Privacy Policy

1. Data controller

CalmBoard is the controller of the personal data processed in the CalmBoard product. For privacy requests, contact us at privacy@calmboard.com.

2. Data we collect

• Account data: email address, name (if provided), and authentication details.
• Workspace data: projects, tasks, sprints, comments, and attachments you submit.
• Usage data: timestamps, feature usage, and performance diagnostics.
• Billing data (if applicable): plan type, invoice details, and payment metadata handled by processors.

3. Legal bases

• Contract: to provide and maintain the service you request.
• Legitimate interests: to secure, improve, and analyze the service.
• Consent: when you opt in to specific communications or features.

4. How we use data

• Provide, operate, and maintain CalmBoard.
• Personalize features, including AI insights within your project scope.
• Monitor security, prevent fraud, and enforce terms.
• Communicate service updates and support responses.

5. Data sharing

Optional Google Analytics measures usage, activation and subscription steps only when enabled. It uses a random installation identifier, not your email or project content. Identifiers are pseudonymous, and the service can associate consent with your signed-in account to report verified subscription changes. We do not enable advertising identifiers or Google Signals for these events. You can withdraw via Analytics preferences on the website or Share usage analytics in the apps. Withdrawal stops future collection; it cannot recall events already exported. Offline withdrawal is retried when the app reconnects or returns to the foreground, or when the website reloads/goes online; server-side consent expires after 24 hours without refresh.

We share data only with vetted processors (e.g., hosting, analytics, email providers) under data processing agreements. We do not sell personal data.

Native AI features ask your permission before sending prompts and relevant task/board context to the named AI provider. You can revoke this permission in AI Settings. Optional custom OpenAI keys are stored in your device Keychain and transmitted through CalmBoard over HTTPS only for requests, without server-side key storage. Prompts and keys are not sent to analytics. Custom-provider charges remain your responsibility. Chat history is kept in app memory for the current board; server AI processing and audit records follow the service's retention policy.

6. International transfers

If data is transferred outside the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses.

7. Data retention

We retain data for as long as your account is active or as needed to provide the service. You can request deletion at any time.

8. Your rights

• Access, rectify, or erase your data.
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.
• Complain to a supervisory authority.

9. Security

We use industry-standard security measures to protect data. No system is 100% secure, but we continuously improve safeguards.

10. Contact

For questions or requests, email daniel@calmboard.ai.