Privacy Policy
‍
gilpen studio (“gilpen studio”, “we”, “our”) is committed to maintaining the privacy and security of its users (“you”, “user”) and the data they entrust to us when using our App. The following information describes how gilpen studio collects and processes information about you and, crucially, the data from your monday.com account when you use our App available on the monday.com marketplace.
‍
Our Privacy Policy explains:
‍
- What information we collect and why we collect it.
- How we use that information.
- How we secure your information and the data you process through our App.
- Your rights with regard to the collection and processing of such information.
‍

1. General
‍gilpen studio provides an App for monday.com customers accessible via the monday.com marketplace. The App enables users to create, generate, and deploy no-code machine learning (ML) predictive models directly within their monday.com account/boards, utilizing data residing in their monday.com account (“App Service”). We also operate a website at www.gilpenstudio.com and/or autobrain.gilpenstudio.com (“Website”) primarily for marketing purposes.

By installing and using the App and/or using our Website, you consent to the collection, transfer, processing, storage, disclosure, and other uses described in this Privacy Policy.

‍
2. Device
‍
Users can access the App via their monday.com account and the Website through various Devices. A “Device” is any digital device used to access the App or Website, including without limitation a desktop, laptop, mobile phone, tablet, or other consumer electronic device. This Privacy Policy governs your access and use of the App and Website, regardless of how you access them.


3. Collecting Information
‍
‍When you use the App and Website, some information may be automatically collected, and some is collected when you interact with our App or Website. We distinguish between information we collect directly about you (Personal Information) and the data we access and process from your monday.com account (Customer Data).


3.1 Personal Information
‍
‍Personal Information is information from which you can be personally identified, collected when you interact directly with gilpen studio (e.g., via our Website or potentially during App setup if we require direct contact information). This may include, but is not limited to, your name, email address, company name, job title, and any information you provide when contacting us.

Any Personal Information you provide is made at your free will and consent (where required under applicable data protection legislation). You acknowledge that you are not under any statutory obligation to provide Personal Information to gilpen studio. However, if you do not provide us with certain Personal Information, we may not be able to fulfill certain purposes, such as providing support or information.

We may collect Personal Information via the methods detailed below:
- Website Contact Forms: If you contact us for various reasons via our Website, such as requesting information or support, we will collect your full name, email address, company name, job title, phone number (optional), and the information related to your inquiry.
- Newsletter Subscription: If you register for our newsletter via the Website, we will collect your email address to send you updates and promotional materials.
- Direct Communications: Information you provide when you communicate with us directly via email (e.g., to support@gilpenstudio.com) or other channels.
We do not collect billing information directly; this is handled by monday.com.


3.2 Customer Data (monday.com Data)
‍
‍The core function of our App involves accessing and processing data residing within your monday.com account and boards (“Customer Data”). This data is owned and controlled by you, the monday.com customer.

When you install the App on a monday.com board and configure it for use, you grant the App permission to access data on that board, as per the permissions granted during the monday.com installation process. Crucially, we access and process only the data in the specific boards where the App is installed and only from the columns you instruct the App to use for building your ML models.

We access and process Customer Data solely for the purpose of providing the App Service as instructed by you. This includes:
- Reading data from your selected monday.com boards and specific columns to gather the necessary information for training and building your ML models.
- Using this data to generate predictions or insights via the ML models.
- Potentially writing data back to monday.com (e.g., predictions in a specific column) if you configure the App to do so.

We store copies of your Customer Data on Google Cloud infrastructure for the purpose of generating and operating the ML models you configure. We retain this data only as necessary to provide the ongoing App Service to you, subject to our data retention policy (see Section 12).

We do not access or process Customer Data for any purpose other than providing, maintaining, and improving the App Service for your benefit, or as required by law.
‍

3.3 Non-Personal Information
‍
‍The type of information that may be automatically collected when you use the App or Website is non-personal information. This includes technical information about your usage (e.g., frequency of App use, features used), session durations, information about your Device and internet connection, browser type, and the frequency and scope of your use of the App and Website. This information is aggregated and anonymized where possible and is used to understand usage patterns and improve the App Service and Website.
‍

4. Use of Information
‍
‍We use the information we collect from you for a range of different business purposes according to different legal bases of processing. One or more purposes may apply simultaneously.
‍

