Privacy Policy

BoardReporter is operated by Network Problems, LLC (“BoardReporter,” “we,” “us,” or “our”), which provides a board-governance portal that helps nonprofits and small organizations run meetings, build packets, and turn recordings into human-reviewed draft minutes. This Privacy Policy explains what information we collect, how we use and protect it, who processes it on our behalf, how long we keep it, and the choices you have. It applies to our website and application (the “Service”).

We designed BoardReporter around a simple principle: your board’s records belong to your board. We collect only what we need to run the Service, and we protect it with the safeguards described below and in our Security & data protection overview.

Information we collect

Information you provide

• Account information — your name, email address, a securely hashed password, and, if you enable two-factor authentication, your authenticator secret and hashed recovery codes.
• Board and governance content — organizations, memberships, roles and officer titles, meetings, agendas, packets, RSVPs and attendance, motions, votes and written consents, action items, resolutions, minutes and their versions, comments, conflict-of-interest disclosures, and documents you upload or email in.
• Meeting audio and transcripts — audio you record in the browser or upload is transcribed and then deleted. We retain the resulting text transcript; the audio is not stored after transcription completes.
• Communications — messages you send us for support, privacy, or other inquiries.

Information collected automatically

• Usage and log data — IP address, browser type, pages requested, and actions taken in the Service (for example, who approved a set of minutes), used to operate, secure, and improve the Service and to keep the audit trail your board relies on.
• Email events — delivery, bounce, and complaint signals from our email provider so we stop sending to addresses that cannot receive mail.

Payment information

Payments are processed by Stripe. We do not collect or store your full card number; we keep only Stripe’s customer and subscription identifiers, the plan you chose, and its status.

Cookies and analytics

We use one strictly necessary, secure, HTTP-only session cookie to keep you signed in, plus short-lived cookies during sign-in to protect against cross-site request forgery and return you to the page you asked for, and a small preference cookie that remembers when you dismiss a trial notice. Website analytics (Vercel Analytics) are aggregated and cookieless; they do not identify you or follow you across sites.

To measure whether our advertising works, our public pages only (the home page, sign-up, help, status, and these policies) load the Google Ads conversion tag (gtag.js), which may set Google advertising cookies (such as _gcl_au) and sends Google the address of the public page you visited, your IP address, and browser information. A single “sign-up” conversion event fires once when an account is created. The tag is never loaded on signed-in pages, so no board, meeting, document, or account information reaches Google, and we do not use it for remarketing. You can block it with a content blocker or by turning off ad personalization in your Google account, and the Service works fully without it.

How we use information

• Provide, maintain, and secure the Service and your board’s account.
• Transcribe recordings, draft minutes, classify documents, index content for search, and answer Assistant questions — always for a human to review.
• Send transactional messages such as invitations, verification links, meeting reminders, packet and task notifications, consent requests, digests, and account or billing notices. You control non-essential notifications in settings.
• Process subscriptions and prevent fraud and abuse.
• Understand aggregate, non-identifying usage to improve the product.

We do not sell your personal information, and we do not use your board’s content to train AI models.

Sub-processors

We share information only with the service providers below, each bound by contract to protect it and to use it solely to provide their service to us:

• Vercel, Inc. — application hosting, edge network, cookieless analytics, and private file storage (Vercel Blob) for documents, packets, exports, and audio while it is being transcribed. United States.
• Neon, Inc. — managed PostgreSQL database holding account and governance records, transcripts, and search embeddings. United States.
• Stripe, Inc. — subscription billing, payments, invoices, and the billing portal.
• Resend, Inc. — sending transactional email, receiving email-in documents, and reporting delivery events.
• OpenAI, L.L.C. — transcription (Whisper), minutes drafting, document classification, text recovery from scanned PDFs (OCR), embeddings for search, and Assistant answers. Audio, transcripts, and the document text or page images needed for a feature are sent to OpenAI’s API for processing when you use that feature. Under OpenAI’s API terms, content sent through the API is not used to train OpenAI’s models and is retained by OpenAI only for abuse monitoring for a limited period.
• Sentry (Functional Software, Inc.) — error reporting. We configure it not to send request bodies, documents, or personal details beyond an internal user id.
• Google LLC — advertising conversion measurement on public pages only (the Google Ads tag described under Cookies). Receives public page addresses and device information; never board content or account details.

We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a merger or acquisition (subject to this Policy). We will notify board owners of a change in sub-processors by email or in the Service.

Data isolation and access

Each board’s data is logically isolated, and access within a board is limited by role (owner, officer, staff, guest) with committee chairs scoped to their committee. Closed-session meetings and documents are hidden from guests and excluded from search, the Assistant index, and cross-board views. Our staff do not read your board’s content except when a board owner asks us to for support, and every time a staff account opens a board it is not a member of, that access is written to the board’s audit log.

Data retention

• Audio — deleted as soon as transcription completes.
• Transcripts, documents, minutes, and other governance records — kept until your board deletes them or deletes the board, so they remain available as the organization’s minute book. Approved and locked minutes stay tamper-evident until the board is deleted.
• Account data — kept while your account exists. When you delete your account or a board, it enters a 30-day hold during which you can reverse the deletion; after that it is permanently erased.
• Audit logs — retained for 7 years to preserve the integrity of the governance record. When an account is deleted, the actor on its log entries is reduced to an internal id; the entries themselves (action, time, and details such as a file name) are kept.
• Backups — encrypted database backups and point-in-time history are kept for up to 30 days and then roll off.
• We may retain information longer where required by law or to resolve disputes.

Your rights and choices

You can update your name, email, password, and notification preferences in Settings. Board owners can export the whole board (documents, minutes, and metadata as a ZIP) and delete the board from board settings; anyone can delete their own account from Settings. Both deletions start the 30-day hold described above. You may also ask us to access, correct, or delete your personal information, or to object to or restrict its processing, by emailing privacy@boardreporter.com. We verify requests through the email address on the account. Some records may be retained where required by law or to preserve an organization’s governance record; in that case we will tell you.

Depending on where you live (for example, the EU/EEA, the UK, or California), you may have additional rights, including the right to lodge a complaint with a supervisory authority. We honor those rights regardless of location. A data processing addendum is available to boards that need one — see our Terms of Use.

Security

We protect information with encryption in transit (HTTPS with HSTS) and at rest, bcrypt-hashed passwords, optional two-factor authentication, rate-limited authentication, private document storage served only through short-lived authorized links, role-based access enforced by a single policy module on every request, strict browser security headers, and an append-only audit trail for sensitive actions. Access to production systems is limited to named staff with two-factor authentication. No system is perfectly secure; if we learn of a breach affecting your data we will notify affected board owners without undue delay.

International transfers

We are based in the United States and our sub-processors store data there. If you use the Service from outside the United States, your information is transferred to and processed in the United States under appropriate safeguards.

Children’s privacy

The Service is intended for organizational and business use and is not directed to children under 13. We do not knowingly collect personal information from children.

Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and notify board owners by email or in the Service.

Contact us

Questions about this Policy or your data? Email privacy@boardreporter.com. For anything else, write to support@boardreporter.com.