Privacy policy

https://privacyboard.io/

Privacy contact

hello@privacyboard.io

Person in charge of personal data

Antoine Milkoff

Customer accounts and service delivery

Purpose

Create and manage customer accounts and deliver the service the customer asked for

Data

Names, email addresses, account identifiers, usage data

People

Customers and their users

Legal basis

Performance of a contract

Retention

For the duration of the contract, then deleted or archived after 12 months

Service providers

Vercel, Supabase, Resend, Cloudflare

Your rights

you can ask us whether we process your personal data and receive the information the FADP requires, ask for the correction of inaccurate data, receive your data in a common electronic format or have it transferred to another controller, and object to processing or ask for its deletion. Where we take a decision based solely on automated processing that has legal effects on you or affects you significantly, we tell you, and you can give your point of view and ask for a person to review it.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 30 days, which we may extend when we tell you why. You can contact the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

Transfers abroad

some of our providers process data outside Switzerland and the European Economic Area (GitHub, US; Lemon Squeezy, US; Anthropic, United States; Cloudflare, Worldwide). We transfer data abroad only to countries the Federal Council recognizes as providing adequate protection or with the safeguards the FADP requires, such as standard contractual clauses recognized by the FDPIC or the provider’s certification under the Swiss-US Data Privacy Framework.

Consent

we collect, use and disclose personal information with your consent, express or, where appropriate, implied, except where the law allows otherwise. You can withdraw your consent at any time, subject to legal or contractual restrictions, and we will tell you what that means for the service.

How we collect it

directly from you, through our website, our forms and the use of our service, and from third parties such as your employer, our partners or public sources, and through cookies and similar technologies on our website.

Your rights

you can ask to access the personal information we hold about you and to have it corrected. Residents of Québec can also ask us to stop disseminating it or to de-index it, to receive it in a structured, commonly used technological format, and to be told about decisions based exclusively on automated processing and to have them reviewed.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, to the Commission d’accès à l’information (cai.gouv.qc.ca).

Storage and processing outside Canada

some of our providers process personal information outside Canada (Vercel, France; Supabase, France; Resend, Ireland; GitHub, US; Lemon Squeezy, US; OVHcloud, France; Google Workspace, EU; Anthropic, United States; Cloudflare, Worldwide). It may then be accessible to the courts and authorities of those countries. Before communicating personal information of Québec residents outside Québec, we assess whether it will be adequately protected.

Tracking technologies

technologies that can identify, locate or profile you are turned off by default, and turned on only if you choose to.

Customer accounts and service delivery

for the duration of the contract, then deleted or archived after 12 months

Billing and payments

as required by accounting and tax law, commonly 6 to 10 years (10 years in France)

Website analytics and cookies

aggregated audience statistics kept for up to 25 months (the analytics tool sets no cookies); consent choices and necessary cookies kept for up to 13 months

Team collaboration and internal tools

during employment or collaboration; accounts closed at departure and content deleted or archived after 12 months

Contact form and customer support

kept in our mailbox while we answer and follow up, then deleted within 2 years of the last exchange

AI assistants and AI-powered tools

conversation history for up to 12 months, then deleted (set the history period in the tool)

Security and abuse prevention

workspace activity log kept 13 months; bot checks are not stored by us

Free website checker

hashed counters can no longer be linked to an address once the daily salt is deleted, after 2 days, and are then removed; reports are not stored

Legal bases

we process personal data on the legal bases of Article 7 of the LGPD, such as your consent, the performance of a contract with you, compliance with a legal or regulatory obligation and our legitimate interests. The legal basis of each activity is given above.

Contact for personal data matters

Antoine Milkoff, reachable at hello@privacyboard.io.

Your rights (Article 18 of the LGPD)

you can ask us to confirm whether we process your data, to access it, to correct incomplete, inaccurate or outdated data, to anonymize, block or delete data that is unnecessary, excessive or processed unlawfully, to port it to another provider, and to delete data processed with your consent. You can ask which public and private entities we share your data with, be told what happens if you refuse consent, and withdraw your consent at any time. You can also ask for a review of decisions taken solely on automated processing that affect your interests.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 15 days of your request. If you are not satisfied, you can file a petition with the National Data Protection Authority (ANPD, gov.br/anpd).

