Monday AI
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“To publish your feedback and submissions to our Sites, public forums and blogs (Performance of Contract; Legitimate Interests) ;”
Watch: audit rights dpa residency
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Multi-jurisdictional processing creates compliance complexity. 'Other locations as reasonably necessary' is an open-ended carve-out that prevents users from knowing with certainty where their data resides. Enterprise customers may have contractual data residency requirements that must be separately negotiated via the DPA.
This segment is a broad limitation of liability clause in which monday.com excludes liability for damages arising from combinations of monday AI with third-party products, inaccuracies in Content, and other specified scenarios, and does so to the fullest extent permitted by law — constituting an operative cap and exclusion on monetary remedies.
Automated collection of granular behavioral data — sessions, clicks, feature use — constitutes profiling under GDPR Article 4(4). Users have rights regarding automated profiling, and the breadth of collection may require a DPIA under Article 35.
Scores derived from 33 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Monday AI's terms explicitly protect your inputs from training use — the policy is affirmatively favorable on this point.
- Your outputs and prompts are explicitly yours — Monday AI's terms include affirmatively protective IP language.
- Data handling is conditional — 9 privacy or retention clauses warrant review before using Monday AI at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Monday AI's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 189 verified, verbatim-cited findings below — read the citations.
Based on 227 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Privacy PolicyVerified - read in full - 0 citationsstaticLast captured 2026-07-20
- Terms of ServiceVerified - read in full - 17 citationsstaticLast captured 2026-07-20
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Authorizes creation and use of aggregated, anonymized, or pseudonymized data derived from personal data for service improvement and business intelligence purposes, effectively permitting secondary use of processed personal data.
" To create aggregated, statistical data, inferred non-personal data or anonymized or pseudonymized data (rendered non-personal), which we or others may use to provide and improve our respective Services, or for any other business purpose su..."
Defines 'Customer Data' as personal data processed on behalf of business Customers submitted to the Platform, and defines 'Platform' to encompass all monday.com cloud-based services, APIs, tools, and applications, establishing the subject matter scope for data processing obligations.
" (i) Customer Data : personal data that we collect, process and manage on behalf of our business customers (“ Customers ”), submitted to the monday.com cloud-based services, including our platforms, products, applications, APIs, tools, and..."
Affirms data subjects' right to choose whether to provide personal data, while noting the consequence that withholding data may preclude use of the Sites or Services, establishing voluntary disclosure as a governing principle.
" You are not legally required to provide us with any of your personal data, and may do so (or avoid doing so) at your own free will. If you prefer not to provide us with your personal data, or to have it processed by us or any of our servic..."
Restricts the use of personal data obtained from Google OAuth API Scopes to specific enumerated purposes in accordance with Google API Services Data Policy's Limited Use requirements, defining 'Restricted personal data' in the process.
" With respect to personal data we obtain from Google OAuth API Scopes, used in our integration with certain Google Services (“ Integrated Google Services ”), our use of such personal data and data aggregated, anonymized, or derived therefro..."
Permits use of personal data including behavioral and interests-based profiling for marketing campaigns, ad management, and targeted advertising across websites and applications under legitimate interests.
" To facilitate and optimize our marketing campaigns, ad management and sales operations, and to manage and deliver advertisements for our Services more effectively, including on other websites and applications. Such activities allow us to h..."
Defines the legal roles of 'data controller' and 'data processor' as used under GDPR and CCPA frameworks, establishing the interpretive basis for the role allocations described in subsequent segments.
" Certain data protection laws and regulations, such as the GDPR or the CCPA, typically distinguish between two main roles for parties processing personal data: the “data controller” (or under the CCPA, “business”), who determines the purpos..."
This segment is an all-caps disclaimer in which monday.com expressly disclaims all warranties — express, implied, and otherwise — regarding monday AI, its features, generated content, and results, and places the risk of use entirely on the customer, constituting a broad warranty disclaimer with legal effect on liability exposure.
" 8. Disclaimer of Warranties . MONDAY.COM DISCLAIMS ALL WARRANTIES AND REPRESENTATIONS REGARDING MONDAY AI, ITS FEATURES, FUNCTIONALITIES, GENERATED CONTENT, AND/OR RESULTS THAT MAY BE OBTAINED FROM USE OF MONDAY AI. USE OF MONDAY AI IS AT ..."
Allows disclosure and use of personal data to facilitate partnerships with local distributors, resellers, and professional services providers for growth and localized experience purposes under legitimate interests.
