Skip to main content
Platform Review
PricingSign in
← All platforms
Workflow & Automation · monday.com

Monday AI

Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.

Overall riskHIGHReviewed 2026-07-20
Creator: medium · GRC: medium · Counsel: medium
creator band
Exemplary
enterprise · Adequate
Exhibit A · Privacy Policy · verbatim

To publish your feedback and submissions to our Sites, public forums and blogs  (Performance of Contract; Legitimate Interests) ;

highest-risk verified finding on prompt ownership — tap for the citation
106 verified findings11 policy surfaces2/2 core docs verified
Risk triage

Watch: audit rights dpa residency

Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.

0
high
40
medium
66
low
2/2
docs
Trains on your data?
No training on your content by default
from 2 cited findings
Who owns outputs?
You own your outputs
from 1 cited finding
Commercial use?
Not yet assessed
no verified finding covers this surface yet
Every rating:verbatim-citedsnapshot-datedchange-loggedHow we keep ratings honest →
Risk by role
Select a role to tailor the summary and reorder the findings below.

Scores derived from 33 enriched findings — same verbatim citations as below. AI-generated, not legal advice.

What this means for you
  • Monday AI's terms explicitly protect your inputs from training use — the policy is affirmatively favorable on this point.
  • Your outputs and prompts are explicitly yours — Monday AI's terms include affirmatively protective IP language.
  • Data handling is conditional — 9 privacy or retention clauses warrant review before using Monday AI at scale.

Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.

How to read this page: Overall risk rates what Monday AI's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.

Creator lens
Your prompts, your outputs, your IP
EXEMPLARY

Based on 189 verified, verbatim-cited findings below — read the citations.

Enterprise lens
Data use, retention, subprocessors, audit
ADEQUATE

Based on 227 verified, verbatim-cited findings below — read the citations.

Automated assessment against a published rubric — not legal advice.

Fully verifiedWorkflow & Automation

Fully verified — complete core corpus captured and read in full.

Document status
  • Privacy Policy
    Verified - read in full - 0 citationsstaticLast captured 2026-07-20
  • Terms of Service
    Verified - read in full - 17 citationsstaticLast captured 2026-07-20
Tier conditions

Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.

plan language
Privacy & data use

Authorizes creation and use of aggregated, anonymized, or pseudonymized data derived from personal data for service improvement and business intelligence purposes, effectively permitting secondary use of processed personal data.

" To create aggregated, statistical data, inferred non-personal data or anonymized or pseudonymized data (rendered non-personal), which we or others may use to provide and improve our respective Services, or for any other business purpose su..."
📍 “Customer, User, Prospect and Technology Partner personal data”Jump to exact text →
plan language
Privacy & data use

Defines 'Customer Data' as personal data processed on behalf of business Customers submitted to the Platform, and defines 'Platform' to encompass all monday.com cloud-based services, APIs, tools, and applications, establishing the subject matter scope for data processing obligations.

" (i)  Customer Data : personal data that we collect, process and manage on behalf of our business customers (“ Customers ”), submitted to the monday.com cloud-based services, including our platforms, products, applications, APIs, tools, and..."
📍 “Last Updated: August 25, 2025”Jump to exact text →
plan language
Privacy & data use

Affirms data subjects' right to choose whether to provide personal data, while noting the consequence that withholding data may preclude use of the Sites or Services, establishing voluntary disclosure as a governing principle.

" You are not legally required to provide us with any of your personal data, and may do so (or avoid doing so) at your own free will. If you prefer not to provide us with your personal data, or to have it processed by us or any of our servic..."
📍 “Additional Notices”Jump to exact text →
plan language
Privacy & data use

Restricts the use of personal data obtained from Google OAuth API Scopes to specific enumerated purposes in accordance with Google API Services Data Policy's Limited Use requirements, defining 'Restricted personal data' in the process.

" With respect to personal data we obtain from Google OAuth API Scopes, used in our integration with certain Google Services (“ Integrated Google Services ”), our use of such personal data and data aggregated, anonymized, or derived therefro..."
📍 “Customer, User, Prospect and Technology Partner personal data”Jump to exact text →
plan language
Privacy & data use

Permits use of personal data including behavioral and interests-based profiling for marketing campaigns, ad management, and targeted advertising across websites and applications under legitimate interests.

