GDPR Policy
Last updated: October 11, 2026
1. Data controller
The data controller is Company LLC, 123 Main Street, City, State ZIP.
2. Purposes and legal bases
- Providing the Service (account, Boardroom, projects, tasks, expenses), performance of a contract.
- Billing and subscription management, performance of a contract / legal obligation.
- Security, fraud prevention and service reliability, legitimate interest.
- Support communications you initiate, legitimate interest / consent.
- Non-essential cookies, if any are ever enabled, consent (see our Cookie Policy).
3. Categories of data
Account details (name, email), workspace content you enter (messages, projects, tasks, expenses, uploaded files), billing data (handled by our payment processor once enabled), and technical/log data needed to operate the Service.
4. Retention
Placeholder, to be confirmed: account and workspace data is kept for as long as your account is active, plus a limited period afterwards to comply with legal and accounting obligations, after which it is deleted or anonymized.
5. Sub-processors
We use the following sub-processors to run the Service. No Google Fonts are used, fonts are self-hosted.
| Sub-processor | What it does | Data involved |
|---|---|---|
| Lovable Cloud (Supabase) | Database, authentication, file storage | Account data, workspace content, uploaded files |
| Cloudflare | Application hosting and edge network | Request/traffic metadata |
| Lovable AI Gateway → AI model providers (e.g. OpenAI) | Generates Boardroom and SOP responses; an optional web-search tool may be used to ground answers | Your messages and the business context you provide |
| Stripe | Payment processing, not yet enabled | N/A until billing goes live |
6. International transfers
Some sub-processors may process data outside your country, including outside the European Economic Area. Where this happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) or an equivalent legal mechanism.
7. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, object to, and port your personal data. You can export your data or delete your account at any time from Settings › Privacy & data ("Export my data" / "Delete my account"), or contact us at privacy@example.com.
8. Complaints
You can lodge a complaint with your local supervisory authority, including Name of the applicable data protection supervisory authority.
9. No sale of data
We do not sell your personal data.
10. Age
The Service is intended for users who are at least 18 years old.
11. More information
See also our Privacy Policy and Cookie Policy.