Who we are
BoardBrief is operated by Two Cores Operations Ltd, a company registered in England and Wales ("we", "us", "our"). We are the data controller for the personal data described in this policy.
If you have any question about this policy or your data, reach us through the contact page.
What we collect
Account information
When you sign up we collect your email address and, optionally, your company name. We use magic link sign in, so we never collect or store a password. Your account record also holds your subscription status and a Stripe customer reference if you subscribe to a paid plan.
Content you provide
To generate an update you enter company information such as your company name, reporting period, metrics (for example MRR, ARR, burn, runway, headcount, customers, churn, and NRR), and notes covering highlights, challenges, and asks. If you use custom branding, we also store the branding details you add, such as a company name, contact details, an accent colour, and a logo. This content is stored in our database against your account so your update history is available in your dashboard.
Payment information
Payments are handled by Stripe. Your card number goes directly to Stripe and is never seen or stored by us. We keep only the identifiers Stripe gives us and the status of your subscription.
Usage data
We use Google Analytics 4 to measure how the site is used, including pages viewed, approximate location, and device and browser information. Our hosting provider also keeps standard server logs, which include IP addresses.
Newsletter and contact form
If you join our newsletter, your email address is forwarded to our signup collector, which runs on Netlify Forms, and is used only to send you the newsletter. You can unsubscribe at any time. If you use the contact form, we receive the name, email address, and message you submit, also via Netlify Forms.
Your board content is confidential
The metrics and notes you submit are commercially sensitive, and we treat them that way. Your board content is processed only to generate your briefs. We never publish it, never share it with other customers, never use it for marketing, and never use it to train AI models.
To draft the narrative in your update, the content you submit is sent to Anthropic's Claude API and used solely for that generation. The finished brief is yours. You download it and share it however you choose. We never contact your investors and we never access your contact lists.
Why we process your data
Under UK data protection law (UK GDPR and the Data Protection Act 2018) we rely on the following legal bases:
- Contract. Providing the service you signed up for: your account, generating your updates, storing your history, and taking payment for paid plans.
- Legitimate interests. Understanding how the site is used, keeping the service secure, preventing abuse, and improving the product.
- Consent. Sending you the newsletter. You can withdraw consent at any time by unsubscribing.
Who we share data with
We do not sell personal data. We share it only with the service providers we need to run BoardBrief, and only for the purposes below:
Runs our database and authentication. Stores your account details, your saved updates, and any branding settings, and sends the magic link emails you use to sign in.
Provides the Claude AI model that drafts the narrative in your updates. The metrics and notes you submit are sent to Anthropic only so your brief can be generated.
Processes subscription payments. Your card details go directly to Stripe and never touch our servers. We store only a Stripe customer reference and your subscription status.
We use Google Analytics 4 to understand how the site is used (pages viewed, approximate location, device and browser type). This relies on analytics cookies.
Hosts the site and processes submissions from our contact form and newsletter signup. Like any host, it keeps standard server logs that include IP addresses.
We may also disclose data where the law requires it, for example in response to a valid legal request.
International transfers
Some of the providers listed above process data outside the UK, including in the United States. Where that happens, transfers are protected by appropriate safeguards such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses with the UK addendum.
How long we keep data
- Account information and saved updates are kept for as long as your account is active. Plan limits may restrict how much history is visible on the free plan.
- If you try the product without an account, that anonymous demo data expires automatically after about two hours.
- Newsletter emails are kept until you unsubscribe.
- If you ask us to delete your account, we delete the personal data and content linked to it, except for records we must keep for legal or accounting reasons (for example invoices).
Your rights
Under UK GDPR you have the following rights over your personal data:
Ask for a copy of the personal data we hold about you.
Ask us to fix personal data that is inaccurate or incomplete.
Ask us to delete your account and the personal data and content linked to it.
Ask us to limit how we process your data while a concern is resolved.
Ask for the data you gave us in a portable, machine readable format.
Object to processing we carry out on the basis of legitimate interests.
To exercise any of these rights, contact us through the contact page and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.
Cookies
We use essential cookies to keep you signed in to your account, and Google Analytics cookies to measure site usage as described above. You can block or delete cookies in your browser settings; blocking essential cookies will prevent sign in from working.
Changes to this policy
If we change this policy, we will post the new version on this page and update the date at the top. If a change materially affects how we handle your data, we will take reasonable steps to bring it to your attention.