4.1 Processing Customer Data (as Data Processor)
‍
‍Our primary use of Customer Data is to provide the core App Service:
- To train, build, and deploy the no-code ML predictive models based on your chosen data from your monday.com boards.
- To provide the results, predictions, or insights generated by the ML models within the App interface or potentially write them back to your monday.com board as configured.
- To maintain, operate, and troubleshoot the App Service for your specific use case.
‍
We process this Customer Data strictly on your behalf and according to your instructions as the Data Controller, as necessary for the performance of the contract (our Terms of Service) with you.
‍
‍
4.2 Using Personal Information (as Data Controller)
‍
We use the Personal Information collected directly from you for the following purposes:
- To provide support via support@gilpenstudio.com, respond to inquiries, and troubleshoot issues related to the App Service or Website.
- To manage your account interactions with gilpen studio (if applicable, separate from your monday.com account).
- To send you technical notices, updates, security alerts, and administrative messages regarding the App Service.
- To send you newsletters, marketing, or promotional materials via email, where you have consented or where we have a legitimate interest and it is permitted by law (you can opt-out anytime).
- To improve and develop our App Service and Website based on usage patterns and feedback (using aggregated and anonymized data where possible).
- To maintain a safe and secure environment, detect and prevent fraud, abuse, and security incidents related to our services.
- To comply with legal obligations.

We process Personal Information where it is necessary for the adequate performance of a contract with you (e.g., providing support), for our legitimate business interests (e.g., improving services, marketing, security), or based on your consent (e.g., for newsletters).
‍
‍
5. Roles and Responsibilities (Data Controller vs. Data Processor)
‍
Certain data protection laws and regulations, such as the EU General Data Protection Regulation 2016/679 (“GDPR”), the California Consumer Privacy Act of 2018, including as modified by the California Privacy Rights Act of 2020 (“CCPA”), and the Israeli Protection of Privacy Law, 5741 – 1981 (“PPL”), typically distinguish between two main roles for parties processing Personal Information: the “Data Controller” (or under the CCPA, “Business”), who determines the purposes and means of processing; and the “Data Processor” (or under the CCPA, “Service Provider”), who processes the data on behalf of the Data Controller

Understanding these roles is crucial when using our App:
- You, the monday.com Customer: For the Customer Data residing in your monday.com account/boards that you use with our App, you are the Data Controller. You determine what data is collected in monday.com and the purposes for which it is used, including selecting which specific boards and columns are processed by our App for ML model creation.
- gilpen studio: For the Customer Data accessed and processed via the App Service (from your selected monday.com boards/columns), gilpen studio is the Data Processor, acting on your behalf and under your instructions to provide the ML model creation and deployment service.
- For the Personal Information collected directly from you for account management, support, communication, or website usage (as described in Section 3.1), gilpen studio is the Data Controller.
‍‍
Our service providers who process data on our behalf are our "Sub-processors". When processing Customer Data on your behalf, our key Sub-processors include Google Cloud (for data storage and processing infrastructure) and Supabase (if used for specific backend services related to processing Customer Data). These Sub-processors act as sub-processors to us (gilpen studio), and indirectly, as sub-processors to you (the Data Controller).
‍
‍
6. Disclosure of Information and Transfer of Data
‍
‍Except as otherwise provided in this Privacy Policy, we reasonably attempt to ensure that we never intentionally disclose any of your Personal Information to any third party without having received your permission, except as provided for herein or otherwise as permitted or required under law.

- For Personal Information (where gilpen studio is Data Controller): We may share your Personal Information with our affiliates, subsidiaries, or third-party service providers who perform services on our behalf, such as hosting, data analysis, customer support, email delivery, and marketing.

- For Customer Data (where gilpen studio is Data Processor): We will not disclose Customer Data to third parties except:
-- As instructed by you, the Data Controller.
-- To our necessary Sub-processors, specifically Google Cloud and Supabase, who are essential for providing the App Service (e.g., data storage, processing infrastructure). We ensure such Sub-processors are bound by data processing terms that offer a similar level of protection as our agreement with you.
-- If required by law or a valid legal process, provided we attempt to notify you unless prohibited by law.

- General Disclosures (apply to both Personal Information and, where permitted/required, Customer Data):
-- Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
-- Protection of Rights: We may disclose information to enforce our agreements, terms, and policies, or to protect the rights, property, or safety of gilpen studio, our customers, or others.
-- Business Transfers: We may transfer your information, including Personal Information and potentially Customer Data (subject to contractual obligations with you), in connection with a merger, sale of assets, financing, or acquisition of all or a portion of our business by another company.
-- Aggregated/Anonymized Data: We may share aggregated or anonymized information derived from the App's usage (which cannot be used to identify you or your specific Customer Data) with third parties for research, marketing, analytics, and other business purposes.
‍

‍7. Your Rights
‍
‍You have rights regarding your Personal Information and, indirectly, regarding your Customer Data.
- Regarding Personal Information (where gilpen studio is Data Controller): You have the right to request access to, modification of, or deletion of your Personal Information that we hold (e.g., contact details provided via the website). To exercise these rights, please contact us at: support@gilpenstudio.com.
- Regarding Customer Data (where gilpen studio is Data Processor): As the Data Controller of your Customer Data, you have ultimate control over it through your monday.com account. Any requests regarding the rights of individuals whose data is contained within your Customer Data (e.g., access, rectification, erasure requests from individuals reflected in your monday.com boards) should primarily be directed to you as the Data Controller. We will assist you in responding to such requests to the extent necessary and feasible, in accordance with our agreement with you.