" To facilitate and optimize our marketing campaigns, ad management and sales operations, and to manage and deliver advertisements for our Services more effectively, including on other websites and applications. Such activities allow us to h..."
📍 “Customer, User, Prospect and Technology Partner personal data”Jump to exact text →
plan language
Privacy & data use

Defines the legal roles of 'data controller' and 'data processor' as used under GDPR and CCPA frameworks, establishing the interpretive basis for the role allocations described in subsequent segments.

" Certain data protection laws and regulations, such as the GDPR or the CCPA, typically distinguish between two main roles for parties processing personal data: the “data controller” (or under the CCPA, “business”), who determines the purpos..."
📍 § 9 (Data Controller/Processor)Jump to exact text →
plan language
Indemnity & liability

This segment is an all-caps disclaimer in which monday.com expressly disclaims all warranties — express, implied, and otherwise — regarding monday AI, its features, generated content, and results, and places the risk of use entirely on the customer, constituting a broad warranty disclaimer with legal effect on liability exposure.

" 8. Disclaimer of Warranties . MONDAY.COM DISCLAIMS ALL WARRANTIES AND REPRESENTATIONS REGARDING MONDAY AI, ITS FEATURES, FUNCTIONALITIES, GENERATED CONTENT, AND/OR RESULTS THAT MAY BE OBTAINED FROM USE OF MONDAY AI. USE OF MONDAY AI IS AT ..."
Location: exact-text link only — source has no section structureJump to exact text →
plan language
Subprocessors & data sharing

Allows disclosure and use of personal data to facilitate partnerships with local distributors, resellers, and professional services providers for growth and localized experience purposes under legitimate interests.

" To explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences, including through partnerships with local distributors, resellers, business partners and providers of professional services rela..."
📍 “Customer, User, Prospect and Technology Partner personal data”Jump to exact text →

Evidence appendix

Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.

High - 0
Medium - 40
Tier-specific - 0
Total citations - 106
Severity
Surface
Document
Tier
Privacy & data use
CautionHigh
"To gain a better understanding of how Users, Prospects and Technology Partners evaluate, use, and interact with our Services, to utilize such information to continuously improve our Services, the overall performance, user-experience and value generated therefrom. We collect such information automatically through their usage of the Services, including through User’s utilization of artificial intelligence capabilities in the Platform  (Legitimate Interests) ;"
“Customer, User, Prospect and Technology Partner personal data”Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Under GDPR, reliance on Legitimate Interests requires a balancing test; users have a right to object. The explicit call-out of AI capability usage as a data collection trigger increases risk that prompts/outputs are being analyzed for service improvement without clear opt-out mechanisms.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" To create aggregated, statistical data, inferred non-personal data or anonymized or pseudonymized data (rendered non-personal), which we or others may use to provide and improve our respective Services, or for any other business purpose such as business intelligence  (Legitimate Interests) ;"
“Customer, User, Prospect and Technology Partner personal data”Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Authorizes creation and use of aggregated, anonymized, or pseudonymized data derived from personal data for service improvement and business intelligence purposes, effectively permitting secondary use of processed personal data.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" We use personal data as necessary for the performance of our Services (“ Performance of Contract ”); to comply with our legal and contractual obligations (“ Legal Obligations ”); and to support our legitimate interests in maintaining and improving our Services, e.g. in understanding how our Services are used and how our campaigns are performing, and gaining insights which help us dedicate our resources and efforts more efficiently; in marketing, advertising and selling our Services to you and others; providing customer services and technical support; and protecting and securing our Users, Customers, Prospects and Technology Partners, ourselves and our Services (“ Legitimate Interests ”)."
§ 2 (Data Uses & Legal Bases)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Establishes the legal bases under which monday.com processes personal data—Performance of Contract, Legal Obligations, and Legitimate Interests—and enumerates the purposes for which data is used, creating binding disclosure and processing obligations under applicable data protection law.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
"We collect and generate this information automatically, including through the use of analytics tools (including cookies and pixels) – which collect data such as: how often Prospects or Technology Partners visit or use the Sites, which pages they visit and when, which website, ad or email message brought them there, and how Users interact with and use the Platform and its various features."
§ 1 (Data Collection & Processing)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Describes the automated methods by which monday.com collects usage and device data, including analytics tools, cookies, and pixels, specifying the procedural means of data collection and the types of behavioral data gathered.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
CautionHigh
" Protecting Rights and Safety : We may disclose your personal data to others if we believe in good faith that this will help protect the rights, property or safety of monday.com, any of our Users or Customers, or any members of the general public."
§ 4 (Data Disclosure)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Permits disclosure of personal data to third parties when monday.com believes in good faith it is necessary to protect the rights, property, or safety of the company, users, customers, or the public.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
CautionHigh
" To explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences, including through partnerships with local distributors, resellers, business partners and providers of professional services related to our Services (“ Partners ”, as further described in Section 4 below)  (Legitimate Interests) ;"
“Customer, User, Prospect and Technology Partner personal data”Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Allows disclosure and use of personal data to facilitate partnerships with local distributors, resellers, and professional services providers for growth and localized experience purposes under legitimate interests.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
CautionHigh
" For the avoidance of doubt, monday.com may disclose your personal data in additional manners, pursuant to your explicit approval, if we are legally obligated to do so, or if we have successfully rendered such data non-personal and anonymous."
§ 4 (Data Disclosure)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Grants a residual permission to disclose personal data in additional ways with explicit user approval, when legally obligated, or after successful anonymization, clarifying that the enumerated disclosure categories are not exhaustive.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
CautionHigh
" Legal Compliance : In exceptional circumstances, we may disclose or allow government and law enforcement officials access to your personal data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect the security or integrity of our products and Services."
§ 4 (Data Disclosure)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Permits disclosure of personal data to government or law enforcement in response to legal process or in good faith belief of legal obligation, investigation needs, or regulatory compliance, identifying the conditions under which such disclosure is permitted.