" To explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences, including through partnerships with local distributors, resellers, business partners and providers of professional services rela..."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"To gain a better understanding of how Users, Prospects and Technology Partners evaluate, use, and interact with our Services, to utilize such information to continuously improve our Services, the overall performance, user-experience and value generated therefrom. We collect such information automatically through their usage of the Services, including through User’s utilization of artificial intelligence capabilities in the Platform (Legitimate Interests) ;"
Under GDPR, reliance on Legitimate Interests requires a balancing test; users have a right to object. The explicit call-out of AI capability usage as a data collection trigger increases risk that prompts/outputs are being analyzed for service improvement without clear opt-out mechanisms.
AI-generated interpretation, not legal advice.
" To create aggregated, statistical data, inferred non-personal data or anonymized or pseudonymized data (rendered non-personal), which we or others may use to provide and improve our respective Services, or for any other business purpose such as business intelligence (Legitimate Interests) ;"
Authorizes creation and use of aggregated, anonymized, or pseudonymized data derived from personal data for service improvement and business intelligence purposes, effectively permitting secondary use of processed personal data.
AI-generated interpretation, not legal advice.
" We use personal data as necessary for the performance of our Services (“ Performance of Contract ”); to comply with our legal and contractual obligations (“ Legal Obligations ”); and to support our legitimate interests in maintaining and improving our Services, e.g. in understanding how our Services are used and how our campaigns are performing, and gaining insights which help us dedicate our resources and efforts more efficiently; in marketing, advertising and selling our Services to you and others; providing customer services and technical support; and protecting and securing our Users, Customers, Prospects and Technology Partners, ourselves and our Services (“ Legitimate Interests ”)."
Establishes the legal bases under which monday.com processes personal data—Performance of Contract, Legal Obligations, and Legitimate Interests—and enumerates the purposes for which data is used, creating binding disclosure and processing obligations under applicable data protection law.
AI-generated interpretation, not legal advice.
"We collect and generate this information automatically, including through the use of analytics tools (including cookies and pixels) – which collect data such as: how often Prospects or Technology Partners visit or use the Sites, which pages they visit and when, which website, ad or email message brought them there, and how Users interact with and use the Platform and its various features."
Describes the automated methods by which monday.com collects usage and device data, including analytics tools, cookies, and pixels, specifying the procedural means of data collection and the types of behavioral data gathered.
AI-generated interpretation, not legal advice.
" Protecting Rights and Safety : We may disclose your personal data to others if we believe in good faith that this will help protect the rights, property or safety of monday.com, any of our Users or Customers, or any members of the general public."
Permits disclosure of personal data to third parties when monday.com believes in good faith it is necessary to protect the rights, property, or safety of the company, users, customers, or the public.
AI-generated interpretation, not legal advice.
" To explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences, including through partnerships with local distributors, resellers, business partners and providers of professional services related to our Services (“ Partners ”, as further described in Section 4 below) (Legitimate Interests) ;"
Allows disclosure and use of personal data to facilitate partnerships with local distributors, resellers, and professional services providers for growth and localized experience purposes under legitimate interests.
AI-generated interpretation, not legal advice.
" For the avoidance of doubt, monday.com may disclose your personal data in additional manners, pursuant to your explicit approval, if we are legally obligated to do so, or if we have successfully rendered such data non-personal and anonymous."
Grants a residual permission to disclose personal data in additional ways with explicit user approval, when legally obligated, or after successful anonymization, clarifying that the enumerated disclosure categories are not exhaustive.
AI-generated interpretation, not legal advice.
" Legal Compliance : In exceptional circumstances, we may disclose or allow government and law enforcement officials access to your personal data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect the security or integrity of our products and Services."
Permits disclosure of personal data to government or law enforcement in response to legal process or in good faith belief of legal obligation, investigation needs, or regulatory compliance, identifying the conditions under which such disclosure is permitted.
AI-generated interpretation, not legal advice.
"Usage and device information concerning our Users, Prospects and Technology Partners : Connectivity, technical and usage data, such as IP addresses and approximate general locations derived from such IP addresses, device and application data (like type, operating system, mobile device or app id, browser version, location and language settings used), user-customized IDs (where personal data is included), activity logs, the relevant cookies and pixels installed or utilized on your device, and the recorded activity (sessions, clicks, use of features, logged activities and other interactions) of Prospects, Users and Technology Partners in connection with our Services."
