Privacy Policy

DedupeIQ: Merge Duplicates for monday.com

Effective date: September 26, 2026

This Privacy Policy explains how Alpenglow Software LLC ("we," "us," "our"), operator of DedupeIQ ("the App"), collects, uses, stores, and protects information when you install and use the App through the monday.com platform. DedupeIQ finds duplicate and near-duplicate items on your monday.com boards, lets you review each match, and, only when you choose to, merges a confirmed pair by filling in the item you keep and archiving the other.

The short version: scanning, reviewing and merging run in your browser, and our servers never store the item names or column values on your boards. Our servers store only IDs, counts, match scores, your review decisions, merge records (IDs only), and your plan status. Two optional features process board content outside your browser, and only when someone on your team starts them:

• AI review sends the name, email, phone and company of the pairs you choose to monday.com's AI service, which returns a suggested verdict. It does not go to our servers.
• DedupeIQ in monday sidekick asks our server to read the board you name and check it for duplicates or for a record you describe. Our server does this in memory, answers, and keeps no board content (it records only that the skill ran, as a usage event).

1. Information We Collect

Permissions (monday.com OAuth scopes)

• boards:read: used to read the columns and items of the boards you choose to scan, so duplicates can be detected. This reading happens in your browser.
• boards:write: used only when you explicitly merge a confirmed pair (or keep one of two records across boards). The App writes the values you chose to the item you keep and archives the other item. Scanning and reviewing never write to your boards.
• ai:consume: used only when someone clicks AI review, to ask monday.com's AI service about the pairs they chose. Usage is billed to your monday.com account's AI credits.

Data processed in your browser when you use the App (not sent to us)

• Item names and column values of the boards you scan, including names, email addresses, phone numbers, company names, and the other columns shown when you compare or merge two items.
• Match explanations (for example, "nickname: Bob and Robert"). These are generated and shown only in your browser and are never sent to us.

Data processed by monday.com's AI service (only when you use AI review)

• When someone clicks AI review, the App sends the name, email address, phone number and company of the pairs they chose (up to 30 pairs per click) from their browser to monday.com's AI service, using their own monday.com session. No other columns, and no item or board IDs, are included.
• monday.com's AI service returns a suggested verdict (likely the same, likely different, or unsure) and a short reason for each pair. These are shown in your browser. If you then confirm or dismiss that pair, we store only the verdict label (same, different or unsure) with your decision, never the reason text or any board content.
• monday.com processes AI requests with its AI model providers under monday.com's own terms and agreements. DedupeIQ has no direct relationship with those providers and does not receive or keep the request or the response.

Data processed in memory by our server (only when you use DedupeIQ in monday sidekick)

• When someone asks monday sidekick to use a DedupeIQ skill, monday.com sends our server the details sidekick took from the conversation (the board to check, and for the "already exists" check, the name, email, phone or company to look for) together with a short-lived monday.com token for that request.
• Our server uses that token only to read the named boards' item names and their name, email, phone and company columns from monday.com, compares them in memory, and returns a short answer to monday sidekick (match counts, the names of matching items, why they match, and links to them). The board data, the details from the conversation, and the token are discarded when the request ends and are not stored. Our logs for these requests record only your account ID, board IDs and counts (and, for errors, the error type).
• monday sidekick shows that answer to you as part of your conversation, which monday.com processes under its own terms.

Data we store (on monday.com's infrastructure)

• Scan summaries: your monday.com account ID, the board ID(s) scanned, the number of items read, the total items on the boards, whether the scan reached your plan's record limit, match counts (overall and per board or board pair), and which column IDs were used for name, email, phone, and company.
• Review decisions: for each pair you confirm or dismiss, the two item IDs, the decision, the match band and confidence score, the time, and, when available, the AI review's verdict label and how similar each compared field was (a number from 0 to 100 per field, never the field's value). Undoing a decision deletes it.
• Merge records: for each merge you perform, the item IDs involved (and, for a cross-board merge, the board of the archived item), the IDs of columns filled, chosen, or skipped, the match band, whether it was a bulk or cross-board merge, the time, and whether the archive step succeeded. No column values are recorded.
• Usage events: product events such as "scan run," "upgrade prompt shown," "AI review used" (how many pairs, the verdict counts, and whether it succeeded) or "sidekick skill used" (which skill, whether it succeeded, and how long it took), with IDs and counts only.
• Plan and subscription status: your current DedupeIQ plan, trial status, and related dates, as reported by monday.com's billing system. Plan limits (for example, scans this month or merges used in a trial) are calculated from your scan and merge records.
• Rate-limit counters: a per-account daily count of database writes, used to protect the service from abuse.
• Install and plan history: the date you installed the App and your plan-change history.
• Welcome status: whether your account has seen the App's welcome page.