AI-generated interpretation, not legal advice.

Privacy & data use
High
"Usage and device information concerning our Users, Prospects and Technology Partners : Connectivity, technical and usage data, such as IP addresses and approximate general locations derived from such IP addresses, device and application data (like type, operating system, mobile device or app id, browser version, location and language settings used), user-customized IDs (where personal data is included), activity logs, the relevant cookies and pixels installed or utilized on your device, and the recorded activity (sessions, clicks, use of features, logged activities and other interactions) of Prospects, Users and Technology Partners in connection with our Services."
§ 1 (Data Collection & Processing)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Automated collection of granular behavioral data — sessions, clicks, feature use — constitutes profiling under GDPR Article 4(4). Users have rights regarding automated profiling, and the breadth of collection may require a DPIA under Article 35.

AI-generated interpretation, not legal advice.

Indemnity & liability
High
" 10. LIMITATION OF LIABILITY. NOTWITHSTANDING ANYTHING TO THE CONTRARY, EITHER IN THE AGREEMENT OR ELSEWHERE, AND TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT SHALL MONDAY.COM, ITS AFFILIATES, SUBCONTRACTORS, AGENTS, VENDORS (INCLUDING THIRD PARTY SERVICE PROVIDERS) BE LIABLE FOR DAMAGES ARISING OUT OF OR RELATING TO: (A) THE COMBINATION OF MONDAY AI AND/OR CONTENT WITH ANY PRODUCTS, SERVICES, OR SOFTWARE NOT PROVIDED BY MONDAY.COM OR ON ITS BEHALF; (B) CONTENT PROVIDED BY THE CUSTOMER OR ITS USERS OR CREATED BY MONDAY AI INCLUDING ANY INACCURACIES OR OMISSIONS THEREIN, AND ANY MODIFICATIONS TO THE FOREGOING BY ANY PARTY OTHER THAN MONDAY.COM OR ITS AUTHORIZED REPRESENTATIVES; (C) THE CUSTOMER’S OR ITS USERS’ USE OF MONDAY AI IN NON-COMPLIANCE WITH THESE MONDAY AI TERMS, THE ACCEPTABLE USE POLICIES, APPLICABLE LAWS, REGULATIONS, OR INDUSTRY STANDARDS, OR OTHERWISE IN A MANNER INCONSISTENT WITH THE DOCUMENTATION OR INTENDED USE OF THE SERVICES, TO THE EXTENT THE CLAIM WOULD NOT HAVE ARISEN BUT FOR SUCH USE."
Location: exact-text link only - source has no section structureJump to exact text →
Source: Terms of Service- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