Automated collection of granular behavioral data — sessions, clicks, feature use — constitutes profiling under GDPR Article 4(4). Users have rights regarding automated profiling, and the breadth of collection may require a DPIA under Article 35.
AI-generated interpretation, not legal advice.
" 10. LIMITATION OF LIABILITY. NOTWITHSTANDING ANYTHING TO THE CONTRARY, EITHER IN THE AGREEMENT OR ELSEWHERE, AND TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT SHALL MONDAY.COM, ITS AFFILIATES, SUBCONTRACTORS, AGENTS, VENDORS (INCLUDING THIRD PARTY SERVICE PROVIDERS) BE LIABLE FOR DAMAGES ARISING OUT OF OR RELATING TO: (A) THE COMBINATION OF MONDAY AI AND/OR CONTENT WITH ANY PRODUCTS, SERVICES, OR SOFTWARE NOT PROVIDED BY MONDAY.COM OR ON ITS BEHALF; (B) CONTENT PROVIDED BY THE CUSTOMER OR ITS USERS OR CREATED BY MONDAY AI INCLUDING ANY INACCURACIES OR OMISSIONS THEREIN, AND ANY MODIFICATIONS TO THE FOREGOING BY ANY PARTY OTHER THAN MONDAY.COM OR ITS AUTHORIZED REPRESENTATIVES; (C) THE CUSTOMER’S OR ITS USERS’ USE OF MONDAY AI IN NON-COMPLIANCE WITH THESE MONDAY AI TERMS, THE ACCEPTABLE USE POLICIES, APPLICABLE LAWS, REGULATIONS, OR INDUSTRY STANDARDS, OR OTHERWISE IN A MANNER INCONSISTENT WITH THE DOCUMENTATION OR INTENDED USE OF THE SERVICES, TO THE EXTENT THE CLAIM WOULD NOT HAVE ARISEN BUT FOR SUCH USE."
This segment is a broad limitation of liability clause in which monday.com excludes liability for damages arising from combinations of monday AI with third-party products, inaccuracies in Content, and other specified scenarios, and does so to the fullest extent permitted by law — constituting an operative cap and exclusion on monetary remedies.
AI-generated interpretation, not legal advice.
"Partnerships : We engage selected business and channel partners, resellers, distributors and providers of professional services related to our Services, which allow us to explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences for our prospective and existing Customers and Users. In such instances, we may disclose relevant contact, business and usage details to the respective Partner, to allow them to engage with those Customers and Users for such purposes. If you directly engage with any of our Partners, please note that any aspect of that engagement which is not directly related to the Services and directed by monday.com is beyond the scope of monday.com’s Terms and Privacy Policy, and may therefore be governed by the Partner’s terms and privacy policy."
Disclosure to commercial partners for sales/growth purposes relies on Legitimate Interests. The disclaimer that partner conduct is governed by the partner's own terms creates a gap in user protections once data is transferred.
AI-generated interpretation, not legal advice.
"Application Providers and Event Sponsors : We may disclose relevant connectivity, technical and usage data to the provider(s) of any third-party applications, or if so instructed or permitted by you or your Account Admin, your personal data (such as your User Profile and contact details, as well as relevant technical data) to provider(s) of any third-party integrations or applications added to your Account. We may also share connectivity, technical, and usage data with the provider(s) of third-party applications whose marketplace pages you have visited."
Passive browsing of marketplace pages triggering data disclosure to third parties raises consent questions under GDPR/ePrivacy. Admin-controlled sharing of individual user data could conflict with employee privacy expectations under applicable labor laws.
AI-generated interpretation, not legal advice.
"Service Providers : We engage selected third-party companies and individuals as “Service Providers”, to perform services on our behalf or complementary to our own. These include providers of Third Party Services (as defined in the Terms ), such as: hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, fraud detection, investigation and prevention services, web and mobile analytics, email and communication distribution and monitoring services, session or activity recording services, call recording, analytics and transcription services, event production and hosting services, remote access services, performance measurement, data optimization and marketing services, social and advertising networks, content, lead generating and data enrichment providers, email, voicemails, video conferencing solutions, support and customer relation management systems, third-party customer support providers, and our legal, compliance and financial advisors and auditors. Our Service Providers may have access to personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services or other activities, and may only use the data as determined in our agreements with them."
The breadth of categories (including 'social and advertising networks' and 'data enrichment providers') means personal data may flow to numerous parties. Users cannot easily identify which specific companies hold their data. Contractual limits on subprocessor use are referenced but not detailed.
