Privacy Policy

1. Scope and xBoard’s Privacy Roles

This Policy applies to Personal Information processed through the Services, including information associated with visitors, Account Owners, Organization Admins, Team Members, Customer Contacts, and other people who interact with xBoard.

When xBoard decides how information is used

xBoard determines how Personal Information is processed for personal Accounts, website visits, account registration, billing, security, support, product operations, analytics, and xBoard’s own business activities. In those situations, xBoard acts as the business, controller, or organization responsible for the information, depending on the law that applies.

When an Organization controls the information

When an Organization uses xBoard to process Personal Information contained in Organization Content, the Organization generally decides why and how that information is used. xBoard processes the information on the Organization’s behalf and acts as a service provider or processor where applicable. That processing is governed by the DPA. Under the DPA, the Organization acts as the controller, business, or equivalent role, and xBoard acts as the processor, service provider, contractor, or equivalent role under applicable privacy law.

The Organization is responsible for collecting and using Organization Content lawfully, providing required notices, obtaining required permissions or consent, and responding to requests concerning information it controls. A privacy request about Organization Content may need to be directed to that Organization.

Information outside this Policy

This Policy does not govern information handled independently by another user, an Organization, a third-party website, or a service that is not controlled by xBoard. Their own privacy policies and practices apply.

Back to contents

2. Key Definitions

• “Personal Information” means information that identifies, relates to, describes, or can reasonably be linked with an identifiable individual. It may also be called personal data or personal information under applicable law.
• “Account” means an individual user’s login and access to xBoard.
• “Organization” means a business, nonprofit, franchise, team, or other entity using a Team plan or Organization features.
• “Organization Admin” means someone authorized to manage an Organization, including members, permissions, billing, and Organization-owned Boards.
• “Content” means information, files, photos, audio, video, notes, Direct Messages, Posts, Things, tasks, links, comments, replies, emoji reactions, metadata, and other material submitted to or created through the Services.
• “Organization Content” means Content in an Organization-owned Board or otherwise identified as controlled by an Organization.
• “Direct Message” means a private message or conversation between selected xBoard users.
• “Smart Tagging” means the optional feature that analyzes eligible Content and suggests tags, descriptions, or related organizational information.
• “Service Provider” or “Subprocessor” means a third party that processes Personal Information on xBoard’s behalf under a written agreement that restricts use to specified purposes and requires confidentiality and security protections.

Capitalized terms not defined in this Policy have the meanings given to them in the Terms of Use.

Back to contents

3. Personal Information We Collect

The information xBoard processes depends on how you use the Services, the features you enable, your relationship with an Organization, and the information you or others choose to provide.

Account and profile information

• Name, email address, authentication information, profile image, language, preferences, Account settings, plan, and subscription status.
• Organization membership, roles, permissions, invitations, and administrative activity.

Content and collaboration information

• Boards, Posts, Things, files, photos, video, audio, notes, links, tasks, comments, tags, Direct Messages, attachments, and related metadata.
• Information about Board ownership, visibility, membership, permissions, sharing, exports, edits, and activity history.
• Information that other users, Organization Admins, customers, partners, or invitees provide about you or share with you through the Services.
• Comments, replies, emoji reactions, the identity of the user who added them, the Thing, Post, or Board they relate to, timestamps, edits, and related activity metadata.

Payment and transaction information

• Billing contact information, subscription and renewal details, payment status, transaction identifiers, invoices, refunds, and limited payment-method information received from our payment processor.

Stripe processes payment-card information on our behalf. xBoard does not receive or store full payment-card numbers or security codes.

Usage, device, and security information

• IP address and approximate location (city or region level) derived from IP address, browser, operating system, device type, language, session identifiers, referring page, pages and features used, timestamps, clicks, error information, and diagnostic data.
• Login activity, authentication events, permission changes, security alerts, audit records, rate-limit information, and information used to detect fraud, abuse, or unauthorized access.

Support, communications, and feedback

• Support requests, emails, feedback, bug reports, diagnostic files, and other information you provide when communicating with xBoard.