Data we do NOT collect

• We do not store item names or column values from your boards (no names, emails, phone numbers, companies, notes, files, or updates), including any processed for monday sidekick or AI review as described above
• monday.com user IDs, user names, or email addresses (records written before September 24, 2026 may contain a numeric monday.com user ID; these are deleted with the rest of your data on uninstall)
• Payment card or banking information (billing is handled entirely by monday.com)
• Tracking, advertising, or web-analytics data

Duplicate matching is performed by deterministic statistical comparison, not by AI. AI is used only in the two optional features above (AI review, and monday sidekick itself), both provided through monday.com's AI, which uses third-party model providers (such as OpenAI and Anthropic). We do not use your board content to train AI or machine-learning models. We do use aggregate decision statistics, which contain no board content (for example, how often people confirm pairs with a given similarity score, or agree with AI review's verdict), to tune DedupeIQ's matching thresholds and AI review instructions.

2. How We Use Your Information

• Resume and remember: scan summaries and decisions let you reopen a board where you left off, and keep dismissed pairs dismissed when you scan again.
• Merging at your direction: merge records provide an audit trail of merges you performed.
• Plans and limits: plan status and counters let us apply the features and limits of your plan.
• Answering sidekick requests: reading the boards named in a monday sidekick request, in memory, only to return the answer.
• Improving the App: aggregate usage events and decision statistics (counts and scores, not content) help us understand which features are used and make matching and AI review more accurate.
• Support and operations: we review per-account usage metrics (for example, scan and merge counts, plan, and install date; never board content) to operate the App, provide support, and prevent abuse. After you uninstall, we keep only account-free daily totals (for example, the number of installs per day).

We do not sell your data, and we do not use it for advertising, marketing, or profiling. DedupeIQ never merges or changes anything automatically: every merge is started by a member of your team.

For the purposes of applicable data protection laws, you are the data controller for your board data. Alpenglow Software LLC acts as your data processor for the identifiers described above and for board content our server reads in memory to answer a monday sidekick request, processing them solely on your behalf and as described in this policy. For AI review, board content goes directly from your browser to monday.com under your own agreement with monday.com; we do not receive it, and monday.com's AI providers are not our sub-processors. For aggregate product usage data and for information you send us directly (such as support emails), we act as an independent controller.

3. Data Storage and Security

• The App runs entirely on monday.com infrastructure: the interface is served from monday.com's app hosting, and our server and database run on monday code, monday.com's hosting platform, in the United States region.
• All connections use HTTPS/TLS encryption in transit.
• Every request is authenticated with a token signed by monday.com (a session token in the App, or a signed request for monday sidekick), and all stored data is scoped to your monday.com account.
• We do not store monday.com access tokens. Each request carries a short-lived session token that we verify and do not keep. In the App, board reads, merges and AI review run in your browser using your own monday.com session. When monday sidekick runs a DedupeIQ skill, monday.com gives our server a short-lived token for that one request, limited to the App's permissions on your account; we use it only to read the boards named in the request and never store it.
• Logging: our server logs technical events needed to operate the App through monday code's logger. Some log lines include your monday.com account ID, plan identifier, board IDs and counts; logs never include board content, names, email addresses, or phone numbers. Logs are kept according to monday code's log retention.
• Secrets: the App's own credentials (for example, the key used to verify monday.com session tokens) are kept in monday code's encrypted secret store, never in source code.
• If we become aware of a security incident affecting your data, we will notify monday.com within 24 hours and affected customers without undue delay (and within 72 hours where required by law).

4. Third-Party Services and Domains

Apart from monday.com (and the AI model providers monday.com uses for AI review under your agreement with monday.com), the App uses no other third-party services, domains, analytics, or sub-processors. If this changes, we will update this Privacy Policy before the change takes effect.

5. Data Retention

• While installed: scan summaries, decisions, merge records, and events are kept while the App is installed, so your review history persists.
• On uninstall: when you uninstall the App, monday.com notifies us and we permanently delete all data associated with your account (scan summaries, decisions, merge records, events, and plan status), promptly and in all cases within 10 days. The one short-lived exception is the current day's rate-limit counter (your account ID, the date, and a number), which is kept briefly so that uninstalling cannot be used to bypass abuse limits, and is deleted automatically within 2 days.
• Account-free totals: daily totals with no account identifier (for example, installs and uninstalls per day) are kept for up to 400 days to understand overall usage.
• Your boards: uninstalling does not change your boards. Items you merged stay merged, and items the App archived remain in your board's archive under monday.com's policies, where you can restore them.

6. Your Rights

• Access and portability: contact us to request a copy of the data we store for your account in a machine-readable format.
• Deletion: uninstalling the App deletes your data (see Section 5). You may also contact us to request deletion without uninstalling.
• Correction: you can change any review decision in the App at any time.

Because we do not store the contents of your boards, requests about a specific person's data (for example, a contact on your CRM board) are fulfilled in monday.com itself. We store no names, emails, or phone numbers that could be searched. We respond to all data requests within 30 days.

7. International Data Transfers

Our server and database run in monday.com's United States region, so the identifiers described above, and board content read in memory for monday sidekick requests, are processed in the United States. Where the law requires it, such transfers rely on appropriate safeguards, such as Standard Contractual Clauses.

8. Cookies and Tracking

The App does not use cookies, tracking pixels, or advertising technologies, and it does not store anything in your browser's local storage. Usage events are recorded on our own server as described above and contain no board content.

9. Children's Privacy

The App is designed for business users of monday.com and is not directed at children under 13. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us