AI-generated interpretation, not legal advice.
" Our Service Providers may have access to personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services or other activities, and may only use the data as determined in our agreements with them."
Restricts service providers' use of personal data to purposes determined by their specific roles and limited to what is defined in the contractual agreements with monday.com, prohibiting unauthorized secondary use.
AI-generated interpretation, not legal advice.
"Data Location : We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States (US), Europe, Israel, Australia, Guatemala, the Philippines, Brazil, Japan, Singapore, the United Kingdom (UK), and other locations as reasonably necessary for the proper performance and delivery of our Services, or as may be required by applicable law."
Multi-jurisdictional processing creates compliance complexity. 'Other locations as reasonably necessary' is an open-ended carve-out that prevents users from knowing with certainty where their data resides. Enterprise customers may have contractual data residency requirements that must be separately negotiated via the DPA.
AI-generated interpretation, not legal advice.
" To publish your feedback and submissions to our Sites, public forums and blogs (Performance of Contract; Legitimate Interests) ;"
Grants permission to publish user feedback and submissions to public-facing sites, forums, and blogs under performance of contract and legitimate interests.
AI-generated interpretation, not legal advice.
" In order to protect your personal data held with us, we use industry-standard physical, procedural and technical security measures, including encryption as appropriate. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties as described in Section 4 above. To learn more, please visit our Trust Center ."
Discloses the use of industry-standard security measures while disclaiming any guarantee of absolute protection of personal data, limiting monday.com's liability exposure for data breaches or losses in storage.
AI-generated interpretation, not legal advice.
" Our Customers are solely responsible for determining whether and how they wish to use our Services, and for ensuring that all individuals using the Services on the Customer’s behalf or at their request, as well as all individuals whose personal data may be included in Customer Data processed through the Services, have been provided with adequate notice and given informed consent to the processing of their personal data, where such consent is necessary or advised, and that all legal requirements applicable to the collection, use or other processing of data through our Services are fully met by the Customer. Our Customers are also responsible for handling data subject rights requests under applicable law, by their Users and other individuals whose data they process through the Services."
Places sole responsibility on Customers to ensure adequate notice and informed consent has been obtained from all individuals whose personal data is processed through the Services, and to comply with all applicable legal requirements for such data processing.
AI-generated interpretation, not legal advice.
Common questions about Monday AI's policies
- Does Monday AI train its AI models on your data?
- No training on your content by default — based on 2 verified findings from Monday AI's published policy. Informational only, not legal advice.
- Who owns the content you create with Monday AI?
- You own your outputs — based on 1 verified finding from Monday AI's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Monday AI's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
28 verified clausesClauses in Monday AI's policies that work in your favour — commitments the platform made to you.
- Privacy & data usesale/sharing of personal data
“If you wish to exercise your privacy rights under applicable law (including the EU or UK GDPR, Swiss Federal Data Protection Act, Israel’s Protection of Privacy Law, or the CCPA), such as (each to the extent applicable to you under the laws which apply to you)…”
Enumerates data subject rights available under GDPR, UK GDPR, Swiss FDPA, Israeli Privacy Law, and CCPA — including access, rectification, erasure, restriction, portability, and objection — specifying the legal framework…
📍 § 8 (Data Subject Rights)Jump to exact text → - Audit rights, DPA & residency
“monday.com Inc., has certified to the U.S. Department of Commerce that monday.com Inc., adheres to the EU-US Data Privacy Framework Principles (EU-US DPF Principles) with regard to the processing of personal data received from the European Union in reliance on…”
Establishes monday.com Inc.'s certification and adherence obligations under the EU-US DPF Principles, UK Extension, and Swiss-US DPF Principles as a formal commitment to the US Department of Commerce governing cross-bord…
📍 § 3 (Data Location & Retention)Jump to exact text → - Privacy & data usechildren's data
“Children : O ur Services are not designed to attract children who are underage according to data protection laws in their respective jurisdiction s. We do not knowingly or intentionally collect personal data from such underage children and do not wish to do so…”
Restricts collection of personal data from children who are underage under applicable data protection laws, states monday.com does not knowingly collect such data, and establishes a procedure to prohibit underage use and…
📍 § 10 (Additional Notices)Jump to exact text → - Output ownershipattribution requirements
“2. Content. You and your Users may provide or make available to monday AI content, such as, text, prompts and datasets, and any other data you or your Users submit to the monday AI (“ Input ”) and receive output based on such Input (“ Output ”). Input and Outp…”