This segment is a broad limitation of liability clause in which monday.com excludes liability for damages arising from combinations of monday AI with third-party products, inaccuracies in Content, and other specified scenarios, and does so to the fullest extent permitted by law — constituting an operative cap and exclusion on monetary remedies.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
"Partnerships : We engage selected business and channel partners, resellers, distributors and providers of professional services related to our Services, which allow us to explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences for our prospective and existing Customers and Users. In such instances, we may disclose relevant contact, business and usage details to the respective Partner, to allow them to engage with those Customers and Users for such purposes. If you directly engage with any of our Partners, please note that any aspect of that engagement which is not directly related to the Services and directed by monday.com is beyond the scope of monday.com’s Terms and Privacy Policy, and may therefore be governed by the Partner’s terms and privacy policy."
§ 4 (Data Disclosure)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Disclosure to commercial partners for sales/growth purposes relies on Legitimate Interests. The disclaimer that partner conduct is governed by the partner's own terms creates a gap in user protections once data is transferred.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
"Application Providers and Event Sponsors : We may disclose relevant connectivity, technical and usage data to the provider(s) of any third-party applications, or if so instructed or permitted by you or your Account Admin, your personal data (such as your User Profile and contact details, as well as relevant technical data) to provider(s) of any third-party integrations or applications added to your Account. We may also share connectivity, technical, and usage data with the provider(s) of third-party applications whose marketplace pages you have visited."
§ 4 (Data Disclosure)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Passive browsing of marketplace pages triggering data disclosure to third parties raises consent questions under GDPR/ePrivacy. Admin-controlled sharing of individual user data could conflict with employee privacy expectations under applicable labor laws.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
"Service Providers : We engage selected third-party companies and individuals as “Service Providers”, to perform services on our behalf or complementary to our own. These include providers of Third Party Services (as defined in the  Terms ), such as: hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, fraud detection, investigation and prevention services, web and mobile analytics, email and communication distribution and monitoring services, session or activity recording services, call recording, analytics and transcription services, event production and hosting services, remote access services, performance measurement, data optimization and marketing services, social and advertising networks, content, lead generating and data enrichment providers, email, voicemails, video conferencing solutions, support and customer relation management systems, third-party customer support providers, and our legal, compliance and financial advisors and auditors. Our Service Providers may have access to personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services or other activities, and may only use the data as determined in our agreements with them."
§ 4 (Data Disclosure)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

The breadth of categories (including 'social and advertising networks' and 'data enrichment providers') means personal data may flow to numerous parties. Users cannot easily identify which specific companies hold their data. Contractual limits on subprocessor use are referenced but not detailed.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
" Our Service Providers may have access to personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services or other activities, and may only use the data as determined in our agreements with them."
§ 4 (Data Disclosure)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Restricts service providers' use of personal data to purposes determined by their specific roles and limited to what is defined in the contractual agreements with monday.com, prohibiting unauthorized secondary use.

AI-generated interpretation, not legal advice.

Audit rights / DPA / residency
High
"Data Location : We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States (US), Europe, Israel, Australia, Guatemala, the Philippines, Brazil, Japan, Singapore, the United Kingdom (UK), and other locations as reasonably necessary for the proper performance and delivery of our Services, or as may be required by applicable law."
§ 3 (Data Location & Retention)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Multi-jurisdictional processing creates compliance complexity. 'Other locations as reasonably necessary' is an open-ended carve-out that prevents users from knowing with certainty where their data resides. Enterprise customers may have contractual data residency requirements that must be separately negotiated via the DPA.

AI-generated interpretation, not legal advice.

Prompt / input ownership
High
" To publish your feedback and submissions to our Sites, public forums and blogs  (Performance of Contract; Legitimate Interests) ;"
“Customer, User, Prospect and Technology Partner personal data”Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Grants permission to publish user feedback and submissions to public-facing sites, forums, and blogs under performance of contract and legitimate interests.

AI-generated interpretation, not legal advice.

Privacy & data use
High
" In order to protect your personal data held with us, we use industry-standard physical, procedural and technical security measures, including encryption as appropriate. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties as described in Section 4 above. To learn more, please visit our  Trust Center ."
§ 7 (Data Security)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Discloses the use of industry-standard security measures while disclaiming any guarantee of absolute protection of personal data, limiting monday.com's liability exposure for data breaches or losses in storage.

AI-generated interpretation, not legal advice.

