Privacy Policy

2.1 Personal Information You Provide

Account Information:

• Name and email address during registration
• Company name and business information
• Contact details for billing and support
• Payment information (processed securely by Paddle, our Merchant of Record)

Authentication Information:

• OAuth tokens for Pipedrive and monday.com accounts
• Refresh tokens for maintaining service access
• Account identifiers and API credentials

2.2 Information from Third-Party Platforms

From Pipedrive (with your authorization):

• Basic account information and user details
• Deal records, stages, values, and related data
• Contact/people records and associated information
• User information for proper data attribution
• Search and configuration data
• Webhook notifications for real-time updates

From monday.com (with your authorization):

• User profile information and account details
• Board data, structure, columns, and configuration
• Workspace information and organization structure
• Updates, comments, and communication threads
• Account settings and general information
• Webhook configurations and notifications

2.3 Automatically Collected Information

Usage Data:

• Service usage patterns and feature utilization
• Synchronization logs and performance metrics
• Error logs and diagnostic information
• IP addresses and device information
• Browser type and operating system

Technical Data:

• API call logs and response times
• Integration configuration settings
• Data mapping and sync preferences
• System performance and monitoring data

3.1 Service Provision

• Data Synchronization: Transfer and sync data between your Pipedrive and monday.com accounts
• Real-time Updates: Detect changes and update corresponding platforms automatically
• Field Mapping: Match and map corresponding fields between platforms
• User Attribution: Properly attribute synced data to correct users
• Configuration Storage: Save and apply your custom sync settings

3.2 Service Improvement

• Performance Optimization: Analyze usage patterns to improve service performance
• Feature Development: Understand user needs to develop new features
• Bug Resolution: Identify and fix technical issues and errors
• Security Enhancement: Monitor for security threats and vulnerabilities

3.3 Communication

• Service Notifications: Send important updates about your account or service
• Support Response: Respond to your support requests and inquiries
• Billing Communications: Send invoices, payment confirmations, and billing notices
• Security Alerts: Notify you of security incidents or suspicious activity

3.4 Legal and Compliance

• Legal Obligations: Comply with applicable laws and regulations
• Terms Enforcement: Enforce our Terms and Conditions
• Dispute Resolution: Resolve disputes and investigate violations
• Data Protection: Fulfill data protection and privacy obligations

4.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or business data to third parties for marketing purposes.

4.2 Service Providers

We may share information with trusted service providers who assist us in operating our Service:

• Payment Processing: Paddle, our Merchant of Record, for secure payment processing
• Cloud Infrastructure: AWS for hosting and data storage
• Analytics: Performance monitoring and usage analytics tools
• Support Tools: Customer support and communication platforms

All service providers are contractually bound to protect your information and use it only for specified purposes.

4.3 Legal Requirements

We may disclose your information if required by law or in good faith belief that such action is necessary to:

• Comply with legal obligations or court orders
• Protect and defend our rights or property
• Prevent or investigate fraud or security issues
• Protect the safety of users or the public

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

5.1 Security Measures

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit using TLS/SSL and at rest using AES encryption
• Access Controls: Role-based access controls limit data access to authorized personnel only
• Monitoring: Continuous monitoring for security threats and suspicious activity
• Authentication: Multi-factor authentication and secure authentication protocols
• Regular Audits: Regular security audits and vulnerability assessments

5.2 Third-Party Platform Security

• We rely on Pipedrive and monday.com's security measures for data stored on their platforms
• We use secure OAuth protocols for authentication with third-party services
• We do not store unnecessary copies of your third-party platform data

5.3 Security Incident Response

We maintain comprehensive incident response procedures to address security breaches promptly:

• Incident detection and response procedures are in place
• Users are notified within 72 hours of discovering any security incident that may affect their data
• We take immediate steps to mitigate security breaches and protect your information
• For security concerns, contact us at [email protected]

5.4 Secure Data Deletion Process

We take data deletion seriously and follow industry best practices:

Deletion Security Measures:

• Atomic Transactions: Deletion operations are all-or-nothing to prevent partial data retention
• Audit Logging: Every deletion is logged with timestamps, reason, and data counts (but not personal data)
• Webhook Cleanup: We unregister all integration webhooks with Pipedrive and monday.com before deletion
• Background Job Cancellation: Any pending sync operations are stopped before deletion
• Irreversible Process: Once data is deleted, it cannot be recovered (except during the 90-day grace period)