Smart Tagging information

• Eligible Content submitted to Smart Tagging, the instructions needed to process it, and generated tags, descriptions, summaries, or related metadata.

Information from integrations and service providers

• Information received from payment processors, authentication providers, analytics and diagnostics providers, integrations you enable, and other service providers supporting the Services.

Sensitive information in user Content

xBoard does not require biometric identifiers, government-issued identification numbers, precise geolocation, health information, or other highly sensitive Personal Information for ordinary Account registration. Users may nevertheless include sensitive information in Content they submit. Do not upload regulated, restricted, or highly sensitive information unless xBoard has expressly agreed in writing to support that type of information.

Back to contents

4. How We Collect Personal Information

• Directly from you when you create or update an Account, subscribe, upload Content, use features, contact support, or communicate with us.
• Automatically from your browser, device, and use of the Services through logs, cookies, local storage, analytics, diagnostics, and security technologies.
• From other users or Organizations when they invite you, add you to a Board, assign permissions, communicate with you, or submit information about you.
• From service providers and integrations, including payment, hosting, storage, database, analytics, error-monitoring, authentication, email, and Smart Tagging providers.

xBoard does not purchase Personal Information from data brokers or collect information from advertising networks for targeted advertising.

Back to contents

5. How We Use Personal Information

We use Personal Information only for purposes reasonably necessary and proportionate to operate xBoard, meet our obligations, protect the Services, and comply with law. These purposes include:

• Providing, maintaining, and improving the Services and requested features.
• Creating and administering Accounts, Organizations, Boards, permissions, and subscriptions.
• Processing payments, renewals, invoices, refunds, taxes, and billing communications.
• Authenticating users and preventing unauthorized access, fraud, abuse, spam, malware, and security threats.
• Providing customer support, investigating technical problems, and communicating about the Services.
• Sending operational messages such as security alerts, invitations, service notices, billing notices, and changes to legal documents.
• Sending optional product or marketing communications (such as email or in-app notifications) where permitted. You may unsubscribe from non-essential email using the unsubscribe link or by contacting us.
• Understanding feature use, reliability, performance, and user experience through analytics and diagnostics.
• Providing Smart Tagging when a user enables or requests it.
• Enforcing the Terms of Use, protecting users and xBoard, resolving disputes, and complying with legal obligations.
• Supporting a financing, merger, reorganization, or other change involving xBoard’s business, subject to appropriate confidentiality and legal protections.

We do not use Personal Information for third-party advertising or cross-context behavioral advertising. We do not use Content to train general-purpose or third-party machine-learning models unless the user expressly agrees through a separate opt-in process.

Back to contents

6. How We Disclose Personal Information

xBoard does not sell Personal Information or share Personal Information for cross-context behavioral advertising. We disclose information only as described below.

At your direction or through permissions

We disclose Content and Account information to other users when you invite them, join an Organization, send a Direct Message, make a Board visible to others, use a sharing feature, or otherwise direct xBoard to disclose it.

To Organizations and Organization Admins

Organization Admins may receive information needed to manage membership, permissions, billing, Organization-owned Boards, and Organization Content. Admin access does not automatically extend to a user’s Personal Boards, Personal Content, or Direct Messages unless the user intentionally shares the information or the Admin is a participant in the conversation.

To service providers and subprocessors

We use service providers to host, store, secure, operate, monitor, support, analyze, and process payments for the Services. They may process Personal Information only for assigned purposes and under contractual confidentiality, security, and use restrictions.

Depending on the feature and current infrastructure, providers may include Amazon Web Services for cloud infrastructure, MongoDB Atlas for managed database services, Wasabi for object storage, Stripe for payment processing, Sentry for error monitoring and diagnostics, Google Analytics for usage analytics, and providers supporting email delivery, authentication, customer support, or optional Smart Tagging.

A current list of material subprocessors is available by contacting privacy@xboard.com. Where required by law or contract, xBoard will provide notice of material subprocessor changes. Where the DPA applies, subprocessor authorization, notice of material changes, and any applicable objection rights are governed by the DPA. Some service providers may process information in multiple regions depending on their infrastructure, and xBoard selects regions designed to support reliability and compliance.

