Privacy Policy

How I collect, use, and protect your information.

Introduction

Welcome to Boardy, the world's first social AI. Your privacy is important to us, and this Privacy Policy outlines how we collect, use, and protect your personal information.

Data Collection

Boardy collects a range of personal data directly from users through interactions, including but not limited to:

• Names
• Email addresses
• Phone numbers
• Professional information
• Any other information you choose to provide during interactions

By sharing your email address and/or phone number with Boardy through LinkedIn messaging or similar communication, you are also opting in to receive marketing communications via email and SMS. These messages may include updates, newsletters, partnership announcements, and personalized suggestions. You may opt out at any time using the unsubscribe link in emails or by replying with STOP to text messages.

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, or religious beliefs. However, if you choose to share this information, it may be collected as part of our interactions.

Legal Basis for Processing

Boardy processes your personal data under the following legal bases:

• Consent (Article 6(1)(a) GDPR): Marketing communications (email and SMS), sharing contact information with matches after double opt-in, and newsletter subscriptions.
• Contract Performance (Article 6(1)(b) GDPR): Processing necessary to provide introduction and matching services, and maintaining user profiles for service delivery.
• Legitimate Interests (Article 6(1)(f) GDPR): Service improvement and analytics, platform security and abuse prevention, and customer support.
• Legal Obligation (Article 6(1)(c) GDPR): Compliance with applicable laws and regulations.

Data Usage

The personal data collected is used to:

• Facilitate introductions between users and relevant contacts.
• Improve our services.
• Send marketing communications via email, WhatsApp, and SMS, including newsletters, updates, and personalized opportunities (you may opt out at any time).
• Digital advertising and retargeting campaigns across social media platforms.

Third-Party Services

Boardy uses third-party services, including OpenAI, Anthropic, and Meta advertising platforms, for data processing, storage, and advertising. These partners are essential to providing our service and are bound by strict confidentiality obligations.

• AI Processing Partners: We use OpenAI and Anthropic to power our AI capabilities. These services may process your conversations, profile information, call transcripts, calendar event details, and derived calendar insights according to their own privacy policies and security standards.
• Advertising Partners: We use Meta and other advertising platforms for targeted marketing and user acquisition, as detailed in our Digital Advertising section.
• Website Analytics: We use PostHog to measure how visitors use our public website, as detailed in our Website Analytics and Session Replay section.

Google Calendar Integration

When you connect your Google account, Boardy requests only the OAuth scopes needed to help you schedule meetings. We never request access to your contacts, Gmail, Drive, or any other Google product.

Boardy uses free/busy access to find availability and owned-calendar event access to keep meeting context current. Write access is used only for meetings Boardy schedules or is explicitly asked to manage: Boardy may create those events, update their time, details, or attendees, or cancel them. Boardy does not edit, delete, or otherwise modify existing calendar events that Boardy did not book for you.

The scopes we request, and how each one is used:

• openid,userinfo.email,userinfo.profile: identify the Google account you connected so we can associate the integration with your Boardy profile. We store the connected account's email address.
• calendar.calendarlist.readonly: read-only access to your calendar list so Boardy can find your primary calendar and timezone for scheduling.
• calendar.freebusy: read your free/busy availability (busy time blocks only — no event titles, descriptions, attendees, or locations) so Boardy can suggest times that work for you.
• calendar.events.owned: view event details on calendars you own, such as titles, descriptions, attendees, locations, meeting links, and updates, so Boardy can support scheduling, preparation, and follow-up. Boardy uses the write portion of this scope only to create, update, or cancel meetings Boardy books for you when you authorize scheduling. Boardy does not use this scope to change or delete existing events on your calendar that Boardy did not book.

Google API Services Limited Use Disclosure

Boardy's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve user-facing features of the Boardy scheduling experience.
• We do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not use calendar attendee information to automatically market to or enroll those attendees in Boardy.
• We do not allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the data has been aggregated and anonymized.

You can disconnect your Google account from Boardy at any time from your account settings, or by revoking access directly at myaccount.google.com/permissions. Disconnecting stops all future calendar access; events Boardy previously created on your behalf remain on your calendar unless you delete them yourself. Calendar event data Boardy already processed may be retained in our systems unless you request deletion, subject to legal and operational retention requirements.

Website Analytics and Session Replay

On our public website, we use PostHog to understand how visitors use the site and to fix issues. How we handle analytics cookies depends on your location:

• EU, EEA, and UK visitors: by default, PostHog runs in a cookieless mode that records anonymous, aggregate usage (such as pages viewed and clicks) without setting analytics cookies or identifying you across visits. We set analytics cookies only if you accept our analytics cookie prompt.
• Visitors elsewhere: we set analytics cookies by default so we can recognize your browser across visits. You can opt out at any time by declining our analytics cookie prompt, which turns off analytics cookies.