This segment defines 'Input,' 'Output,' and 'Content,' establishes that the customer retains ownership of their Content (treated as Customer Data), affirms monday.com's exclusive ownership of its Materials and Services,…
Location: exact-text link only — source has no section structureJump to exact text → - Model trainingdoes-not-train
“6. Monitoring and Improvement . monday.com does not use Customer Data and/or Content to train artificial intelligence models and does not allow others to do so. Notwithstanding anything to the contrary in the Agreement, we may access and use data of your inter…”
This segment explicitly states that monday.com does not use Customer Data or Content to train AI models and does not permit others to do so, while also granting itself a permission to access and use interaction data for…
Location: exact-text link only — source has no section structureJump to exact text → - Governing law & disputesarbitration & class-action waiver
“If a privacy complaint or dispute relating to personal data received by us in reliance on the DPF cannot be resolved through our internal processes, you did not receive a timely acknowledgement of your EU-US DPF-Principles related complaint from us, or we did…”
Establishes a multi-step dispute resolution procedure for unresolved DPF-related privacy complaints, including participation in the VeraSafe Data Privacy Framework Dispute Resolution Procedure as a free-of-charge recours…
📍 § 3 (Data Location & Retention)Jump to exact text →
+ 22 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
1 verified clauseWhat Monday AI requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Moderation & enforcementconduct restrictions
“4. Restrictions. You will not use monday AI (a) to develop, train, or improve any artificial intelligence models, or services that compete with monday AI, its AI models providers or the Services, including by using monday AI to extract, infer, reverse engineer…”
This segment explicitly prohibits the customer from using monday AI to develop, train, or improve competing AI models or services, from reverse engineering underlying technologies, and from using monday AI in ways that v…
Location: exact-text link only — source has no section structureJump to exact text →
What the policies actually cover
14 topics- Product telemetry & usage tracking11 clauses
- Advertising & tracking1 protective7 clauses
- Sale or sharing of personal data1 protective2 clauses
- Children's data1 protective1 clause
- Government & law-enforcement disclosure3 clauses
- Does not train on your content2 protective2 clauses
- Arbitration & class-action waiver2 protective2 clauses
- Damages & liability cap2 clauses
- Terms can change at any time1 protective2 clauses
- Deletion rights & post-termination survival1 clause
- Feedback ownership2 clauses
- Attribution requirements1 protective1 clause
- Breach-notification promises2 protective2 clauses
- Conduct restrictions1 obligation1 clause
67 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the policy document, § 3 (Data Location & Retention) addresses how long content is retained, and the Terms of Service addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
The policy document, “Customer, User, Prospect and Technology Partner personal data” describes rights the platform takes in user content, and the policy document, “Customer, User, Prospect and Technology Partner personal data” describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“Furthermore, subject to certain conditions (as described under the EU-US DPF Principles that monday.com Inc. adheres to), you may invoke binding arbitration by delivering a notice to us via [email protected] . monday.com Inc. is also subject to the investigatory and enforcement powers of the Federal Trade Commission.”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | audit rights dpa residency | worsens | HIGH | 7 |
| All applicable tiers | data retention | worsens | HIGH | 6 |
| All applicable tiers | governing law disputes | conditional | MEDIUM | 5 |
| All applicable tiers | indemnity liability | conditional | MEDIUM | 1 |
| All applicable tiers | output ownership | improves | LOW | 1 |
| All applicable tiers | privacy data use | worsens | HIGH | 11 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 5 |
| All applicable tiers | training use | improves | LOW | 3 |
| Free | indemnity liability | conditional | MEDIUM | 1 |
| Government | audit rights dpa residency | conditional | MEDIUM | 2 |
| Government | privacy data use | conditional | MEDIUM | 1 |
| Team / Business | audit rights dpa residency | conditional | MEDIUM | 2 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“Children : O ur Services are not designed to attract children who are underage according to data protection laws in their respective jurisdiction s. We do not knowingly or intentionally collect personal data from such underage children and do not wish to do so. W e request that anyone underage refrains from providing their personal data to us. I f you believe that we might have any such data, please contact us at privacy@ monday.com . If we are made aware that a person who is underage according to the law applicable to them is using the Services, we will attempt to prohibit and block such use and will make our best efforts to promptly delete any personal data stored with us with regard to such child , except where retention is required for legal purposes. For the purposes of the CCPA, monday.com does not knowingly sell or share the personal information of individuals under the age of 16. If you believe that we might have any such data, please contact us by email at [email protected] .”Before citation