Privacy & data use
NeutralHigh
" Our Customers are solely responsible for determining whether and how they wish to use our Services, and for ensuring that all individuals using the Services on the Customer’s behalf or at their request, as well as all individuals whose personal data may be included in Customer Data processed through the Services, have been provided with adequate notice and given informed consent to the processing of their personal data, where such consent is necessary or advised, and that all legal requirements applicable to the collection, use or other processing of data through our Services are fully met by the Customer. Our Customers are also responsible for handling data subject rights requests under applicable law, by their Users and other individuals whose data they process through the Services."
§ 9 (Data Controller/Processor)Jump to exact text →
Source: other- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Places sole responsibility on Customers to ensure adequate notice and informed consent has been obtained from all individuals whose personal data is processed through the Services, and to comply with all applicable legal requirements for such data processing.

AI-generated interpretation, not legal advice.

Common questions about Monday AI's policies

Does Monday AI train its AI models on your data?
No training on your content by default — based on 2 verified findings from Monday AI's published policy. Informational only, not legal advice.
Who owns the content you create with Monday AI?
You own your outputs — based on 1 verified finding from Monday AI's published policy. Informational only, not legal advice.

Clause detail — protections, your obligations, and coverage

Every clause below is a verbatim quote from Monday AI's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.

✅ Protections found

28 verified clauses

Clauses in Monday AI's policies that work in your favour — commitments the platform made to you.

  • Privacy & data usesale/sharing of personal data
    If you wish to exercise your privacy rights under applicable law (including the EU or UK GDPR, Swiss Federal Data Protection Act, Israel’s Protection of Privacy Law, or the CCPA), such as (each to the extent applicable to you under the laws which apply to you)…

    Enumerates data subject rights available under GDPR, UK GDPR, Swiss FDPA, Israeli Privacy Law, and CCPA — including access, rectification, erasure, restriction, portability, and objection — specifying the legal framework…

    📍 § 8 (Data Subject Rights)Jump to exact text →
  • Audit rights, DPA & residency
    monday.com Inc., has certified to the U.S. Department of Commerce that monday.com Inc., adheres to the EU-US Data Privacy Framework Principles (EU-US DPF Principles) with regard to the processing of personal data received from the European Union in reliance on…

    Establishes monday.com Inc.'s certification and adherence obligations under the EU-US DPF Principles, UK Extension, and Swiss-US DPF Principles as a formal commitment to the US Department of Commerce governing cross-bord…

    📍 § 3 (Data Location & Retention)Jump to exact text →
  • Privacy & data usechildren's data
    Children : O ur Services are not designed to attract children who are underage according to data protection laws in their respective jurisdiction s. We do not knowingly or intentionally collect personal data from such underage children and do not wish to do so…

    Restricts collection of personal data from children who are underage under applicable data protection laws, states monday.com does not knowingly collect such data, and establishes a procedure to prohibit underage use and…

    📍 § 10 (Additional Notices)Jump to exact text →
  • Output ownershipattribution requirements
    2. Content. You and your Users may provide or make available to monday AI content, such as, text, prompts and datasets, and any other data you or your Users submit to the monday AI (“ Input ”) and receive output based on such Input (“ Output ”). Input and Outp…

    This segment defines 'Input,' 'Output,' and 'Content,' establishes that the customer retains ownership of their Content (treated as Customer Data), affirms monday.com's exclusive ownership of its Materials and Services,…

    Location: exact-text link only — source has no section structureJump to exact text →
  • Model trainingdoes-not-train
    6. Monitoring and Improvement . monday.com does not use Customer Data and/or Content to train artificial intelligence models and does not allow others to do so. Notwithstanding anything to the contrary in the Agreement, we may access and use data of your inter…

    This segment explicitly states that monday.com does not use Customer Data or Content to train AI models and does not permit others to do so, while also granting itself a permission to access and use interaction data for…

    Location: exact-text link only — source has no section structureJump to exact text →
  • Governing law & disputesarbitration & class-action waiver
    If a privacy complaint or dispute relating to personal data received by us in reliance on the DPF cannot be resolved through our internal processes, you did not receive a timely acknowledgement of your EU-US DPF-Principles related complaint from us, or we did…

    Establishes a multi-step dispute resolution procedure for unresolved DPF-related privacy complaints, including participation in the VeraSafe Data Privacy Framework Dispute Resolution Procedure as a free-of-charge recours…

    📍 § 3 (Data Location & Retention)Jump to exact text →

+ 22 more verified clauses of this kind on this platform, cited in full in the report.

📋 Rules you must follow

1 verified clause

What Monday AI requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.