In some jurisdictions, in particular those located within the European Union (the “EU”) or within the European Economic Area (the “EEA”) or if the Privacy Protection Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 5783-2023 apply to you, you may be afforded specific rights regarding your Personal Information. Subject to such eligibility, you may have the following rights to:
- Request a rectification of your Personal Information where the information we hold about you is incorrect or incomplete.
- Object to the processing of your Personal Information for direct marketing purposes.
- Object to the processing of your Personal Information where our legal basis for that processing is that such processing is necessary for our legitimate interests.
- Object to automated decision-making (including profiling) in certain circumstances (note: this applies to our processing of your Personal Information, not necessarily your use of our ML models on your Customer Data, where you are the controller).
- Request the erasure of your Personal Information in certain circumstances, such as where processing is no longer necessary for the purpose it was originally collected for, and there is no compelling reason for us to continue to process or store it.
- Receive your Personal Information, or ask us to transfer it to another organization that you have provided to us, which we process by automated means, where our processing is either based on your consent or is necessary for the performance of a contract with you.

If you wish to file a request regarding any of the above rights concerning your Personal Information processed by gilpen studio as Controller, you may contact us at support@gilpenstudio.com.

If your request pertains to Customer Data where you are the Data Controller, please handle the request directly or contact us for assistance as per our agreement.
‍

‍8. Notice to California Residents
‍
‍This section is designated for California residents and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“California Privacy Laws”). It explains your privacy rights, provides “notice at collection”, and provides certain mandated disclosures about how we handle your Personal Information. This section uses certain terms that have the meanings given to them by the California Privacy Laws, unless otherwise specified. Please note that some of the disclosure obligations required under the California Privacy Laws are satisfied within other sections of this Privacy Policy.

The California Privacy Laws permit some users to request to exercise certain rights. If these rights are applicable to you (regarding Personal Information where gilpen studio is the Business), you are afforded with the following rights:
- Right of access: You can request gilpen studio for certain information about our practices with respect to your Personal Information. In particular, you can request to receive information on the following:
-- The categories and specific pieces of your Personal Information that we have collected.
-- The categories of sources from which we collected your Personal Information.
-- The business or commercial purposes for which we collected or share your Personal Information.
-- The categories of third parties with which we shared your Personal Information.
- Right to Opt Out of Sale/Sharing: We do not sell your Personal Information. We do not "share" your Personal Information for cross-context behavioral advertising¹ purposes.
- Right to Limit Use and Disclosure of Sensitive Personal Information: We do not collect Sensitive Personal Information triggering this right.
- Right to Deletion: You have the right to request the deletion of your Personal Information we have collected, subject to certain exceptions.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your California Privacy Law rights.

‍Exercising your California Law Rights: To exercise your rights regarding Personal Information where gilpen studio is the Business, please contact us at support@gilpenstudio.com. We will need to verify your identity before processing your request.

If your request pertains to Customer Data where you are the Data Controller (gilpen studio acts as Service Provider), please handle the request directly or contact us for assistance as per our agreement.
‍

‍9. CAN SPAM Act
‍
‍The CAN-SPAM Act is a Federal US law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right² to have emails stopped from being sent to them, and spells out tough penalties for violations. We collect your email address³ (e.g., via website forms or direct contact) in order to: Send information, respond to inquiries, and/or other requests or questions; Market to our mailing list or continue to send emails to our clients after the original transaction has occurred⁴ (where consent is obtained or applicable).

To be in accordance with CAN-SPAM, we agree to the following: Not use false or misleading subjects or email addresses; Identify the message as an advertisement⁵ in some reasonable way; Include the physical address of our business or site headquarters; Monitor third-party email marketing services for compliance, if one is used; Honor opt-out/unsubscribe requests quickly; Allow users to unsubscribe by using the link at the bottom of each marketing email or by contacting support@gilpenstudio.com.
‍

‍10. Cookies
‍
‍We may use “cookies” and/or other technologies or files (collectively, “cookies”) to identify how users make use of our Website. This aggregated tracking information may be used to help us improve and enhance the Website experience. In addition, cookies may be used for adjusting the Website to your personal preferences. Cookies contain information such as the pages you visited, the length of time you stayed, and more.