International transfers

some of our providers process data outside Brazil (Vercel, Supabase, Resend, GitHub, Lemon Squeezy, OVHcloud, Google Workspace, Anthropic, Cloudflare). We transfer data only as allowed by Article 33 of the LGPD, for example to countries the ANPD recognizes as adequate or under the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024).

Legal bases

we process personal data with your consent or on another basis the law allows, such as the performance of a contract with you, compliance with a legal obligation or our legitimate interests. The basis of each activity is given above.

Your rights

you can ask to access your personal data, to rectify it, to delete it and to object to its processing. You can also ask for it to be blocked while a request is examined, receive it in a structured, commonly used format, and not be subject to decisions based solely on automated processing that significantly affect you.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 30 days, which may be extended once by 30 days. If you are not satisfied, you can file a complaint with the Personal Data Protection Agency (Agencia de Protección de Datos Personales).

International transfers

some of our providers process data outside Chile (Vercel, Supabase, Resend, GitHub, Lemon Squeezy, OVHcloud, Google Workspace, Anthropic, Cloudflare). We transfer data only to countries with an adequate level of protection or with the safeguards the law requires, such as contractual clauses.

Your rights

you can ask to access the personal information we hold about you and to have it corrected. You can opt out of direct marketing at any time, and deal with us anonymously or under a pseudonym where that is practicable.

How to make a request or a complaint

use the form in our privacy center or write to hello@privacyboard.io. We answer within 30 days. If you are not satisfied with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (OAIC, oaic.gov.au).

How we hold it

electronically, in our systems and with the service providers listed in this notice (main storage: France), protected by the security measures described above. We destroy or de-identify personal information we no longer need.

Disclosure overseas

we are likely to disclose personal information to service providers located in or processing data in France, Ireland, US, EU, United States, Worldwide.

Automated decisions

We do not use computer programs to make, or substantially help make, decisions that could significantly affect your rights or interests.

Legal bases

we process personal information with your consent, or where it is necessary to conclude or perform a contract with you, to comply with a legal obligation, to respond to an emergency to protect life, health or property, or to use, within a reasonable scope, information you have made public. We ask for your separate consent before we process sensitive personal information, share your information with another processor, make it public or transfer it outside China. You can withdraw your consent at any time. The data, purposes and retention periods are given above.

Your rights

you can ask to know about and decide on the processing of your personal information; to access and copy it, and to have it transferred to another processor where the conditions set by the Cyberspace Administration of China are met; to correct or complete it; to delete it; to restrict or refuse its processing; to have our processing rules explained; and to refuse a decision made solely by automated means that significantly affects you. After a person’s death, their close relatives may exercise these rights for their own lawful interests, unless the person arranged otherwise.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 15 working days, and explain our reasons if we refuse a request. You can complain to the Cyberspace Administration of China or another department responsible for personal information protection, and bring an action in a people’s court if we refuse your request.

International transfers

some of our providers process personal information outside China (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). Before a transfer, we tell you the recipient’s name and contact details, the purposes, the processing methods, the categories of information and how to exercise your rights with it, and we ask for your separate consent. We use the standard contract of the Cyberspace Administration of China, a certification or a security assessment, unless an exemption applies.

Legal bases

we use personal information only for the purposes of use given above. We ask for your consent before using it for another purpose, obtaining sensitive (special care-required) personal information, providing personal data to a third party, unless the APPI allows otherwise, for example when we entrust it to a service provider in Japan or must comply with a law. Providing personal data to a third party in a foreign country follows the rules under International transfers below.

Your rights

you can ask us to disclose the personal data we hold about you and the records of its provision to third parties; to correct, add to or delete it if it is untrue; and to stop using, erase or stop providing it to third parties when it is used beyond its purpose, was obtained improperly, is no longer needed, or is handled in a way that could harm your rights or legitimate interests.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer without delay, within two weeks in most cases, and explain our reasons if we do not act on all or part of a request. You can send complaints to the privacy contact above. You can also contact the Personal Information Protection Commission (ppc.go.jp).

