Privacy Policy

Last updated: 19 September 2026

This policy describes how BoardVault handles personal data for directors and board workspaces. Formal legal entity details and counsel review will be updated on the site before a general public launch.

Who we are

BoardVault (“we”, “us”) provides a workspace for directors and the organisations they serve. For organisation (entity) workspaces, the organisation is the controller of board materials and we act as a processor. For a director’s personal workspace, that director is the controller of their own notes, annotations, action history and decision log.

Privacy requests: privacy@myboardvault.com.

What we collect

• Account details — name, email address, password or sign-in via a connected identity provider, and optional authenticator credentials.
• Workspace content — documents, minutes, agendas, comments, actions, decisions, interests declarations and similar governance records that you or your organisation upload.
• Usage that keeps the service honest — sign-in times, which papers were opened, and an audit trail of sensitive actions. We use this so boards can see who has prepared, and so access can be investigated if something goes wrong.
• Device basics — browser type, approximate time zone, and similar technical data needed to run the site and keep sessions secure.

We do not sell personal data. We do not use board papers to train general-purpose AI models.

How we use it

• To provide the workspace you signed up for, including multi-board calendars, committee rooms and search.
• To send transactional email you have asked for (invites, published packs, action reminders, digests you opted into).
• To keep accounts secure, prevent abuse, and meet legal obligations.
• Where AI features are enabled for an organisation, to retrieve and summarise that organisation’s own papers so a director can ask a question of the record. You can switch those features off.

Legal bases

Where UK GDPR / EU GDPR applies, we rely on: performance of a contract (providing the service); legitimate interests (security, product improvement that does not involve reading your papers for advertising); consent where we ask for it (for example optional marketing, which we do not currently send); and legal obligation where the law requires us to retain or disclose information.

Sharing

We share data only as needed to run BoardVault:

• People in your workspace, according to the roles and committee memberships your organisation sets.
• Sub-processors who host the application, store files, send email, or (if configured by you) provide identity sign-in or AI inference. They may only use the data to provide that service to us.
• Professional advisers or authorities if the law requires it, or to protect rights, safety and the integrity of the service.

If a director links a personal workspace to an organisation, organisation papers remain the organisation’s. The director’s own layer (notes, annotations, their action history) stays with the director if the directorship ends.

International transfers

Your data may be processed in the United Kingdom, the European Economic Area, or other countries where our sub-processors operate. Where we transfer personal data out of the UK/EEA we will use an appropriate safeguard such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

How long we keep it

Account data is kept while the account is open. Organisation workspaces follow the retention period the organisation sets, or until the organisation asks us to delete the workspace. A director’s personal workspace remains until they delete it. Backup copies may persist for a short period after deletion. Audit records may be kept longer where we have a legitimate need to investigate access.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Organisation-controlled board papers are handled through that organisation. To exercise rights over your account or personal workspace, email privacy@myboardvault.com. You may also complain to the ICO (UK) or your local supervisory authority.

Children

BoardVault is for adult directors, trustees and governance professionals. It is not directed at children.

Cookies

We use essential cookies to keep you signed in and to protect forms against misuse. We do not use advertising cookies.

Changes

We will update this page when the policy changes and revise the date above. Material changes will be notified in-product or by email where we have an account to write to.