1. Who controls your data
The controller is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. For any question about this policy or your rights, write to [CONTACT EMAIL].
2. What we collect
Account data — your email address, name if you give it, and authentication records.
Company data you enter — everything you put into Company Brain: revenue, costs, margins, team size, products, customers, competitors, problems and priorities, plus the goals, notes and decisions you record.
Documents you upload — files placed in the Vault, and the text extracted from them so they can be searched.
Usage data — which features you use, when, and technical logs needed to keep the service running and secure.
Payment data — handled by our payment processor. We never see or store your card number.
3. Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the service you signed up for | Performance of a contract |
| Billing and accounting | Contract and legal obligation |
| Keeping the service secure, preventing abuse | Legitimate interest |
| Improving the product from aggregate usage | Legitimate interest |
| Optional analytics cookies | Consent |
| Marketing email, if you opt in | Consent |
Where we rely on legitimate interest, we have weighed it against your rights, and you may object at any time.
4. Artificial intelligence — where your data goes
This is the part most people want to know about, so we state it plainly.
When you use a feature that involves AI — the Advisor, the Boardroom, document search, plan commentary — the relevant parts of your company data are sent to a model provider to generate a response. We route these requests through OpenRouter, which passes them to the model provider selected for that feature (currently providers including OpenAI and Google).
What this means:
- Only the data needed for that request is sent, not your whole account.
- We have configured our provider account so that your content is not used to train models.
- Model providers may retain request data briefly for abuse monitoring, according to their own terms.
- Some providers process data outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses.
If you would rather not have your data reach a model provider, you can simply not use the AI features. The deterministic parts of Boardeon — the Business Score, the financial calculators, the simulator, the valuation — are computed entirely on our own infrastructure and never leave it.
5. Who else processes your data
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | European Union (eu-west-1) |
| Vercel | Application hosting | European Union (primary region), global edge |
| OpenRouter and connected model providers | AI generation | EU and third countries under SCCs |
| Payment processor | Subscriptions and invoicing | As stated by the processor |
| Email provider | Transactional email | As stated by the provider |
6. Where your data lives
Your account and company data are stored in the European Union. Some processing necessarily happens elsewhere, as described above.
7. How long we keep it
We keep your data for as long as your account exists. When you delete your organisation, its records are removed from our live systems immediately. Encrypted backups are retained for up to 30 days before they expire, after which the data is gone.
Invoices and accounting records are kept for as long as tax law requires, regardless of account deletion.
8. How we protect it
Each organisation's data is isolated at the database level: every table enforces row-level security, so one customer's queries cannot reach another customer's rows even if the application had a bug.
Any API keys you supply are encrypted with AES-256-GCM before storage, bound cryptographically to your organisation, and the ciphertext is not readable through the ordinary application interface. Data is encrypted in transit and at rest.
9. Your rights
You may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to another provider. You may object to processing based on legitimate interest, and withdraw any consent you have given — withdrawing consent does not affect processing that already happened.
Write to [CONTACT EMAIL]. We answer within 30 days.
If you think we have handled your data badly, you may complain to your national supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO).
10. Children
Boardeon is a business tool and is not directed at anyone under 18. We do not knowingly collect their data.
11. Automated decisions
We do not make decisions producing legal or similarly significant effects about you by automated means alone. Scores and recommendations produced by Boardeon are information for you to act on, not decisions we take about you.
12. Changes
We will post any change here and, where it materially affects you, notify you before it takes effect. Previous versions remain available on this page.