  • Moderation & enforcementconduct restrictions
    4. Restrictions. You will not use monday AI (a) to develop, train, or improve any artificial intelligence models, or services that compete with monday AI, its AI models providers or the Services, including by using monday AI to extract, infer, reverse engineer…

    This segment explicitly prohibits the customer from using monday AI to develop, train, or improve competing AI models or services, from reverse engineering underlying technologies, and from using monday AI in ways that v…

    Location: exact-text link only — source has no section structureJump to exact text →

What the policies actually cover

14 topics
  • Product telemetry & usage tracking11 clauses
  • Advertising & tracking1 protective7 clauses
  • Sale or sharing of personal data1 protective2 clauses
  • Children's data1 protective1 clause
  • Government & law-enforcement disclosure3 clauses
  • Does not train on your content2 protective2 clauses
  • Arbitration & class-action waiver2 protective2 clauses
  • Damages & liability cap2 clauses
  • Terms can change at any time1 protective2 clauses
  • Deletion rights & post-termination survival1 clause
  • Feedback ownership2 clauses
  • Attribution requirements1 protective1 clause
  • Breach-notification promises2 protective2 clauses
  • Conduct restrictions1 obligation1 clause

67 further verified clauses are cited on this page but not yet assigned a topic.

Cross-clause notes

Cross-referenceacross documents

Two verified clauses intersect on the same subject matter: the policy document, § 3 (Data Location & Retention) addresses how long content is retained, and the Terms of Service addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.

Cross-reference

The policy document, “Customer, User, Prospect and Technology Partner personal data” describes rights the platform takes in user content, and the policy document, “Customer, User, Prospect and Technology Partner personal data” describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.

Automated cross-reference against the published rubric — not legal advice.

Clause intelligence

Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.

473
clauses
69
patterns
69
stances
privacy sharing · 54training use · 6dispute resolution · 5ip ownership · 2legal burden · 2
dispute resolutionMEDIUM§ 3 (Data Location & Retention)

The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.

Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.
Open source citation
dispute resolutionMEDIUM§ 3 (Data Location & Retention)

The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.

Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.
Open source citation
dispute resolutionMEDIUM§ 3 (Data Location & Retention)

The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.

Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.
Open source citation
dispute resolutionMEDIUM§ 3 (Data Location & Retention)

The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.

Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.
Open source citation
dispute resolutionMEDIUM§ 3 (Data Location & Retention)

The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.

Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.
Open source citation

Tier matrix

Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.

TierSurfaceVerdictRiskCitations
All applicable tiersaudit rights dpa residencyworsensHIGH7
All applicable tiersdata retentionworsensHIGH6
All applicable tiersgoverning law disputesconditionalMEDIUM5
All applicable tiersindemnity liabilityconditionalMEDIUM1
All applicable tiersoutput ownershipimprovesLOW1
All applicable tiersprivacy data useworsensHIGH11
All applicable tierssubprocessors data sharingconditionalMEDIUM5
All applicable tierstraining useimprovesLOW3
Freeindemnity liabilityconditionalMEDIUM1
Governmentaudit rights dpa residencyconditionalMEDIUM2
Governmentprivacy data useconditionalMEDIUM1
Team / Businessaudit rights dpa residencyconditionalMEDIUM2

Policy evolution

Open full timeline

Before/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.

improvedhigh materialityJun 17Jul 8, 2026

data sharing improved from high/sale or sell to medium/third party or vendor sharing.

Before · high
Children : O ur Services are not designed to attract children who are underage according to data protection laws in their respective jurisdiction s. We do not knowingly or intentionally collect personal data from such underage children and do not wish to do so. W e request that anyone underage refrains from providing their personal data to us. I f you believe that we might have any such data, please contact us at privacy@ monday.com . If we are made aware that a person who is underage according to the law applicable to them is using the Services, we will attempt to prohibit and block such use and will make our best efforts to promptly delete any personal data stored with us with regard to such child , except where retention is required for legal purposes. For the purposes of the CCPA, monday.com does not knowingly sell or share the personal information of individuals under the age of 16. If you believe that we might have any such data, please contact us by email at [email protected] .
Before citation
After · medium
monday.com Inc., has certified to the U.S. Department of Commerce that monday.com Inc., adheres to the EU-US Data Privacy Framework Principles (EU-US DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-US DPF, and from the UK (and Gibraltar) in reliance on the UK Extension to the EU-US DPF. monday.com Inc., furthermore certifies that it adheres to the Swiss-US Data Privacy Framework Principles (Swiss-US DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-US DPF. monday.com Inc., will remain liable for onward transfers of your personal data to third parties (including our Service Providers) in accordance with applicable data transfer mechanisms. If there is any conflict between the terms in this privacy policy and the EU-US DPF Principles and/or the Swiss-US DPF, the Principles shall govern with respect to personal data transferred under the DPF. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/ .
After citation
Jul 20, 2026model trainingLOW