Audit Log Retention (Permanent Compliance Trail):

• Every deletion event is permanently logged to our audit system
• Audit logs include: Organization ID (anonymized number, not personally identifiable), Deletion date and timestamp, Deletion reason (trial expiration, cancellation, uninstallation, GDPR request), Data counts (number of users, synced items, automation rules deleted)
• Audit logs are NEVER deleted - they provide a permanent compliance trail
• These logs are anonymized and cannot identify you after deletion (GDPR Recital 26)
• Purpose: Legal compliance, regulatory audits, dispute resolution

Email Notifications:

You will receive clear email notifications at key stages:

1. Deletion Choice Email: Choose immediate or 90-day deletion (sent within 24 hours of cancellation)
2. Confirmation Email: Confirms your deletion preference
3. Day 7 Reminder: Reminder that you have 83 days remaining (90-day grace only)
4. Day 85 Final Notice: Final warning 5 days before deletion (90-day grace only)
5. Deletion Complete Email: Confirms your data has been deleted

All email links are secured with time-limited, single-use authentication tokens.

5.5 Automated Data Processing & Deletion (GDPR Article 13 Transparency)

Daily Automated Cleanup:

• We run a daily automated process at 2 AM UTC to manage data deletions and send reminder emails
• This automated system:
  • Identifies trial users whose trial has expired or who uninstalled the app
  • Schedules their data for deletion in 48 hours (no email notification for trial users)
  • Processes scheduled deletions for users whose chosen deletion date has arrived
  • Sends reminder emails to paid users (Day 7 and Day 85 of grace period)
• No human intervention: The entire process is automated for consistency and reliability
• Audit trail: Every deletion is logged to our permanent audit system with timestamps, reason, and data counts
• Purpose: Ensures timely, consistent data deletion in compliance with your choices and GDPR obligations

6.1 Data Retention and Deletion Timelines

Your data retention timeline depends on your subscription type and choices:

Trial Users:

• If you do not convert to a paid subscription, your data will be automatically deleted within 48 hours of your trial ending or app uninstallation
• No email notification is sent (trial users have no paid subscription commitment)
• No user action is required for deletion

Paid Users:

• When you cancel your subscription or uninstall the app, you can choose between two deletion timelines:
  • Immediate Deletion: Your data will be deleted within 48 hours
  • 90-Day Grace Period: Your data will be retained for 90 days, giving you time to reactivate or export your data
• If you do not respond to the deletion choice email within 7 days, we will apply the 90-day grace period by default (giving you maximum time to change your mind)
• You can change your deletion choice within 24 hours of your initial selection

How to Change Your Deletion Preference (24-Hour Window):

• You can cancel an "immediate deletion" choice within 24 hours and switch to the 90-day grace period
• Access the "Change My Mind" link in your deletion confirmation email (link expires after 24 hours)
• After 24 hours, your deletion preference is final and cannot be changed
• This safety feature prevents accidental immediate deletions

Reactivation Option:

• During the 90-day grace period, you can reactivate your subscription at any time
• All your data will be preserved without loss
• After the deletion date passes, reactivation is not possible

6.2 What Happens When You Uninstall the Pipedrive App

Automatic Deletion Trigger:

• When you uninstall the monday connector from your Pipedrive account, we automatically detect this

Trial Users (Uninstallation):

• Your data is automatically scheduled for deletion in 48 hours
• No email notification is sent (trial users have no paid subscription commitment)
• Deletion reason logged as "uninstalled"

Paid Users (Uninstallation):

• Your subscription is automatically canceled
• You receive the deletion choice email within 24 hours
• You can choose between:
  • Immediate deletion (48 hours)
  • 90-day grace period (default if no response within 7 days)
• Your account status changes from "active" to "canceled"

6.3 What Data Is Deleted vs. Retained

When your data is scheduled for deletion, here's exactly what we delete and what we retain:

Data We Delete Permanently:

• User Accounts: All user profiles, names, email addresses, and roles
• Synced Items: All deals, contacts, organizations, and other data synced between Pipedrive and monday.com
• Automation Rules: Your custom automation configurations and field mappings
• Webhooks: Integration connections with Pipedrive and monday.com
• Settings: Your company name, domain, and application preferences

Data We Anonymize (Not Deleted):

• Organization Record: We retain an anonymous organization ID (just a number, no identifiable information)
• Subscription Metadata: Plan name, billing dates, and payment amounts (anonymized, cannot be linked to you)

Why We Retain Some Data (GDPR Article 17(3)(b)):

Tax laws (IRS in the US, HMRC in the UK) require us to retain financial transaction records for 7 years for accounting and tax audit purposes. However, this data is completely anonymized — it cannot be used to identify you or your company.

