Privacy Policy

DedupeIQ: Merge Duplicates for monday.com

Effective date: September 24, 2026

This Privacy Policy explains how Alpenglow Software LLC ("we," "us," "our"), operator of DedupeIQ ("the App"), collects, uses, stores, and protects information when you install and use the App through the monday.com platform. DedupeIQ finds duplicate and near-duplicate items on your monday.com boards, lets you review each match, and, only when you choose to, merges a confirmed pair by filling in the item you keep and archiving the other.

The short version: matching runs in your browser. The item names and column values on your boards (names, emails, phone numbers, companies, and any other column) are read and compared on your device and are never sent to or stored on our servers. Our servers store only IDs, counts, match scores, your review decisions, merge records (IDs only), and your plan status.

1. Information We Collect

Permissions (monday.com OAuth scopes)

• boards:read: used to read the columns and items of the boards you choose to scan, so duplicates can be detected. This reading happens in your browser.
• boards:write: used only when you explicitly merge a confirmed pair (or keep one of two records across boards). The App writes the values you chose to the item you keep and archives the other item. Scanning and reviewing never write to your boards.

Data processed in your browser only (never sent to us)

• Item names and column values of the boards you scan, including names, email addresses, phone numbers, company names, and the other columns shown when you compare or merge two items.
• Match explanations (for example, "nickname: Bob and Robert"). These are generated and shown only in your browser and are never sent to us.

Data we store (on monday.com's infrastructure)

• Scan summaries: your monday.com account ID, the board ID(s) scanned, the number of items read, the total items on the boards, whether the scan reached your plan's record limit, match counts (overall and per board or board pair), and which column IDs were used for name, email, phone, and company.
• Review decisions: for each pair you confirm or dismiss, the two item IDs, the decision, the match band and confidence score, and the time. Undoing a decision deletes it.
• Merge records: for each merge you perform, the item IDs involved (and, for a cross-board merge, the board of the archived item), the IDs of columns filled, chosen, or skipped, the match band, whether it was a bulk or cross-board merge, the time, and whether the archive step succeeded. No column values are recorded.
• Usage events: product events such as "scan run" or "upgrade prompt shown," with IDs and counts only.
• Plan and subscription status: your current DedupeIQ plan, trial status, and related dates, as reported by monday.com's billing system. Plan limits (for example, scans this month or merges used in a trial) are calculated from your scan and merge records.
• Rate-limit counters: a per-account daily count of database writes, used to protect the service from abuse.
• Install and plan history: the date you installed the App and your plan-change history.
• Welcome status: whether your account has seen the App's welcome page.

Data we do NOT collect

• Item names or column values from your boards (no names, emails, phone numbers, companies, notes, files, or updates)
• monday.com user IDs, user names, or email addresses (records written before September 24, 2026 may contain a numeric monday.com user ID; these are deleted with the rest of your data on uninstall)
• Payment card or banking information (billing is handled entirely by monday.com)
• Tracking, advertising, or web-analytics data

We do not use artificial intelligence or machine learning to process your data, and your data is not used to train AI or machine-learning models. Matching is performed by deterministic statistical comparison running in your browser.

2. How We Use Your Information

• Resume and remember: scan summaries and decisions let you reopen a board where you left off, and keep dismissed pairs dismissed when you scan again.
• Merging at your direction: merge records provide an audit trail of merges you performed.
• Plans and limits: plan status and counters let us apply the features and limits of your plan.
• Improving the App: aggregate usage events (counts, not content) help us understand which features are used.
• Support and operations: we review per-account usage metrics (for example, scan and merge counts, plan, and install date; never board content) to operate the App, provide support, and prevent abuse. After you uninstall, we keep only account-free daily totals (for example, the number of installs per day).

We do not sell your data, and we do not use it for advertising, marketing, or profiling. DedupeIQ never merges or changes anything automatically: every merge is started by a member of your team.

For the purposes of applicable data protection laws, you are the data controller for your board data. Alpenglow Software LLC acts as a data processor for the limited identifiers described above, processing them solely on your behalf and as described in this policy. For aggregate product usage data and for information you send us directly (such as support emails), we act as an independent controller.

3. Data Storage and Security

• The App runs entirely on monday.com infrastructure: the interface is served from monday.com's app hosting, and our server and database run on monday code, monday.com's hosting platform, in the United States region.
• All connections use HTTPS/TLS encryption in transit.
• Every request that reads or writes your data is authenticated with a monday.com-signed session token, and all stored data is scoped to your monday.com account.
• We do not store monday.com access tokens. Each request carries a short-lived session token that we verify and do not keep. Board reads and merges run in your browser using your own monday.com session.
• Logging: our server logs technical events needed to operate the App through monday code's logger. Some log lines include your monday.com account ID and plan identifier; logs never include board content, names, email addresses, or phone numbers. Logs are kept according to monday code's log retention.
• Secrets: the App's own credentials (for example, the key used to verify monday.com session tokens) are kept in monday code's encrypted secret store, never in source code.
• If we become aware of a security incident affecting your data, we will notify monday.com within 24 hours and affected customers without undue delay (and within 72 hours where required by law).

4. Third-Party Services and Domains

The App uses no other third-party services, domains, analytics, or sub-processors. If this changes, we will update this Privacy Policy before the change takes effect.

5. Data Retention

• While installed: scan summaries, decisions, merge records, and events are kept while the App is installed, so your review history persists.
• On uninstall: when you uninstall the App, monday.com notifies us and we permanently delete all data associated with your account (scan summaries, decisions, merge records, events, and plan status), promptly and in all cases within 10 days. The one short-lived exception is the current day's rate-limit counter (your account ID, the date, and a number), which is kept briefly so that uninstalling cannot be used to bypass abuse limits, and is deleted automatically within 2 days.
• Account-free totals: daily totals with no account identifier (for example, installs and uninstalls per day) are kept for up to 400 days to understand overall usage.
• Your boards: uninstalling does not change your boards. Items you merged stay merged, and items the App archived remain in your board's archive under monday.com's policies, where you can restore them.

6. Your Rights

• Access and portability: contact us to request a copy of the data we store for your account in a machine-readable format.
• Deletion: uninstalling the App deletes your data (see Section 5). You may also contact us to request deletion without uninstalling.
• Correction: you can change any review decision in the App at any time.

Because we do not store the contents of your boards, requests about a specific person's data (for example, a contact on your CRM board) are fulfilled in monday.com itself. We store no names, emails, or phone numbers that could be searched. We respond to all data requests within 30 days.

7. International Data Transfers

Our server and database run in monday.com's United States region, so the identifiers described above are processed in the United States. Where the law requires it, such transfers rely on appropriate safeguards, such as Standard Contractual Clauses.

8. Cookies and Tracking

The App does not use cookies, tracking pixels, or advertising technologies, and it does not store anything in your browser's local storage. Usage events are recorded on our own server as described above and contain no board content.

9. Children's Privacy

The App is designed for business users of monday.com and is not directed at children under 13. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us