“monday.com Inc., has certified to the U.S. Department of Commerce that monday.com Inc., adheres to the EU-US Data Privacy Framework Principles (EU-US DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-US DPF, and from the UK (and Gibraltar) in reliance on the UK Extension to the EU-US DPF. monday.com Inc., furthermore certifies that it adheres to the Swiss-US Data Privacy Framework Principles (Swiss-US DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-US DPF. monday.com Inc., will remain liable for onward transfers of your personal data to third parties (including our Service Providers) in accordance with applicable data transfer mechanisms. If there is any conflict between the terms in this privacy policy and the EU-US DPF Principles and/or the Swiss-US DPF, the Principles shall govern with respect to personal data transferred under the DPF. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/ .”After citation
Latest stance: no training claim on training use
“4. Restrictions. You will not use monday AI (a) to develop, train, or improve any artificial intelligence models, or services that compete with monday AI, its AI models providers or the Services, including by using monday AI to extract, infer, reverse engineer, replicate, or otherwise attempt to derive models, systems, methodologies, underlying technologies or the Services; or (b) in a manner that may: (i) violate any applicable law, (ii) breach these monday AI Terms, the Agreement or applicable Acceptable Use Policies as defined in Section 7 below, (iii) infringe third party rights, including but not limited to intellectual property rights or privacy rights, (iv) falsely represent Content as human generated, (v) perform automated decision making, including profiling, which may significantly impact individual rights without adequate safeguards, human oversight, and transparency, (vi) use monday AI to infer sensitive attributes, such as race, political opinions, or sexual orientation, without explicit consent or authorization where required by law; and (vii) to impersonate any person, organization, or entity, or (vii) to engage in unlawful, fraudulent, misleading, or deceptive activities, including misrepresenting the origin of communications.”Open timeline citation
Latest stance: user retains rights on training use
“2. Content. You and your Users may provide or make available to monday AI content, such as, text, prompts and datasets, and any other data you or your Users submit to the monday AI (“ Input ”) and receive output based on such Input (“ Output ”). Input and Output are referred to together as “ Content ”. As between you and monday.com, you retain ownership of your Content which shall be regarded as Customer Data . All monday.com Materials and Services are and shall remain the exclusive property of monday.com. You acknowledge that (i) due to the nature of machine learning and artificial intelligence, other monday.com customers and/or their users may generate identical or similar outputs, and similar to those included in monday AI or monday.com Materials; (ii) Output may be inaccurate, incomplete and does not reflect the views or recommendations of monday.com, its Affiliates, vendors, third party services providers or Third Party Agents.”Open timeline citation
Latest stance: training with opt out on training use
“6. Monitoring and Improvement . monday.com does not use Customer Data and/or Content to train artificial intelligence models and does not allow others to do so. Notwithstanding anything to the contrary in the Agreement, we may access and use data of your interaction with, and your use of monday AI in order to monitor and improve the Services, for example, to ensure that features work as intended, to comply with legal obligations, monitor, prevent, or debug abusive, unlawful or harmful activities, and to adapt our Services to better meet user needs. Such data will not be shared with third parties and may be retained by us for up to 60 days. Your Admin(s) can opt-out your Account from use of Customer Data and/or Content to improve our Services, by contacting our Support here or via [email protected] . To clarify, regardless of whether your Admin(s) opts-out, such data will not be used to train models.”Open timeline citation
Latest stance: no training claim on training use
“6. Monitoring and Improvement . monday.com does not use Customer Data and/or Content to train artificial intelligence models and does not allow others to do so. Notwithstanding anything to the contrary in the Agreement, we may access and use data of your interaction with, and your use of monday AI in order to monitor and improve the Services, for example, to ensure that features work as intended, to comply with legal obligations, monitor, prevent, or debug abusive, unlawful or harmful activities, and to adapt our Services to better meet user needs. Such data will not be shared with third parties and may be retained by us for up to 60 days. Your Admin(s) can opt-out your Account from use of Customer Data and/or Content to improve our Services, by contacting our Support here or via [email protected] . To clarify, regardless of whether your Admin(s) opts-out, such data will not be used to train models.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-07-20· verified 2026-07-20
- Terms of Service:Last captured 2026-07-20· verified 2026-07-20
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 60 more findings this quarter vs last (213 vs 153). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Monday AI's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Monday AI's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.