Privacy Policy

1. Introduction

This Privacy Policy describes how ClientBoards (“we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use our website, web application, and related services (collectively, the “Services”). By using the Services, you agree to the practices described here.

If you do not agree, please do not use the Services. For questions, contact us.

2. Roles and responsibility

For account holders and visitors to our marketing site, we typically act as a data controller for personal information we process to operate ClientBoards.

When you use ClientBoards to host client-facing boards, upload content, or collect information from your own clients or end users, you may act as a controller (or co-controller) for that content and those individuals, and we process such data as a processor or service provider on your instructions, subject to your agreement with us and applicable law.

3. Information we collect

3.1 You provide directly

• Account data: name, email address, password (stored securely by our authentication provider), profile and workspace settings.
• Billing data: processed by our payment processor (e.g. Stripe). We do not store full payment card numbers on our servers.
• Support and communications: messages you send via contact forms, in-app support, or email.
• Content you upload: board configuration, milestones, files, messages, branding assets, and similar workspace content.

3.2 Automatically

• Usage and device data: IP address, browser type, general location derived from IP, pages viewed, and timestamps—where needed for security, analytics, or service operation.
• Cookies and similar technologies: session and preference cookies required for sign-in and core functionality; we may use additional cookies or local storage as described in our cookie practices or consent tools where required.

4. How we use information

We use personal information to:

• Provide, maintain, and improve the Services;
• Create and manage accounts and authenticate users;
• Process subscriptions and payments;
• Send transactional messages (e.g. security alerts, receipts);
• Provide customer support;
• Operate optional features such as AI-assisted tools, where enabled;
• Detect, prevent, and address fraud, abuse, and security issues;
• Comply with legal obligations and enforce our terms; and
• Analyze aggregated or de-identified usage to improve the product.

Where the GDPR or similar laws apply, we rely on appropriate legal bases such as contract performance, legitimate interests (balanced against your rights), consent where required, and legal obligation.

5. How we share information

We do not sell your personal information. We may share information with:

• Service providers who assist us under contractual obligations, including:
  • Hosting and database (e.g. Supabase or equivalent) for application data and authentication;
  • Payment processing (e.g. Stripe);
  • Email delivery (e.g. Resend or similar);
  • AI providers when you use AI features (e.g. Anthropic or other models), subject to our agreements and settings;
  • Infrastructure and analytics vendors as configured in our deployment.
• Legal and safety: when required by law, court order, or government request, or to protect rights, safety, and security.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice where required.

6. Retention

We retain personal information for as long as your account is active, as needed to provide the Services, and as necessary to comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion of your account subject to applicable law and legitimate retention needs (e.g. tax or fraud prevention).

7. Security

We implement technical and organizational measures appropriate to the nature of the Services, including encryption in transit (HTTPS), access controls, and reliance on reputable infrastructure providers. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

8. International transfers

We may process and store information in the United States and other countries where we or our subprocessors operate. If we transfer personal data from the EEA, UK, or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms where required.

9. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or port your personal data; restrict or object to certain processing; withdraw consent where processing is consent-based; and lodge a complaint with a supervisory authority.

To exercise rights, contact us. We will respond in accordance with applicable law.

10. U.S. state privacy notices

Residents of certain U.S. states may have additional rights under applicable state privacy laws (e.g. California). We do not sell personal information as “sale” is commonly defined under those laws. You may request access, deletion, or correction as provided by law by contacting us.

11. Children

The Services are not directed to individuals under 16 (or the age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the effective date. Material changes may be communicated by email or in-product notice where appropriate. Continued use after the effective date constitutes acceptance of the updated policy, except where prohibited by law.

13. Contact

For privacy-related requests, contact us through our contact page.