Google Forms Sync

Privacy policy

Last updated 8 November 2026

This policy explains how Augmentum Studios Ltd (“Augmentum”, “we”, “us”) processes personal data for Google Forms Sync, a monday.com app, and for this website at augmentumapps.com. Contact support@augmentumapps.com. Our postal address is International House, 101 King’s Cross Road, London, United Kingdom, WC1X 9LP.

1. Who decides the purpose

We are the controller for the installing monday admin’s contact details, for account and billing-status records, and for messages you send to support.

The monday account that installs the app decides why form responses are collected and where they should go. We process those responses, and any files the account chooses to copy, only to carry out that sync. We do not keep the answers or the file bytes. Once an item is written, it is content in the customer’s monday.com account. monday.com’s own privacy policy covers monday’s processing, and Google’s privacy policy covers a respondent’s use of Google Forms.

2. Google user data

A person connecting Google from the board view grants these scopes. An account connected before a scope was added has to connect again before that scope can be used.

Google Forms Sync’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data to provide the sync the user configured in the board view. We do not sell it. We do not use it for advertising, creditworthiness, or to train generalised models. We do not transfer it except to write the mapped values or files into the customer’s own monday.com board, to comply with law, or as part of a merger after notice. Humans do not browse stored form answers: the answers are not stored. Operational logs are written with identifiers and error codes, and fields whose names indicate tokens, secrets, answers, or authorisation codes are redacted.

3. monday permissions

The app requests boards:read, boards:write, and me:read. The first save on a board asks the user to approve that access. boards:read loads the board structure so columns and groups can be chosen. boards:write creates the items or subitems the sync is set up to create.

me:read reads the signed-in installing admin’s own email when that person opens the board view. If the address differs from the one we stored, we replace the encrypted email and its lookup hash. Name, country, and any other person’s address are left as they were. me:read is not used to read other users’ profiles. An account connected before this scope was added must connect monday again.

4. What we store

Production data for the app is stored in a Firestore database in the European Union (Google Cloud region europe-west1). The app runs on monday code in the EU. The record can include:

• Account plan, usage counters, and install status.
• The installing admin’s monday user id, and the account name and slug. Name, email, and country from the signed install webhook are encrypted with AES-256-GCM before they are written. The key is held in monday Secrets, not in the database. A separate HMAC of the normalised email is stored so the account can be found from that address. The account name and slug stay readable.
• Google and monday OAuth refresh tokens, encrypted with AES-256-GCM before they are written, using a separate token key in monday Secrets. Access tokens are kept in memory only. monday refresh tokens rotate on each refresh, and the previous value is replaced only when it is still the one that was used.
• The connected Google account email, encrypted with the same personal-data key, plus an HMAC of that address. The Google subject identifier stays readable because it identifies the connection. The board view decrypts the email to show which account is connected.
• Board sync settings: board, form, group, column mapping, cursor, and status. Google Forms watch identifiers. Synced-response documents store the response id, the monday item ids, and Drive file ids already copied into a Files column, so a retry does not upload them again. They do not store answers or form titles.
• A per-account file-sync lock that stores waiting job ids only while a copy is running. Those jobs carry account, user, plan, sync, form, response, board, and item ids. They do not carry answers or file bytes.

5. What we do not store

Form answers and respondent data are not written to the database, not put in queue messages, and not written to application logs. They stay in process memory only while the item is created or a file is streamed. Google’s notification to the app carries form and watch identifiers. The app then fetches responses newer than the saved cursor and writes the mapped values to the board.

6. File copies

A Files-column mapping is available on the Growth plan and above. The app downloads each selected file from the connected Google account with drive.readonly and streams it to monday. Bytes are not stored. A response copies at most 5 files, 10 MB each, and 50 MB in total. Larger files are skipped. The same question mapped to a text, long text, or link column stores a Drive link and does not download the file.

7. Emails about usage

At 75% and at 100% of a usage window, the installing admin receives one transactional email per threshold. If that address is missing, the Google account that connected the board receives it instead. The message contains the usage count, the limit, a short explanation, the account slug, and the app id. It does not contain form answers. The send does not add the recipient to a marketing audience. We use Loops for these messages only.

8. Subprocessors

We use the providers below to run the app. This marketing site is separate: Firebase Hosting serves these public pages and does not receive form responses, tokens, or board data. Hosting logs can include the IP address and user agent of a visitor to this website.

Their privacy notices are Google Cloud, Google, monday.com, and Loops. Where a provider processes personal data outside the UK, we rely on the UK International Data Transfer Agreement or the Standard Contractual Clauses, together with any required UK addendum.

9. Retention

• Form answers and file bytes: not retained.
• Pub/Sub notification identifiers: no more than seven days.
• Sync settings, encrypted tokens, encrypted contact details, watch ids, and synced-response ids: kept while the monday account has the app installed. Disabling a sync keeps its mapping. The Google watch is removed when no enabled sync still uses that form. Turning the sync back on creates the watch again and continues from the current time.
• A Google watch that could not be deleted expires within seven days. A watch still needed by another account stores only the form id and the watch id.
• Support messages: kept for as long as we need them to handle the request and to keep a record of what was agreed, then deleted. We do not use them for marketing.

10. Deletion

Uninstalling the app pauses that account’s syncs, deletes a Google watch when no enabled sync still uses the form, revokes and deletes stored refresh tokens, and deletes the account’s Google connections, board syncs, synced-response ids, file-sync lock, and account document, including the installer’s contact details. A later install creates a new account and has to connect Google and monday again.

An erasure request to support@augmentumapps.com runs the same deletion. Include the monday account id or slug. See the support page for what to send. Items already created on the monday board are the customer’s board content. We cannot erase an answer from our systems when we did not keep one. The customer deletes those items in monday.

11. Security

Refresh tokens and the installer name, email, and country are encrypted with AES-256-GCM before storage. Access tokens stay in memory. Board-view requests carry a monday session token, checked with the app’s client secret. Lifecycle calls and OAuth state are signed tokens. Pub/Sub push uses Google OIDC and a fixed audience. Logs are structured so that token, secret, answer, and authorisation fields are redacted.

12. Incident response

Report a vulnerability or suspected breach to support@augmentumapps.com with the subject “Security”. We acknowledge the report, investigate, and contain the issue. Where UK GDPR requires it, we notify the ICO within 72 hours of becoming aware of a notifiable breach, and we notify affected accounts when the breach is likely to result in a high risk to them. The same contact is on the support page.

13. Your rights

If you are in the UK or the EEA you can ask for access, correction, erasure, restriction, or a copy of personal data we control, and you can object to processing based on legitimate interests. Email support@augmentumapps.com. You can also complain to the Information Commissioner’s Office. A person whose form response was written to a monday board should contact the organisation that owns that board. That organisation decides the items, and we do not keep the answers.

14. Children

Google Forms Sync is a business app for monday.com accounts. It is not directed at children, and we do not knowingly collect personal data from children.

15. Changes

We will post changes on this page and update the date above. If a change materially affects how we use account data, we will also email the installing admin where we still hold an address.

16. Contact