Under GDPR Recital 26, anonymized data is not considered "personal data" because it does not relate to an identifiable natural person.

Permanent Deletion After 7 Years:

After 7 years, even these anonymized financial records are permanently deleted from our systems.

Other Retention Periods:

• Sync Logs: Retained for 90 days for troubleshooting and performance monitoring
• Support Communications: Retained for 3 years for quality assurance and training

7.1 Access and Control

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal requirements)
• Portability: Request transfer of your data in a structured, machine-readable format
• Objection: Object to certain processing of your personal information

7.2 Communication Preferences

• You can opt out of non-essential communications
• You cannot opt out of service-related or security communications
• You can update your communication preferences in your account settings

7.3 Data Export (GDPR Article 20 - Right to Data Portability)

Export Methods:

1. Via Email Link: Click "Export My Data" in any deletion lifecycle email
2. Via Account Settings: Access the data export feature in your account dashboard

Export Contents:

Your export includes all personal and business data in machine-readable format:

• Organization details (company name, domain, configuration)
• All user accounts (names, emails, roles)
• Synced items (Pipedrive deals, contacts, organizations synced to monday.com)
• Automation rules (trigger events, conditions, actions)
• Field mappings and configurations
• Webhook registrations

Export Specifications:

• Format: JSON (JavaScript Object Notation) - machine-readable and portable
• Generation Time: Typically completes in seconds for standard accounts
• Availability: Exports available anytime before your deletion date

Using Your Export:

• Import to other SaaS platforms that accept JSON format
• Archive for your records
• Analyze your historical sync data
• Migrate to alternative integration tools

8.1 Cookies We Use

• Essential Cookies: Required for basic service functionality and security
• Analytics Cookies: Help us understand service usage and performance
• Preference Cookies: Remember your settings and preferences

8.2 Managing Cookies

• You can control cookies through your browser settings
• Disabling essential cookies may affect service functionality
• We do not use cookies for advertising or marketing purposes

9.1 Data Location

• Primary data processing occurs in secure AWS regions
• Data may be transferred to other countries for processing by service providers
• All transfers comply with applicable data protection laws

9.2 Transfer Safeguards

• We implement appropriate safeguards for international data transfers
• Service providers are contractually bound to protect your information
• We comply with GDPR, CCPA, and other applicable privacy regulations

11.1 European Union (GDPR)

If you are in the EU, you have additional rights under GDPR:

• Lawful Basis: We process your data based on contract performance and legitimate interests
• Data Protection Officer: Contact [email protected] for data protection inquiries
• Supervisory Authority: You may lodge complaints with your local data protection authority
• Right to Restriction: You may request restriction of processing in certain circumstances

11.2 California (CCPA)

If you are a California resident, you have rights under CCPA:

• Right to Know: Categories and specific pieces of information we collect
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: We do not sell personal information, so no opt-out is required
• Non-Discrimination: We will not discriminate for exercising your rights

11.3 Other Jurisdictions

We comply with applicable privacy laws in all jurisdictions where we operate. If you have questions about your rights in your jurisdiction, please contact us.

12.1 Policy Updates

• We may update this Privacy Policy from time to time
• Material changes will be communicated via email or service notification
• Continued use after changes constitutes acceptance of the updated policy
• We will provide at least 30 days' notice for material changes

12.2 Version History

• Previous versions of this Privacy Policy are available upon request
• We maintain records of all policy changes and effective dates

For Data Deletion, Export, or GDPR Requests:

• Email: [email protected]
• Subject Line: "GDPR Deletion Request" or "Data Export Request"
• Response Time: Within 30 days (GDPR Article 12 requirement)

For Privacy Policy Questions:

• Email: [email protected]
• Response Time: Within 7 business days

For Technical Support:

• Email: [email protected]
• Response Time: Within 24-48 hours

Company Information:

• Company: Onespace Tech
• Location: Christophstr. 24, 73734 Esslingen am Neckar, Germany

Data Protection Inquiries: [email protected]
Security Concerns: [email protected]