For legal, security, and safety reasons

We may disclose Personal Information when we reasonably believe disclosure is necessary to comply with law or valid legal process; enforce agreements; investigate fraud, abuse, infringement, or security incidents; protect users, xBoard, or others; or prevent serious harm. We may challenge requests that appear unlawful or overly broad when reasonably possible.

Corporate Changes

If xBoard undergoes a financing, merger, reorganization, or other change involving its business, Personal Information may be reviewed or transferred as reasonably necessary for that process. Any disclosure or transfer will be subject to applicable privacy law and appropriate confidentiality and security protections.

Back to contents

7. Boards, Organizations, Comments, Reactions, and Direct Messages

Personal and Organization Content

Personal Boards and Personal Content are separate from Organization Content. An Organization does not gain access to a user’s Personal Boards simply because the user belongs to the Organization or shares one Board with it. Content placed in an Organization-owned Board is controlled by the Organization and may remain available to it after a user leaves or loses access. Organization Admins may export Organization-owned Boards and Organization Content where the feature is available.

Board visibility and sharing

When a user invites someone to a Board, changes Board visibility, or shares Content, authorized users may be able to view, download, copy, screenshot, export, or further share that Content. A Board marked Public is visible only to signed-in xBoard users. It is not available to the general public and is not intended to be accessible through public search engines.

xBoard cannot control copies that another user saves outside the Services. Review permissions before sharing confidential, regulated, or sensitive information.

Direct Messages

Direct Messages are intended only for the people included in the conversation. Being an Organization Admin does not give an Admin access to a Direct Message unless the Admin is a participant.

A sender may edit or delete a Direct Message for up to six hours after sending it. When a message is deleted, xBoard removes the message content and any attachments stored only with that message for everyone in the conversation. Attachments saved or copied elsewhere by participants are not removed. A notice stating “This message was deleted” remains. xBoard may retain limited audit information, such as the sender, conversation, original timestamp, and deletion timestamp, but not the deleted message content.

After six hours, the sender can no longer edit or delete the message. It remains part of the conversation history for as long as that conversation is retained. Leaving an Organization or closing an Account does not remove the message from another participant’s conversation history.

While a Direct Message remains in xBoard, authorized xBoard personnel may access or disclose it when reasonably necessary to provide support, investigate abuse or security issues, enforce agreements, comply with law, or protect users and the Services. Recipients may save messages or attachments outside xBoard before deletion, and xBoard cannot remove those external copies.

Comments, Replies, and Reactions

Users who can view a Thing may be able to see comments, replies, and emoji reactions attached to it, including the name or profile information of the person who added the interaction.

These interactions are shared Board activity, not private Direct Messages. Their visibility follows the permissions of the Thing, Post, and Board where they appear.

If an interaction is added to an Organization-owned Board, the Organization and its authorized users may access and manage it as Organization Content. Leaving the Board or Organization does not automatically remove interactions previously added to Content controlled by another user or Organization.

xBoard uses interaction information to display collaboration activity, send notifications, maintain activity history, enforce permissions, provide support, investigate abuse or security concerns, and operate the Services.

Back to contents

8. Cookies, Analytics, and Online Tracking

Cookies and similar technologies

xBoard uses cookies, local storage, and similar technologies for authentication, account preferences, security, service operation, diagnostics, and, where enabled, analytics. Some technologies are provided by service providers acting on xBoard’s behalf.

Essential technologies are needed for secure login and core functionality. Blocking them may prevent parts of the Services from working. Where applicable law requires consent for non-essential analytics or similar technologies, xBoard will request consent before activating them.

Analytics and diagnostics

xBoard may use services such as Google Analytics and Sentry to understand use, diagnose errors, monitor performance, and improve reliability. These providers may receive technical information such as IP address, device and browser information, page or feature activity, timestamps, and error details. They are not permitted to use xBoard data for their own targeted advertising.

No advertising tracking

xBoard does not use advertising cookies, marketing pixels, or cross-site tracking technologies to build advertising profiles or deliver targeted advertisements. We do not permit third parties to collect Personal Information through xBoard across unaffiliated websites for their own advertising purposes.