International transfers

some of our providers handle personal data outside Japan (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). We provide personal data to them only if they are in a country the Personal Information Protection Commission recognises as equivalent (the EU, the EEA or the United Kingdom), if they maintain a system that meets the Commission’s standards, such as a data protection agreement with us, in which case we give you information about it on request, or with your prior consent, after telling you the country, its personal information protection system and the measures the recipient takes.

Security measures

we protect personal data with organisational, personnel, physical and technical measures. Where it is stored outside Japan, it is in the countries of the providers listed above. You can ask us for more detail about these measures.

Legal bases

we collect and use personal information with your consent, or where it is necessary to conclude or perform a contract with you, to comply with a legal obligation, to protect vital interests, or for our legitimate interests where they clearly override your rights. When we ask for consent, we ask for each matter separately and say which items are required and which are optional. We process sensitive and unique identifying information only with your separate consent or where the law allows it.

Your rights

you can ask to access your personal information; to correct or delete it; to suspend its processing; to receive an explanation of, or refuse, a decision made solely by automated means that significantly affects you; and to withdraw your consent.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 10 days. If we have to postpone or refuse a request, we tell you why within the same period. You can report an infringement to the Personal Information Infringement Report Center (privacy.kisa.or.kr, phone 118) or apply to the Personal Information Dispute Mediation Committee (kopico.go.kr).

International transfers

we entrust the storage or processing of personal information to providers outside Korea to provide our service. For each: the provider (country; purpose; personal information transferred; contact): Vercel (France; Host business websites, online services or other company systems.; data: Website or service content, account identifiers, IP addresses and server logs where applicable.; contact: privacy@vercel.com); Supabase (France; Provide database, authentication and file storage for enabled Supabase services.; data: Email addresses, account identifiers, authentication metadata and customer-uploaded records.; contact: privacy@supabase.com); Resend (Ireland; Deliver transactional emails such as account notifications and password resets.; data: Recipient email addresses, message content and delivery metadata.; contact: privacy@resend.com); GitHub (US; Manage source code, software development and deployment workflows.; data: Developer names, work email addresses, contribution metadata and information included in repositories or issues.; contact: dpo@github.com); Lemon Squeezy (US; Sell Privacyboard subscriptions as merchant of record: checkout, payment, invoicing, sales tax and billing.; data: Customer names, email addresses, billing addresses, transaction identifiers and payment information handled by the provider.); OVHcloud (France; Domain name registrar for privacyboard.io (DNS and email are no longer hosted at OVHcloud).; data: Domain owner contact details (name, email address, postal address) and account identifiers.); Google Workspace (EU; Provide internal business email and the support mailbox that receives the messages customers send us.; data: Employee names, work email addresses, messages, documents and other content shared by the team.; contact: https://support.google.com/a/contact/googlecloud_dpr); Anthropic (United States; Used to translate specific passage of Privacy Center's documentations.; data: Prompts, documents and files submitted, generated outputs and account identifiers; for translation, the passages a customer wrote in its records (vendor and company names, email addresses and web addresses are replaced by markers before sending); any personal data included in that content.; contact: dpo@anthropic.com); Cloudflare (Worldwide; Bot protection on sign-up and login forms, and real-browser scans of the websites customers ask us to check; data: IP addresses and browser signals for bot checks; pages and cookies observed on customers' public websites during scans; contact: dpo@cloudflare.com). The information is transferred over the network as the service is used, and the provider keeps it for the duration of our contract with it or the retention periods given above, whichever ends first. You can refuse a transfer abroad by contacting us; we may then be unable to provide the part of the service that needs it.

Retention and destruction

we keep personal information for the periods given above, then destroy it without delay, by permanent deletion for electronic files and by shredding for paper records.

Cookies

our website uses cookies as described in our cookie policy. You can refuse them in the cookie settings or in your browser; some features may then not work.

Person in charge of personal information

you can reach our Chief Privacy Officer at the privacy contact given above.

Legal bases

we collect, use and disclose personal data with your consent, given expressly or deemed, for example when you provide data for a purpose or when it is needed for a contract with you, or on an exception the PDPA allows, such as our legitimate interests, which we rely on only after assessing that they outweigh any adverse effect on you. You can withdraw your consent at any time by contacting us; we will tell you the likely consequences.