If you accept the analytics cookie prompt, we also:

• Set analytics cookies (if they are not already set) so we can recognize your browser across visits.
• Record session replays of your interactions with the website. Session replay captures a reconstruction of the page including mouse movement, clicks, scroll, and visible text and images. Form input values you type are masked and not recorded. We do not capture audio, video, or microphone input.

Session replay recordings are processed by PostHog and retained for up to 90 days, after which they are deleted. You can withdraw your consent at any time by clearing your browser's site data for this website, which resets the prompt and stops session replay.

Digital Advertising and Social Media Tracking

Boardy uses social media advertising platforms, including Meta, to deliver targeted advertisements and measure campaign effectiveness. This involves:

• Custom Audiences: We may share hashed versions of your email address or phone number with Meta to create custom audiences for advertising purposes.
• Retargeting: Information about your interactions with our services may be used to show you relevant advertisements on Facebook, Instagram, and other Meta platforms.
• Conversion Tracking: We use Meta Pixel and similar tracking technologies to measure the effectiveness of our advertising campaigns and understand user behavior.
• Lookalike Audiences: Your information may be used to help create audiences of users with similar characteristics for advertising purposes.

You can opt out of targeted advertising by:

• Adjusting your ad preferences in your Meta account settings.
• Using browser settings to block tracking cookies.
• Contacting us at privacy@boardy.ai to request exclusion from advertising audiences.

Data Sharing

Your data may be shared with third parties in the following circumstances:

• When introducing you to relevant contacts: Your email address and/or phone number will only be shared with another user after both parties have explicitly opted in to connect with each other.
• With partners who assist in providing or improving our service.
• With social media advertising platforms (such as Meta) for targeted advertising and retargeting purposes.

We do not sell your personal data to third parties.

Data Retention

We retain personal data for the following periods:

• Profile and matching data: Retained while your account is active and for 2 years after account deletion.
• Communication records: Retained for 3 years for service improvement and support.
• Marketing data: Retained until you opt out, then deleted within 30 days.
• Legal compliance data: Retained as required by applicable law.

Data Deletion and Anonymization

To delete or anonymize your data, please contact us at privacy@boardy.ai. We will process your request promptly and will also request removal of your data from advertising platforms where applicable.

Security Measures

We implement robust security measures to protect your data, especially business and mission-critical information, from unauthorized access, disclosure, alteration, or destruction.

Enterprise Data Protection

Boardy recognizes that through our product, we may access sensitive, proprietary, and mission-critical information from businesses. We maintain stringent security protocols for all corporate data:

Data Classification

Business information is classified by sensitivity levels, with proprietary and mission-critical data receiving enhanced protection.

Technical Safeguards

• End-to-end encryption for data transmission.
• Multi-factor authentication for system access.
• Regular third-party security audits.
• 24/7 security monitoring systems.

Access Controls

• Strict role-based access limiting internal visibility to business data.
• Complete audit logging of all data access.
• Employee access restricted to essential personnel only.

Processing Safeguards

• Business information used only for specifically authorized purposes.
• No training of AI models on proprietary business information without consent.
• Clearly defined data retention policies.

Third-Party Protection

• All third-party processors bound by strict data security agreements.
• Regular security assessments of all vendors handling business information.

Incident Response

• Comprehensive breach response protocol.
• 24-hour notification commitment for affected businesses.
• Post-incident analysis and remediation planning.

Data Breaches

In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify you without undue delay and provide information about:

• The nature of the breach.
• Likely consequences.
• Measures taken or proposed to address the breach.

Your Data Protection Rights

Under GDPR, you have the following rights:

• Right of Access (Article 15): You can request information about what personal data we process and obtain a copy of your personal data.
• Right of Rectification (Article 16): You can request correction of inaccurate personal data.
• Right of Erasure (Article 17): You can request deletion of your personal data in certain circumstances.
• Right to Restrict Processing (Article 18): You can request that we limit how we use your personal data in certain situations.
• Right to Data Portability (Article 20): You can request your personal data in a structured, machine-readable format.
• Right to Object (Article 21): You can object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making (Article 22): You have rights regarding automated decision-making, including AI-powered matching.

Additional rights regarding advertising

• Right to opt out of targeted advertising on social media platforms.
• Right to request removal from custom audiences and lookalike audiences.
• Right to know which advertising platforms have received your data.

To exercise any of your rights, please contact us at privacy@boardy.ai. We will respond within one month of receiving a valid request.

Consent Withdrawal

You may withdraw your consent at any time by:

• Marketing communications: Using unsubscribe links or replying STOP to SMS.
• Profile matching: Contacting privacy@boardy.ai to remove your profile.
• All processing: Requesting account deletion via privacy@boardy.ai.

Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be communicated to users via email or platform notifications at least 30 days before they take effect. For changes affecting data processing under GDPR, we may require renewed consent where legally required. Continued use of the service after changes have been made will constitute acceptance of the revised Policy.

Contact Information

• General privacy inquiries: privacy@boardy.ai
• Data Protection Officer: joseph@boardy.ai

If you have any questions or concerns about this Privacy Policy, please contact us using the information above.

Last updated: June 26, 2026