Do Not Track and browser privacy signals

Some browsers send Do Not Track or Global Privacy Control signals. Because xBoard does not sell Personal Information or share it for cross-context behavioral advertising, these signals do not currently change our practices. If our practices change in a way that requires honoring a legally recognized signal, we will do so as required by law.

Back to contents

9. Smart Tagging and Automated Processing

Smart Tagging is optional. When enabled, xBoard and its service providers may analyze eligible Content and suggest tags, descriptions, summaries, or other organizational information. Smart Tagging inputs and outputs are treated as Content and Personal Information when they identify or relate to an individual.

Suggestions may be incomplete, inaccurate, or inappropriate. Users are responsible for reviewing them before relying on them. Smart Tagging does not change Board permissions or grant access to Content that a user could not otherwise view.

Neither xBoard nor its service providers use Content submitted to Smart Tagging to train general-purpose or third-party machine-learning models. xBoard will not use Content for machine-learning model training unless the user expressly agrees through a separate opt-in process. Smart Tagging may generate temporary processing data needed to provide the feature. That information is handled according to this Policy and xBoard’s applicable retention and deletion procedures.

xBoard does not use Smart Tagging to make decisions that produce legal or similarly significant effects about individuals. If xBoard later uses exclusively automated processing for a decision where applicable law gives additional rights, we will provide required notice, information, correction options, and an opportunity for human review.

Back to contents

10. Retention, Deletion, and Backups

We retain Personal Information only as long as reasonably necessary for the purposes described in this Policy, including operating the Services, maintaining Accounts, meeting contractual commitments, protecting security, resolving disputes, and complying with tax, accounting, legal, and regulatory requirements.

Expired trials and paid plans

If a trial or paid plan expires, xBoard retains the related Content for 90 days so the Account can be reactivated or the Content recovered. After 90 days, xBoard may permanently delete the Content unless a longer retention period is required for legal, security, billing, dispute, or fraud-prevention purposes.

Closed Accounts

When an Account is closed, xBoard begins deleting or deactivating Personal Information that is no longer needed. Some information may remain with another user or Organization, including Content contributed to an Organization-owned Board and Direct Messages retained in another participant’s conversation history.

Deleted Content and recovery

When Content is deleted, xBoard removes or deactivates it from active systems according to its retention procedures. We do not guarantee that deleted Content can be recovered. If xBoard provides a trash or recovery period, the Services will show how long the Content remains recoverable. After that period ends, the Content may be permanently deleted and may no longer be recoverable.

Direct Messages

Deleted Direct Message content and message-only attachments are removed as described in Section 7. Limited audit metadata may be retained for security, legal, or integrity purposes. Messages that can no longer be deleted by the sender remain for as long as the applicable conversation is retained. Audit metadata associated with Direct Messages (such as sender, timestamps, and deletion logs) is retained only for the period reasonably necessary for security, integrity, and legal compliance.

Comments, Replies, and Reactions

Comments, replies, and emoji reactions are normally retained with the Thing, Post, or Board where they were added. Deleting or removing the underlying Content may also remove the related interactions, subject to applicable recovery periods, backups, legal holds, and security requirements.

Business, billing, and security records

Billing, tax, transaction, legal, support, and security records may be retained for periods required or reasonably necessary for accounting, compliance, fraud prevention, dispute resolution, and protection of the Services.

Backups

Residual copies may remain temporarily in backups (typically for limited periods consistent with xBoard’s backup schedules), logs, legal holds, security records, or disaster-recovery systems until they are deleted, overwritten, or no longer needed in the ordinary course. Backups remain subject to applicable security protections and are not restored to active systems except when reasonably needed for disaster recovery, service restoration, security, or legal compliance.

De-identified and aggregated information

Where permitted by law, xBoard may retain and use information that has been aggregated or de-identified so that it cannot reasonably identify an individual. We do not attempt to re-identify de-identified information except to test whether de-identification measures are effective or as otherwise permitted by law.