Your rights

you can ask for access to your personal data in our possession or under our control, and for information about how it has been used or disclosed in the past year; and you can ask us to correct an error or omission in it.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer as soon as reasonably possible. If we cannot answer within 30 days, we tell you within that time when we will. If you are not satisfied, you can contact the Personal Data Protection Commission (pdpc.gov.sg).

International transfers

some of our providers process personal data outside Singapore (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). We make sure they give it a standard of protection comparable to the PDPA, through contracts, binding corporate rules or recognised certifications.

Data Protection Officer

you can reach our Data Protection Officer at the privacy contact given above.

Legal bases

we process your personal data with your consent, which you can withdraw at any time as easily as you gave it, or for a legitimate use the Act allows, such as data you provide voluntarily for a stated purpose or compliance with a legal obligation. The data and purposes are given above.

Your rights

you can ask for a summary of the personal data we process about you and of the processing, and for the identity of those we shared it with; ask us to correct, complete, update or erase it; withdraw your consent; nominate a person to exercise your rights in the event of your death or incapacity; and use our grievance process.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 90 days at the latest. If you are not satisfied with how we handled your grievance, you can complain to the Data Protection Board of India.

International transfers

some of our providers process personal data outside India (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare), which the Act allows except to countries the Government of India restricts.

Languages

you can ask us for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India.

Legal bases

we process personal information with your consent, to perform a contract with you, to comply with a legal obligation, to protect your legitimate interests, or for our legitimate interests or those of a third party. The basis of each activity is given above. We send electronic direct marketing only with your prior consent, or to existing customers about similar products, with a way to opt out in each message.

Your rights

you can ask whether we hold personal information about you, and for a description of it and of the third parties who had access to it; ask us to correct, or to delete or destroy, information that is inaccurate, out of date, incomplete, excessive or that we are no longer allowed to keep; object at any time to processing based on legitimate interests, and to direct marketing; and not be subject to a decision based solely on automated processing that has legal or substantial effects on you. Where needed, we restrict the processing instead of deleting the information.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 30 days, which may be extended once by 30 days; we tell you if we need the extension, and why. You can complain to the Information Regulator (inforegulator.org.za).

International transfers

some of our providers process personal information outside South Africa (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). We transfer it only to recipients bound by a law, binding corporate rules or an agreement giving protection substantially similar to POPIA, or as section 72 otherwise allows.

Information Officer

you can reach our Information Officer at the privacy contact given above.

Legal bases

we process personal data with your explicit consent, or without it when the processing is necessary for a contract with you, to comply with a legal obligation, to establish or defend a right, or for our legitimate interests, or when you made the data public. Where we rely on explicit consent, we ask for it separately from this notice. The data, purposes and bases of each activity are given above.

Your rights

under Article 11, you can learn whether we process your personal data and request information about it; learn the purpose of the processing and whether the data is used for that purpose; know the third parties in Türkiye or abroad to which it is transferred; ask us to correct incomplete or inaccurate data, or to erase or destroy it once the reasons for processing no longer exist, and to tell the recipients; object to a result against you that comes solely from automated analysis; and claim compensation for damage caused by unlawful processing.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. Requests can be sent in Turkish, in writing or by email from the address you gave us. We answer as soon as possible and within 30 days at the latest, free of charge unless the action has a cost set by the Personal Data Protection Board. If we reject your request, if our answer is not sufficient or if we do not answer in time, you can complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of our answer, and in any case within 60 days of your request.

International transfers

some of our providers process personal data outside Türkiye (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). We transfer it on the basis of an adequacy decision or appropriate safeguards, such as the standard contracts of the Personal Data Protection Board, as Article 9 requires.

Legal bases

we use personal data with your informed consent, express or implied, or under another lawful authority, and only for the purposes for which it was collected. The purposes and data of each activity are given above. Unless stated otherwise, you are not legally required to provide your data; if you do not, we may not be able to provide the service that needs it.

Your rights

you can inspect the personal data we hold about you; ask us to correct or delete data that is incorrect, incomplete, unclear or out of date; and ask to be removed from our direct marketing lists and not to be contacted for direct marketing.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We let you inspect your data within 30 days of your request, and we tell you within 21 days if we refuse, with the reason. You can complain to the Privacy Protection Authority (gov.il).