Latest stance: no training claim on training use

4. Restrictions. You will not use monday AI (a) to develop, train, or improve any artificial intelligence models, or services that compete with monday AI, its AI models providers or the Services, including by using monday AI to extract, infer, reverse engineer, replicate, or otherwise attempt to derive models, systems, methodologies, underlying technologies or the Services; or (b) in a manner that may: (i) violate any applicable law, (ii) breach these monday AI Terms, the Agreement or applicable Acceptable Use Policies as defined in Section 7 below, (iii) infringe third party rights, including but not limited to intellectual property rights or privacy rights, (iv) falsely represent Content as human generated, (v) perform automated decision making, including profiling, which may significantly impact individual rights without adequate safeguards, human oversight, and transparency, (vi) use monday AI to infer sensitive attributes, such as race, political opinions, or sexual orientation, without explicit consent or authorization where required by law; and (vii) to impersonate any person, organization, or entity, or (vii) to engage in unlawful, fraudulent, misleading, or deceptive activities, including misrepresenting the origin of communications.
Open timeline citation
Jul 20, 2026content ownershipLOW

Latest stance: user retains rights on training use

2. Content. You and your Users may provide or make available to monday AI content, such as, text, prompts and datasets, and any other data you or your Users submit to the monday AI (“ Input ”) and receive output based on such Input (“ Output ”). Input and Output are referred to together as “ Content ”. As between you and monday.com, you retain ownership of your Content which shall be regarded as Customer Data . All monday.com Materials and Services are and shall remain the exclusive property of monday.com. You acknowledge that (i) due to the nature of machine learning and artificial intelligence, other monday.com customers and/or their users may generate identical or similar outputs, and similar to those included in monday AI or monday.com Materials; (ii) Output may be inaccurate, incomplete and does not reflect the views or recommendations of monday.com, its Affiliates, vendors, third party services providers or Third Party Agents.
Open timeline citation
Jul 20, 2026model trainingMEDIUM

Latest stance: training with opt out on training use

6. Monitoring and Improvement . monday.com does not use Customer Data and/or Content to train artificial intelligence models and does not allow others to do so. Notwithstanding anything to the contrary in the Agreement, we may access and use data of your interaction with, and your use of monday AI in order to monitor and improve the Services, for example, to ensure that features work as intended, to comply with legal obligations, monitor, prevent, or debug abusive, unlawful or harmful activities, and to adapt our Services to better meet user needs. Such data will not be shared with third parties and may be retained by us for up to 60 days. Your Admin(s) can opt-out your Account from use of Customer Data and/or Content to improve our Services, by contacting our Support here or via [email protected] . To clarify, regardless of whether your Admin(s) opts-out, such data will not be used to train models.
Open timeline citation
Jul 20, 2026model trainingLOW

Latest stance: no training claim on training use

6. Monitoring and Improvement . monday.com does not use Customer Data and/or Content to train artificial intelligence models and does not allow others to do so. Notwithstanding anything to the contrary in the Agreement, we may access and use data of your interaction with, and your use of monday AI in order to monitor and improve the Services, for example, to ensure that features work as intended, to comply with legal obligations, monitor, prevent, or debug abusive, unlawful or harmful activities, and to adapt our Services to better meet user needs. Such data will not be shared with third parties and may be retained by us for up to 60 days. Your Admin(s) can opt-out your Account from use of Customer Data and/or Content to improve our Services, by contacting our Support here or via [email protected] . To clarify, regardless of whether your Admin(s) opts-out, such data will not be used to train models.
Open timeline citation

Capture recency

  • Privacy Policy:Last captured 2026-07-20· verified 2026-07-20
  • Terms of Service:Last captured 2026-07-20· verified 2026-07-20

Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.

↑ 60 more findings this quarter vs last (213 vs 153). First scan: June 2026.

Claim this profile

Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Monday AI's policies — no human edits the data.

Need this for procurement or legal diligence?

Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.

Every finding above is a verbatim quote from Monday AI's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.

📢 POLICY UPDATES ALERT

AIRIN Brief

Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.