Back to contents

11. Security and Confidentiality Incidents

xBoard uses commercially reasonable administrative, technical, and organizational safeguards designed to protect Personal Information. These safeguards may include encryption in transit and at rest, access controls, authentication protections, logging, monitoring, backup and recovery procedures, restrictions on production access, and contractual requirements for service providers.

Any statement about certifications, audits, or compliance frameworks applies only when expressly stated in current xBoard security documentation.

No security measure can guarantee complete protection against unauthorized access, loss, misuse, or alteration. Users are responsible for protecting their credentials and devices, setting appropriate permissions, and promptly reporting suspected unauthorized access to security@xboard.com.

If xBoard discovers a confidentiality or security incident involving Personal Information, we will investigate, contain, remediate, document, and provide notices to affected individuals or authorities when required by law. We may preserve relevant information to investigate the incident and meet legal obligations.

Back to contents

12. International Processing and Data Location

xBoard is based in the United States. xBoard and its service providers may process Personal Information in the United States and other jurisdictions where they operate. Privacy laws in those jurisdictions may differ from the laws where the individual lives.

We use contractual, technical, and organizational safeguards appropriate to the information and the processing. When Quebec law applies, xBoard will complete the required privacy impact assessment before communicating Personal Information outside Quebec and will use a written agreement or other safeguards required by law.

Where the DPA applies, international processing of Organization Content is also governed by the DPA and applicable privacy law.

The location of particular information may depend on the feature, service provider, backup process, and Organization agreement. Unless xBoard agrees otherwise in writing, the Services do not guarantee that Personal Information will remain in a particular state, province, or country. Unless otherwise agreed in writing, xBoard does not guarantee region-specific hosting or data residency for particular Accounts or Organizations.

Back to contents

13. Privacy Rights and Requests

Depending on where you live and the circumstances of the processing, you may have the right to:

• Request access to Personal Information and information about how it is collected, used, and disclosed.
• Request correction of inaccurate or incomplete Personal Information.
• Request deletion of Personal Information, subject to legal and operational exceptions.
• Request a portable copy of certain Personal Information where applicable.
• Withdraw consent where processing depends on consent. Withdrawal does not affect processing already completed lawfully.
• Object to or restrict certain processing where applicable.
• Submit a complaint or appeal a decision where applicable law provides that right.

A summary of privacy rights by region is provided below:

• Certain U.S. states, including California where applicable: access, correction, deletion, portability, and processing disclosures.
• Canada: access, correction, withdrawal of consent, and information about service providers outside Canada.
• Quebec: access, correction, cessation of dissemination, de-indexing, re-indexing, and structured format rights.
• Other regions: rights vary by applicable law.

How to submit a request

Email privacy@xboard.com or mail the request to the address in Section 18. Describe the request and identify the Account, Organization, or information involved. We will respond within the period required by applicable law.

Verification and authorized agents

We may ask for information that is reasonably necessary to verify identity, authority, and the scope of the request. Verification information is used only for verification, security, and legal compliance. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and may verify the request directly with the individual.

Organization Content

If a request concerns Organization Content, xBoard may refer the requester to the Organization that controls the information or assist the Organization as required by law or an applicable DPA.

Legal exceptions and non-discrimination

Privacy rights are subject to legal exceptions. For example, we may retain information needed for security, fraud prevention, legal claims, tax records, or another lawful purpose. xBoard will not unlawfully discriminate against an individual for exercising a privacy right.

Back to contents

14. Canada and Quebec Disclosures

Canadian residents

Canadian residents may request access to or correction of Personal Information and may withdraw consent where processing depends on consent, subject to legal exceptions. They may also request information about service providers located outside Canada. Unresolved concerns may be submitted to the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority.

Person responsible for privacy in Quebec

For Quebec privacy matters, the person responsible for the protection of Personal Information is xBoard’s Privacy Officer. Contact: privacy@xboard.com; xBoard, LLC, 2123 Old Spartanburg Rd., #200, Greer, SC 29650.

Quebec rights

Where Quebec law applies, individuals may have rights to access and correct Personal Information, withdraw consent, receive certain information in a structured and commonly used technological format, and request cessation of dissemination or de-indexing or re-indexing in qualifying circumstances. Requests and privacy complaints may be sent to the Privacy Officer.