If you would prefer not to have cookies stored on your Device, you may modify your browser settings to reject most cookies, or manually remove cookies that have been placed on your Device. However, by rejecting cookies, you may be unable to fully access certain features of our Website.

To find out more about cookies, visit www.allaboutcookies.org.

Further, we may partner with third-party services (e.g., web analytics providers) to capture how you use and interact with our Website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage⁷ data may be captured using first and third-party cookies and other tracking technologies. This helps us understand website traffic, page popularity, and online activity for site optimization and potentially for fraud/security purposes. For more information about how these third parties collect and use your data, please refer to their respective privacy policies.

‍(Note: The App interface within monday.com may operate differently regarding cookies, primarily governed by monday.com's environment).
‍

‍11. Opt In or Opt Out
‍
‍You are always in control of your Personal Information provided directly to us. If you choose to receive marketing information from us (e.g., newsletters), you can change your mind later. If, at any time, you would like to stop receiving marketing communications from us, you can unsubscribe by following the instructions in the communication or by contacting us at support@gilpenstudio.com.

Note that you cannot opt-out of receiving essential service-related communications regarding the App Service or administrative messages if you are an active user.

Regarding Customer Data, your control is managed primarily through your monday.com account permissions (installing/uninstalling the App on specific boards) and the configuration choices you make within the App (selecting columns). Uninstalling the App will cease our processing of new Customer Data from that board.
‍

‍12. Data Security
‍
‍We deploy industry standard, or better, measures to ensure the security, confidentiality, integrity, and availability of the information we process, including both Personal Information and Customer Data. We leverage the security infrastructure of our sub-processors like Google Cloud and Supabase, and maintain physical, technical, and administrative safeguards, testing and updating these periodically. We endeavor to restrict access to information on a ‘need to know’ basis for the provision of the App Service and Website.

In the event of a security breach affecting your information, we will take all reasonable action to minimize any harm, including providing notifications as required by applicable law and our agreements.

While we strive to protect your information using robust measures, no method of transmission over the internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute⁸ security.
‍

‍13. Data Retention
‍
‍We retain Personal Information (e.g., contact details from website inquiries) for as long as necessary to fulfill the purposes for which it was collected, provide our services, comply with our legal obligations, resolve disputes, and enforce our agreements.

We retain Customer Data processed via the App Service (stored on Google Cloud) only for as long as necessary to provide the App Service to you. This includes storing data required for the creation, ongoing deployment, potential retraining, or performance monitoring of the ML models as configured by you. When you uninstall the App from a board, we will cease processing new data from that board and will delete or anonymize the associated Customer Data stored on our sub-processor systems (Google Cloud) within a reasonable timeframe, unless retention is required by law or for legitimate business purposes directly related to our agreement with you (e.g., audit trails for security or billing reconciliation).

If you terminate your subscription or agreement with gilpen studio entirely, we will delete or anonymize all Personal Information and Customer Data associated with your account from our systems and those of our sub-processors within a reasonable timeframe, subject to legal or contractual retention requirements.
‍

‍14. Children’s Privacy
‍
‍Our Services are not intended for children under the age of 16. We do not, knowingly or intentionally, collect information about children who are under 16 years of age.

IF YOU ARE UNDER THE AGE OF 16 YOU MAY NOT USE THE APP OR WEBSITE, UNLESS PARENTAL CONSENT IS PROVIDED ACCORDINGLY.
‍

‍15. Questions Regarding Our Privacy Policy
‍
‍If you have any questions regarding this Privacy Policy or the practices described above, you are always welcome to contact us at: support@gilpenstudio.com
‍

‍16. Revisions and Modifications to our Privacy Policy
‍
‍We reserve the right to revise, amend, or modify this Privacy Policy at any time. When changing the policy, we will update this posting accordingly and revise the "Last Updated" date below. Please review this Privacy Policy often so that you will remain updated regarding our current policies. We may provide notice of significant changes through the App interface, via email, or on our Website.
‍

‍17. Governing Law and Jurisdiction
‍
‍This Privacy Policy will be governed and interpreted pursuant to the laws of the State of Israel without giving effect to its choice of law rules. You expressly agree that the exclusive jurisdiction for any claim or action arising out of or relating to this Privacy Policy shall be to the competent courts in Tel Aviv, Israel, to the exclusion of any other jurisdiction.

‍

‍Last Updated: April 21, 2025