Privacy Policy
1. Who is responsible
The controller of your personal data is [company name – set LEGAL_COMPANY in config.php], ul. …, 00-000 Miasto, Poland, [registration, e.g. KRS number – set LEGAL_REGISTRATION in config.php] (“we”). Questions about your data: [contact email – set LEGAL_EMAIL in config.php].
For boards that a company uses for its own work, that company is the controller of the personal data on those boards, and we process it on its behalf under our Data Processing Agreement.
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| If you sign in with Google: your name, email address and Google account ID, received from Google (we don’t get your Google password or access to anything else in your Google account) | Signing you in with Google | Contract, Art. 6(1)(b) |
| Name, email address, password (stored only as a secure hash) | Your account, signing in, emails about your account (confirming your address, resetting your password) | Contract, Art. 6(1)(b) |
| Boards, their content and images you add | Providing the Service, sharing with the people you choose, backups | Contract, Art. 6(1)(b) |
| Plan, subscription status, Paddle customer reference | Giving you the features of your plan | Contract, Art. 6(1)(b) |
| IP address of sign-in attempts, time of last activity | Protecting accounts from password guessing, keeping the Service secure | Legitimate interest, Art. 6(1)(f) |
| Messages you send us | Answering you | Contract or legitimate interest |
We don’t sell your data, don’t use it for advertising and don’t build profiles of you. Payment card details are handled only by Paddle; we never see them.
3. Who else processes data
- [hosting company – set LEGAL_HOSTING in config.php] – hosting of the application, database and images (in the EU).
- Liveblocks Inc. – real-time collaboration (board content while you edit together). Data may be processed in the USA, protected by the EU Standard Contractual Clauses / EU–US Data Privacy Framework.
- Paddle.com Market Ltd (UK) – payments, invoices and taxes for paid plans. Paddle acts as an independent controller for payment data under its own privacy notice.
- [email provider – set LEGAL_EMAIL_PROVIDER in config.php] – sending emails about your account.
4. How long we keep data
- Account and boards: for as long as you have the account. When you delete it, everything is deleted straight away; copies in backups disappear as backups are rotated, within 14 days.
- Sign-in attempts: 15 minutes. Links in emails stop working after 1 hour (password reset), 3 days (email confirmation) or 7 days (invitation).
- Records that the law requires (for example invoices, kept by Paddle): as long as the law requires.
5. Your rights
You can ask us for access to your data, to correct it, to delete it, to limit its use, to receive it in a portable format, and you can object to processing based on legitimate interest. Write to [contact email – set LEGAL_EMAIL in config.php]; we answer within one month. You can delete your account yourself at any time in the app. You also have the right to complain to a data protection authority – in Poland the President of the Personal Data Protection Office (UODO), or the authority in your own EU country.
6. Cookies and browser storage
We use one cookie that is strictly necessary: it keeps you signed in. We also keep a few settings in your browser’s storage (light or dark theme, whether the sidebar is open, and a copy of your board list so pages open quickly); they’re removed when you sign out. We don’t use analytics, advertising or tracking cookies, so we don’t ask for cookie consent. If that changes, we’ll ask you first.
7. Security
Connections are encrypted (HTTPS), passwords are stored only as secure hashes, sign-in attempts are rate-limited, private boards and their images open only for people who have access, and we make regular checked backups.
8. Children
The Service is not meant for children under 16, and we don’t knowingly collect their data.
9. Changes
If we change this policy in a way that matters, we’ll tell you by email or in the app before it applies.