If a Quebec resident is not satisfied with xBoard’s response, the resident may contact the Commission d’accès à l’information du Québec.

Technology, profiling, and automated decisions

If xBoard uses technology that includes functions allowing identification, location, or profiling and Quebec law requires user activation, xBoard will provide the required notice and means to activate those functions. If a decision is based exclusively on automated processing, xBoard will provide the information and human-review opportunity required by law.

Processing outside Quebec

Before communicating Personal Information outside Quebec where Quebec law applies, xBoard will conduct the required privacy impact assessment and use contractual or other safeguards appropriate to the identified risks.

French version

xBoard will make a French version of this Policy available to Quebec users. Where applicable law requires additional French-language notices at the point of collection, xBoard will provide them.

Back to contents

15. California Disclosures

This section applies when xBoard is subject to the California Consumer Privacy Act ("CCPA") for a particular processing activity. xBoard may also choose to honor certain California requests voluntarily when the CCPA does not require it.

Categories collected during the preceding 12 months

The categories of Personal Information described in Section 3 may include identifiers; customer-record information; commercial and transaction information; internet or other electronic network activity; approximate location derived from IP address; audio, visual, and other user-submitted Content; professional or employment information users provide; account preferences and inferences; communications; and limited sensitive Personal Information that a user includes in Content.

Sources, purposes, and recipients

The sources are described in Section 4, the purposes are described in Section 5, and the categories of recipients are described in Sections 6 and 7. xBoard may disclose these categories to service providers, Organization Admins, other users at the individual’s direction, professional advisers, transaction participants, or government and legal recipients as described in this Policy.

No sale or advertising-related sharing

xBoard has not sold Personal Information or shared it for cross-context behavioral advertising during the preceding 12 months. xBoard does not knowingly sell or share Personal Information of individuals under 16 for those purposes. Because xBoard does not engage in those practices, it does not provide a “Do Not Sell or Share” link.

Sensitive Personal Information

xBoard does not use or disclose sensitive Personal Information for purposes that require a California right to limit its use or disclosure. Users should not place sensitive information in Content unless appropriate and legally permitted.

California rights

Subject to verification and legal exceptions, California residents may have rights to know, access, delete, or correct Personal Information and to receive information about xBoard’s collection, use, and disclosure practices. They also have rights to opt out of sale or advertising-related sharing and to limit certain uses of sensitive Personal Information, but xBoard does not currently engage in the practices that trigger those opt-out rights.

California residents may submit requests through privacy@xboard.com or the mailing address in Section 18. xBoard will not discriminate against a resident for exercising a CCPA right.

California online tracking disclosure

xBoard’s response to Do Not Track and other browser signals is described in Section 8. Third parties are not permitted to collect Personal Information through xBoard across unaffiliated services for their own targeted advertising.

Back to contents

16. Children’s Privacy

The Services are not intended for anyone under 18, and users must be at least 18 to create an Account. xBoard does not knowingly collect Personal Information directly from children under 13. If we learn that we collected Personal Information directly from a child under 13, we will take reasonable steps to delete it as required by law.

An Organization or adult user may place information about a minor in Content. The Organization or user is responsible for having the legal authority and required consent to submit and use that information.

Back to contents

17. Changes to This Policy

We may update this Policy to reflect changes in our practices, technology, legal requirements, or the Services. We will post the updated Policy and revise the effective date. For material changes, we will provide reasonable additional notice by email, through the Services, or on our website when required or practical.

Where applicable law requires consent before a material change in processing, xBoard will request that consent. Changes apply going forward and do not reduce rights that cannot legally be waived.

Back to contents

18. Contact Us

Privacy requests and questions: privacy@xboard.com

Security concerns: security@xboard.com

Privacy Officer: xBoard Privacy Officer

Mailing address: xBoard, LLC, 2123 Old Spartanburg Rd., #200, Greer, SC 29650

Questions about the Privacy Policy: legal@xboard.com

Data Processing Addendum questions or requests: legal@xboard.com

Copyright © 2026 xBoard. All rights reserved.

Back to contents