. The App reads and writes them during an export, import or sync run and does not retain them after the run completes.
3.2 Stored
- Your monday.com account ID and name, and the installing user's ID and email address
- Authorized Users' email addresses and Google account identifiers for the accounts they connect
- OAuth tokens for monday.com and Google, encrypted at rest
- Board-to-sheet mappings, column mappings, Data Sync configurations and schedules
- Run status records: which automation or sync ran, when, whether it succeeded, and the error class if it failed
- Plan and subscription status, received from monday.com's billing events
- Support correspondence you send us by email or in-app chat
4. How we use the data
We use the data described above only to:
- run the exports, imports, automations and syncs you configure;
- authenticate your users with monday.com and Google;
- apply the limits of your Plan;
- notify your users when a run fails or a connection needs attention;
- provide support;
- secure, monitor, debug and improve the App;
- send service and onboarding emails to the installing user (marketing emails only where permitted, always with an unsubscribe link); and
- comply with legal obligations.
We do not sell personal data, use it for advertising, or use Customer Data to train machine-learning models.
5. Google API Services User Data Policy (Limited Use)
The App's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we only use Google user data to provide and improve the App's user-facing features; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you; we do not use it for serving advertisements; and we do not allow humans to read it unless we have your affirmative agreement, it is necessary for security purposes, it is required to comply with law, or it is aggregated and anonymised for internal operations.
6. Sharing and subprocessors
We share data only with the providers below, each of which processes it on our instructions and under a written agreement.
| Provider | Purpose | Location | Data it receives |
|---|---|---|---|
| DigitalOcean | Application hosting, managed databases and backups | Frankfurt, Germany | All stored data listed in section 3.2 |
| Better Stack | Application log management and uptime monitoring | European Union / United States | Technical metadata: account and user IDs, automation names, error classes, timestamps. No board or sheet content |
| Klaviyo | Service and onboarding email | United States | Installing user's name, email address, plan and lifecycle status |
| Crisp | In-app support chat | European Union | Chat messages and any name or email you provide in the chat, plus browser and page metadata |
| Google Workspace | Support mailbox | European Union / United States | Support correspondence |
| monday.com and Google | The connected platforms | Per their own policies | The data you transfer between them |
Beyond these, we disclose data only to public authorities where legally required, and to a successor in a merger or acquisition with prior notice to you. We update this table at least 14 days before adding or replacing a subprocessor.
7. Hosting and security
- Hosting. The App and its databases run on DigitalOcean managed infrastructure in Frankfurt, Germany (European Union), with encrypted backups in the same region.
- Encryption. TLS 1.2 or higher with HSTS for all traffic; encryption at rest for databases, backups and OAuth tokens.
- Access. The App never collects or stores user passwords. Access to monday.com and Google is by OAuth tokens that you can revoke at any time. Production access is limited to named LupApps staff protected by multi-factor authentication.
- Independent assessment. The App passed Google's CASA Tier 2 assessment, performed by TAC Security, an App Defense Alliance authorised laboratory. The Letter of Validation was issued on September 19, 2026 and is valid until September 20, 2027. The App is also a verified Google OAuth application and has passed monday.com's marketplace app review, which covers privacy and security.
- Incidents. If we confirm a security incident affecting your data, we notify the installing account's administrator contact by email without undue delay and no later than 72 hours after confirmation, describing what happened, the data involved and the steps taken.
- Not held. We do not currently hold SOC 2 or ISO 27001 certification.
8. Retention, deletion and revoking access
| Data | Kept for |
|---|---|
| Run status records | 24 hours |
| Operational logs | A rolling window of 7 days |
| Account, user, token and configuration records | While the App is installed |
| Support correspondence | Up to 24 months |
| Billing and subscription records | As required by tax and accounting law |
When you uninstall the App, monday.com notifies us: the App's monday.com tokens are revoked and deleted, its Google tokens are deleted, and the account is marked uninstalled, so no further access is possible. Configuration records (mappings, schedules) are kept so that you can reinstall without rebuilding. Email support@lupapps.io and we delete them in full within 30 days.
You can revoke access at any time without uninstalling: from your Google account permissions page (myaccount.google.com/permissions), from the App's Google accounts screen (disconnect), or as a monday.com administrator from the account's installed apps.
9. International transfers
Your data is hosted in the European Union. LupApps is established in Israel, which holds an adequacy decision from the European Commission. Where personal data originating in the EU/EEA, the United Kingdom or Switzerland is transferred to a subprocessor in the United States, the transfer is made under an appropriate safeguard, such as the EU–US Data Privacy Framework where the provider is certified, or the EU Standard Contractual Clauses. Customers outside the European Union, including in the United States, should note that their data is processed in Germany and, for support, in Israel.
10. Your rights
Depending on where you are, you may have the right to access, correct, delete, restrict or port your personal data, and to object to certain processing, under laws such as the GDPR, the UK GDPR, the California Consumer Privacy Act and Israel's Protection of Privacy Law. To exercise a right, email support@lupapps.io. If you are an Authorized User of a customer's monday.com account, we may refer your request to that customer, which controls the data in its account. You may also lodge a complaint with your data-protection authority.
11. Children
The App is intended for business use and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
12. Cookies and similar technologies
The App runs inside monday.com. It uses only the browser storage and session tokens strictly necessary to keep you signed in and to remember your settings, and the Crisp support chat widget described in section 6. It does not use advertising cookies or trackers.
13. Changes to this policy
We may update this policy from time to time. The effective date at the top shows the current version. For material changes, we notify the installing administrator by email or through the App at least 14 days before the change takes effect, and for a new or replaced subprocessor we follow section 6.
14. Contact
Lupo Digital Ltd. (LupApps) · Haprahim 48, Ra'anana, Israel
Support and privacy requests: support@lupapps.io · Privacy contact: idan@lupapps.io · https://lupapps.io