International transfers

some of our providers process personal data outside Israel (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). We transfer it only where the law of the destination country gives protection no lower than Israeli law, or under an exception of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and with the recipient’s written undertaking to protect the data.

Legal bases

we process personal data with your consent, which you can withdraw at any time, or without it where the law allows, for example to perform a contract with you, to comply with a legal obligation, or to establish or defend legal claims.

Your rights

you can ask for information about the personal data we hold about you, including its categories, purposes, recipients inside and outside the UAE, retention and the safeguards for transfers abroad; receive it in a structured, machine-readable format and have it sent to another controller; correct or complete it; erase it; restrict its processing; object to its processing for direct marketing; and object to a decision based solely on automated processing that has legal or serious effects on you.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 30 days. You can complain to the UAE Data Office.

International transfers

some of our providers process personal data outside the UAE (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). We transfer it to countries recognised as offering adequate protection, under a contract binding the recipient to protection equivalent to the PDPL, or as the PDPL otherwise allows.

Legal bases

we process personal data with your consent, which you can withdraw at any time, or without it where the law allows, for example to perform an agreement with you, to comply with a law, or for our legitimate interests, which we never rely on for sensitive data. The legal basis and purpose of each activity are given above. Unless stated otherwise, providing your data is optional, but we may not be able to provide the service that needs it.

Your rights

you can ask to be informed of how we process your personal data; to access it and obtain a copy in a readable and clear format; to correct, complete or update it; to have it destroyed when we no longer need it; and to stop receiving marketing messages.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 30 days, which may be extended by up to 30 days; we tell you if we need the extension. You can complain to the Saudi Data & AI Authority (SDAIA, dgp.sdaia.gov.sa) and claim compensation for damage before the competent court.

International transfers

some of our providers process personal data outside the Kingdom (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). We transfer only the data needed, to countries recognised as adequate or with appropriate safeguards such as SDAIA’s standard contractual clauses, as the Law and the Regulation on Personal Data Transfer outside the Kingdom require.

Legal bases

we process personal data with your consent, or where it is necessary for a contract with you, to comply with a legal obligation, to protect vital interests, for a public task, for research or archiving, or for our legitimate interests. We ask for your explicit consent before processing sensitive data, unless the law allows otherwise. Where data is required by law or for a contract, we tell you the consequences of not providing it. The retention periods are given above.

Your rights

you can withdraw your consent at any time; access and obtain a copy of your personal data, and ask how we obtained data you did not consent to; receive it in a commonly used, machine-readable format and have it sent to another controller; object to its processing; have it erased, destroyed or anonymised; restrict its use; and have it corrected and kept accurate, up to date and complete.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer within 30 days, which may be extended by up to 30 days for large or complex requests; we tell you if we need the extension. You can complain to the Office of the Personal Data Protection Committee (pdpc.or.th).

International transfers

some of our providers process personal data outside Thailand (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). We transfer it to countries with adequate protection, under binding corporate rules or appropriate safeguards such as standard contractual clauses, or as the PDPA otherwise allows.

Legal bases

we collect personal information only for lawful purposes connected with our activities and only when it is necessary for those purposes, and we use or disclose it only for those purposes, with your authorisation, or as the Privacy Act otherwise allows. Unless stated otherwise, providing your information is voluntary; if you do not, we may not be able to provide the service that needs it.

Your rights

you can ask for access to the personal information we hold about you, and ask us to correct it. If we do not correct it, you can ask us to attach a statement of the correction you asked for.

How to make a request

use the form in our privacy center or write to hello@privacyboard.io. We answer as soon as reasonably practicable and within 20 working days. If we need more time, we tell you within that period how long and why. If you are not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

International transfers

some of our providers store or process personal information outside New Zealand on our behalf (Vercel; Supabase; Resend; GitHub; Lemon Squeezy; OVHcloud; Google Workspace; Anthropic; Cloudflare). If we disclose personal information to a foreign recipient, we make sure it is protected by safeguards comparable to the Privacy Act, or we ask for your authorisation first.