Your governance record is your evidence. We treat it that way.

We are Boardverse.ai Ltd ("we", "us", "our"), a company registered in England and Wales with company number 17431790. We operate the Boardverse platform, available at boardverse.ai (the "Service").

This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it. It applies whether you are a registered user of the Service or simply visiting the website.

We are the data controller for the personal data described in this policy. If you have any questions about it, please contact us at hello@boardverse.ai.

We collect information in three ways: information you give us, information we collect automatically, and information we receive from other sources.

Information you give us. When you create an account, use the Service, or contact us, you may provide us with your name, email address, company name and job title, billing and payment details, and any content you upload or create using the Service.

When you use the contact form. The form on our contact page asks for your name, your email address, what the enquiry is about and your message. You can add a phone number, an organisation and a job title if you want the reply to reach you another way or to be about the right company. We keep what you send so that we can answer it, and so that the next person you speak to has the same record as the first.

When you complete the Readiness Diagnostic. Before we set up an organisation on the Service, we ask the person arranging it to complete a Readiness Diagnostic. The first part is required and asks about the organisation and the people who will use Boardverse: the organisation's name, size and sector, and for each person who will use the Service, their name, their work email address, their role, and which account they will use to sign in (Google, Microsoft or Apple, and the address for it). The second part is optional and asks where the organisation's existing records live. The diagnostic never asks for a password, an API key or any other secret, and it refuses anything that looks like one. Please do not enter a secret into it. You reach the diagnostic through a private link we email to you. The link stands in place of a password, so please treat it as you would a password and do not forward it to anyone who should not see the answers. You are asked to confirm that you are authorised to give us the details of the people you name.

Information we collect automatically. When you visit the Service, we automatically collect certain technical information, including your IP address, browser type and version, device information, pages you visit, and how you interact with the Service. Some of this is collected through cookies, which are covered in our Cookie Policy.

Information from other sources. We may receive information from payment processors, analytics providers and, if you choose to sign in using a third party service, from that provider.

Contact enrichment. We use a contact enrichment service provided by our contact management provider, Every (every.ai). It adds to a contact's record their role and employer, their approximate location, their social profile address and their profile photograph. It draws only on the accounts we have connected to our own contact management system, such as our LinkedIn and Google accounts, and on nothing else: we do not buy personal data, and Every does not enrich from public lists or third-party brokers. The enrichment is carried out for us by Google's Gemini service and Cloudflare's Workers AI, which act for Every under terms that do not allow them to train on the data. We use enrichment to understand who we are speaking to, and not to make automated decisions about anyone. We also keep an internal score of each contact, which helps us decide which organisations to approach first. The score is not shared with anyone outside Boardverse and is not used for any other purpose. You can ask us to stop enriching your record, or object to it, at any time, by writing to hello@boardverse.ai.

People who are named in a Readiness Diagnostic. Most of the people whose details we hold from a diagnostic have not visited this site and have not dealt with us directly. They are named by a colleague who is arranging their organisation's use of the Service. We receive each person's name, work email address, role, and the account they will use to sign in. Section 8 explains what we do with that information and how they can reach us.

We use your personal data for the following purposes:

Under the UK GDPR and the Data Protection Act 2018, we rely on the following legal bases:

• Consent. Where you have given us clear permission to process your data for a specific purpose, such as marketing. You can withdraw consent at any time.
• Performance of a contract. Where processing is necessary to provide the Service you have asked us to provide.
• Legitimate interests. Where processing is necessary for our legitimate interests, such as improving the Service and keeping it secure, and where those interests are not overridden by your rights.
• Legal obligation. Where we need to process data to comply with the law.

We use cookies that are strictly necessary to run the Service and to protect this site from automated traffic. We do not use cookies to understand how you use the site, and we do not use cookies to advertise to you. For full details, including how to manage or disable cookies, please see our Cookie Policy.

The Service may include features powered by artificial intelligence and machine learning. When you use these features, the content you provide may be processed by us and by our AI service providers to generate the output you have requested.

We process this content only to provide the feature you are using. We do not use your content to train our models or those of our providers unless we have your explicit consent and tell you so.

We share personal data only where necessary and always on a lawful basis. The categories of recipients include:

• Service providers. Companies that host the Service, process payments, provide analytics, and supply AI and other technical services. We require these providers to process data only on our documented instructions and to protect it appropriately.
• Every. The customer relationship system we keep enquiries in, provided by Every (every.ai). When you send a message through the contact form, your name, email address, enquiry type and message, and any phone number, organisation or job title you gave, are stored there as one record against your email address, so that we reply from a record rather than from memory. A Readiness Diagnostic creates one organisation record in Every and one contact record for each person named in it, holding that person's name, work email address, their role in the organisation, and which account they will use to sign in. Every processes that data only on our instructions.
• Cloudflare. Cloudflare serves and protects the site. When you send a message through one of our forms, or complete the Readiness Diagnostic, its Turnstile service checks that the submission came from a person rather than an automated program. To make that check it collects your IP address, the way your browser identifies itself, the way it negotiates a secure connection, and the address of the page you are on. Cloudflare states that it cannot identify you from those signals and uses them only to detect and block bots and to improve that detection. It does not read what you type into the form.
• Payments. We take payment for Governed through Stripe. When you set up payment, Stripe receives the payer's name, billing address and email address, the card or bank details you give it, your VAT number if you provide one, and a record of the payments. Your card and bank details go to Stripe and never to us: we keep only a payment reference and whether the payment succeeded. If you choose to save your details for later checkouts, Stripe keeps them under Stripe's own terms and privacy policy, at stripe.com/privacy. Stripe takes payments on our instructions, and is also a controller of payment data it uses to prevent fraud, to secure its services and to meet its own legal obligations. Our account is with Stripe Payments Europe, Limited, and Stripe Payments UK Ltd is party to it for the regulated parts of the service. Payment data may be processed outside the United Kingdom, including in the European Economic Area and the United States. Where it is, Stripe relies on the UK Extension to the EU-US Data Privacy Framework and, where that does not apply, on the standard contractual clauses in its data processing agreement. You can ask us for details of the safeguards at hello@boardverse.ai.
• Professional advisers. Lawyers, accountants, auditors and insurers who advise us.
• Regulators and authorities. Where we are legally required to disclose data, for example to HMRC or the ICO.

We never sell your personal data.

If your details were given to us by a colleague who was arranging your organisation's use of Boardverse, this section is for you. You have not dealt with us directly and we have not asked you for your details.

What we hold, and where it came from. Your name, your work email address, your role in your organisation, and which account you will use to sign in (Google, Microsoft or Apple, and the address for it). We received these from the colleague who completed the diagnostic, not from you.

Why we hold them. To set up your organisation on the Service, to give you the right access, and to confirm with you which account you will use to sign in. We rely on our legitimate interests in doing so, because we cannot set up an organisation's board software without knowing who its people are. We hold very little about you, we use it only for that purpose, and we have considered your rights in deciding to do so.

What we do not do. We do not market to you. We do not use your details to advertise to you, we do not sell them, and we do not add you to any list of ours for anything other than your organisation's use of the Service. We never ask you for a password and we never hold one.

What you can ask us to do. You can ask us what we hold about you, ask us to correct it, ask us to remove it, or object to our holding it. Write to hello@boardverse.ai and we will respond within one month. If you ask us to remove your details, we will, and we will tell the colleague who named you. Please note that this may mean we can no longer give you access to your organisation's Boardverse environment, because we would no longer know who you are. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

How we tell you. When a diagnostic is submitted, we write to each person named in it, within one month, to tell them that their organisation is arranging to use Boardverse, what we hold, and how to reach us. If you have received that message, it came from this process and you can use the address in it to reach us.

Where data is held, and transfers outside the UK. Our customer records are held for us by Every (every.ai), whose infrastructure is in the United States: databases with Supabase in Ohio, and application hosting with Railway on the US east and west coasts. Every's other service providers are listed at every.ai/subprocessors. When personal data is transferred outside the United Kingdom, we rely on the UK Addendum to the EU standard contractual clauses, which Every has adopted. You can ask us for a copy of those safeguards at hello@boardverse.ai. Payment data is processed by Stripe, as set out in the payments section above.

We keep personal data only for as long as we need it for the purposes described in this policy. In practice:

• Account data is kept while your account is active, and for a reasonable period afterwards to allow you to reactivate it.
• Billing records are kept for at least six years to comply with tax law.
• Messages sent through the contact form, and the record of them we keep in Every, are kept while we are in contact with you and for two years after our last exchange. If you become a customer they form part of your account records instead.
• Readiness Diagnostic. A diagnostic that is started and never submitted is deleted from our database 90 days after it was last touched, and the private link that reaches it stops working at the same time. A submitted diagnostic from an organisation that does not become a customer is kept on the same terms as a contact form message: while we are in contact with you and for two years after our last exchange. A confirmed diagnostic from an organisation that becomes a customer forms part of that account's records and is kept for as long as those records are kept. When one of those periods ends, we delete the diagnostic from our own database. In Every we erase it: every answer is removed, the email address is removed, the name is replaced with one that identifies nobody, and the record is retired from view. The record that remains is not personal data, because nothing in it identifies anyone, and we keep it only so that our records stay consistent.

When we no longer need your data, we delete it or anonymise it securely.

We take the security of your data seriously. We use appropriate technical and organisational measures, including encryption in transit, access controls and staff training, to protect personal data against loss, misuse and unauthorised access.

Under the UK GDPR you have the following rights:

• The right to access the personal data we hold about you.
• The right to have inaccurate data corrected.
• The right to have your data erased in certain circumstances.
• The right to restrict or object to processing in certain circumstances.
• The right to data portability.
• The right to withdraw consent at any time where we rely on consent.
• The right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

To exercise any of these rights, contact us at hello@boardverse.ai. We will respond within one month.

The Service is not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Please review this page regularly.

If you have any questions about this policy or how we handle your personal data, please contact us at hello@boardverse.ai. Our ICO registration number is ZC236394.