Privacy policy
What we process, why, and what you can do about it. The plain-language overview is on the security page.
Last updated 28 October 2026
1. Who is responsible
Boardly Systems OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Harju maakond, Estonia. Email: hello@board.ly.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, sign-in data (passkeys, Google account id) | Your account and signing in | Art. 6(1)(b) GDPR, contract |
| Subscriptions you add, reminder settings, AI scan history | Running the service you use | Art. 6(1)(b) GDPR |
| If you subscribe: your Polar customer and subscription ids, the plan’s status and billing period | Giving you the scans you pay for | Art. 6(1)(b) GDPR |
| Files and emails you import with AI (processed, not stored) | Finding subscriptions in them, when you ask | Art. 6(1)(b) GDPR |
| Signed-in devices (browser, IP address, last active) and an activity log (sign-ins, imports, exports, AI runs, account changes) | Showing you where you’re signed in and what happened in your account, so you can spot and stop anything you don’t recognize | Art. 6(1)(b) and (f) GDPR |
| Push subscription of your device | Sending reminders you turned on | Art. 6(1)(a) GDPR, consent, withdrawable any time |
| Server logs (IP address, time, request) | Security and fixing errors | Art. 6(1)(f) GDPR, legitimate interest |
Bank CSV exports are processed only in your browser and never sent to us. We don’t use your data for advertising, don’t sell it, and don’t make automated decisions about you with legal effect.
3. Processors
We use these processors under data processing agreements:
- Supabase (database, authentication), data stored in Ireland.
- Cloudflare (hosting and DNS), the app runs next to the database in Ireland; static files and traffic go through Cloudflare’s global network.
- Anthropic (Claude API), only for AI imports you start. Inputs aren’t used for training by default and are deleted within 30 days, per Anthropic’s published terms.
- Resend (sending sign-in codes and reminder emails).
- Google, only if you sign in with Google.
Payments. If you subscribe, Polar Software Inc. (3500 South DuPont Highway, Dover, DE 19901, USA) sells you the subscription as our reseller and merchant of record. Polar collects your payment details, billing address and tax information itself, with Stripe as its payment processor, and is responsible for that data under its own privacy policy. We never see your card details. From Polar we receive only what’s in the table above.
4. Transfers outside the EU
Some processors are based in the USA. Transfers rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
5. How long we keep data
- Account data: until you delete your account. Deleting is immediate and removes everything. A running subscription is canceled at the same time, and Polar is asked to delete your customer record, apart from the orders and invoices tax law makes it keep.
- Imported files and email bodies: not stored. Deleted once read.
- Reminder delivery records: as long as your account exists, so we never send the same reminder twice.
- Activity log: 12 months. Signed-in devices: until you sign out there, or the session expires.
- Server logs: kept by our hosting provider for a short period, then deleted.
6. Cookies
We only use cookies that are needed to keep you signed in. No analytics, no tracking, no third-party ad cookies, so there’s no cookie banner.
7. Your rights
You can ask for access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), a copy in a portable format (Art. 20) and object to processing based on legitimate interest (Art. 21). You can withdraw consent at any time. Most of this you can do yourself in Settings: export, delete, turn notifications off. Otherwise write to hello@board.ly.
You also have the right to complain to a data protection supervisory authority, for example the one where you live, or the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), which supervises us.
8. Changes
We update this page when the service changes. The date at the top shows the latest version. See also our terms.