Privacy Policy

1. Who we are

BoardSimple is operated by Richard Romero. For the purposes of UK and EU data protection law, Richard Romero is the data controller for personal data collected through this service.

Privacy contact: privacy@boardsimpleapp.com

2. What data we collect

We collect only the information needed to provide and improve the service:

• Account data: email address, authentication credentials, and profile information when you sign up or sign in.
• Board content: feature requests, bug reports, comments, statuses, categories, and changelog posts you create or import.
• Public submitter/voter data: email addresses voluntarily submitted by visitors when they post ideas or upvote posts, used only to prevent duplicate votes and notify them of updates they opt into.
• Usage data: page views, interactions, and technical logs to help us keep the service reliable and improve it.
• Payment data: billing details are collected and processed by Stripe; we do not store full card numbers on our servers.

3. How we use your data

We use personal data to:

• Create and manage your account and authenticate you.
• Host, display, and operate your public roadmap, feedback board, and changelog.
• Prevent duplicate votes and moderate public submissions.
• Process subscription payments and send billing-related notifications.
• Communicate product updates, security notices, and support responses.
• Monitor and improve the performance and security of the service.

We do not sell personal data and do not use it for third-party advertising.

4. Legal basis for processing

Where UK/EU GDPR applies, we rely on the following legal bases:

• Performance of a contract: to provide the service you signed up for.
• Consent: for optional communications or cookies where required by law.
• Legitimate interests: to keep the service secure, prevent abuse, and improve the product.
• Legal obligation: to comply with applicable laws, tax, or regulatory requirements.

5. Who we share data with

We share data with a limited number of service providers who help us run the service:

• Lovable Cloud: hosting and infrastructure for the application.
• Supabase: managed backend database and authentication services.
• Stripe: payment processing and subscription management.

Public board content and votes may be displayed publicly according to your board settings. We may also disclose information if required by law, court order, or to protect our rights and users.

6. International data transfers

Some of our service providers are based outside the UK and European Economic Area. Where personal data is transferred internationally, we rely on approved safeguards such as Standard Contractual Clauses or equivalent mechanisms to protect your data.

7. Data retention

We keep personal data for as long as your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. If you delete your account or content, we will remove it from active storage within a reasonable period, though residual copies may remain in backups for a limited time.

8. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data in certain circumstances.
• Restrict or object to processing based on legitimate interests.
• Receive a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise these rights, email us at privacy@boardsimpleapp.com.

9. Cookies and similar technologies

We use essential cookies to keep you signed in and maintain core functionality. We may also use analytics cookies to understand how visitors interact with the product. You can manage or disable non-essential cookies through your browser settings.

10. Security

We take reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, and secure authentication. No online service can guarantee absolute security, and we encourage you to use strong passwords and keep your login details safe.

11. Children

BoardSimple is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy as the service evolves. Changes will be posted on this page with an updated effective date. For significant changes, we will notify active users by email where appropriate.

13. Contact us

For privacy questions, data requests, or complaints, please contact Richard Romero at privacy@boardsimpleapp.com.