What this policy covers
This policy is written by Boardroom Sweden AB (organisation number 559592-6659), trading as Boardroom (we). It covers the website at helloboardroom.com, the platform at portal.helloboardroom.com, and the emails we send from them. Use of the platform itself is governed by our Terms of Service.
We wear two hats, and it matters which one applies to you:
- For the website and your account, we decide what is collected and why. We are the controller.
- For what a company puts into its workspace, its shareholders, investors, board members, cap table, valuations and documents, the company decides. It is the controller and we are its processor, working to its instructions. If you are an investor or board member reading this, the company that invited you is the one to ask first. Our GDPR page sets out that relationship.
- Nominee holdings are the one exception inside a workspace. When a nominee records the people it holds shares for, the nominee is the controller of that data, we are the processor, and the company itself cannot see it.
It does not cover other companies' websites we link to, or the internal practices of a company using Boardroom beyond how the platform itself works.
Where personal data comes from
- You give it to us: when you create an account, fill in the Talk to us form, enter a shareholder, upload a document, or write to us.
- We record it as you use the platform: sign-ins, and inside a workspace, who opened which room, document or fundraising page and when.
- Others give it to us: the company that invites you to its workspace, the public company register when a company onboards (Companies House in the UK), and Stripe for the status of a subscription.
Categories of personal data
| Category | What it includes | Where it comes from |
|---|---|---|
| Identity and contact | Name, work email, company, role. | You, or the company that invites you |
| Account and security | Login email, sign-in events, and an authenticator app if you choose to add one. There are no passwords: you sign in with a one-time code sent to your email, or with Google. | You |
| Workspace content | Shareholdings, share classes and events, valuations, KPIs, investor updates, board materials, and the documents a company uploads. Documents can contain personal data about people who never use Boardroom. | The company, as controller |
| Billing | Plan, billing cycle, invoices and billing country. Card details go straight to Stripe through its hosted checkout and never reach our servers. | You and Stripe |
| Activity and engagement | For data rooms and share links: who opened a room, viewed or downloaded a document, when, and for how long, with the IP address stored only as a hash. For fundraising pages: which investor engaged with which material. For a company's shareholders: which of its updates they opened, and the days on which they used its investor portal. An audit log of admin actions (who did what, to which record, when). | Recorded by the platform |
| Correspondence | What you send us through the Talk to us form (name, work email, company, role, number of investors, any message) or by email. | You |
| Technical | Browser and device type, country, the page that sent you to us, request logs at our hosting provider, visit counts and a few actions such as pressing sign-up (measured without cookies, see below), and anonymous performance measurements of the platform. | Your browser, automatically |
We do not ask for, and ask companies not to upload, special category data such as health, political or religious information.
How we use personal data
- To run the platform for the company you belong to: showing you the holdings, updates and documents you are permitted to see, and nothing else. Basis: our contract with the company, and its instructions to us.
- To keep accounts secure: one-time sign-in codes, an optional authenticator app, a confirmation step before sensitive actions, session handling, and an audit log of sensitive actions. Basis: legitimate interest in security, and our contractual duties.
- To show companies how their own materials are used: engagement on data rooms, documents and fundraising pages. See the next section. Basis: the company's instructions as controller.
- To bill: subscriptions and add-ons through Stripe, VAT by billing country. Basis: contract and legal obligation.
- To send service emails: invitations, investor updates a company publishes, digests and alerts a company configures, and sign-in and confirmation codes. We do not send marketing email unless you have asked for it. Basis: contract, and consent where we ask for it.
- To reply to you when you use the Talk to us form or write to us. Basis: legitimate interest in answering you.
- To help a company get set up: our onboarding reads the documents a company drops in and proposes a register and history for a person to review. See AI features below. Basis: the company's instructions.
- To keep the service working: diagnosing errors and performance. Basis: legitimate interest.
- To understand how the website and platform are used: counting visits, which pages are read, where visitors came from and a few actions such as pressing sign-up or sending the Talk to us form, without cookies and without identifying anyone. Basis: legitimate interest in improving the site.
- To meet legal obligations, including tax and accounting records. Basis: legal obligation.
We do not use personal data to build advertising profiles, and we do not sell it.
Engagement analytics, said plainly
Boardroom exists so a company can see what happens to what it shares. If you are an investor or a prospect and you open a data room, a document, a tracked link or a fundraising page, the company that shared it can see that you did, which item, when, and how long you spent. Your IP address is recorded as a hash, not in the clear.
If you are a shareholder with a login, the company can also see which of its updates you opened, and on which days you used its investor portal: one record for each day, not each page you open. It shows them as a count of the days each shareholder was active over the last 90 days, so it knows who is reading what it sends.
That information is shown to the company that owns the material and to nobody else. We do not combine it across companies, sell it, or use it to profile you.
AI features
Onboarding and bulk import can read the documents a company uploads, work out what each one is, and propose the cap table, contacts, history and filings they describe. Two outside services are involved, each only when the company uses the feature:
- Amazon Web Services Bedrock (EU regions only) runs the AI models that classify those documents and extract from them. The model provider has no access to what is sent, and nothing sent is used to train models. We send only what the extraction needs, and per company daily limits apply.
- Amazon Web Services Textract (Ireland) turns scanned PDFs into text. The copy used for that job is deleted when the job completes, with a one day backstop.
Nothing an AI proposes is written to a register until a person at the company reviews and accepts it.
Where your data lives
The database, authentication and file storage run in the European Union, in Ireland. Platform compute runs in Dublin, and the AI models used during onboarding run in EU regions. Cap tables, registers and documents therefore stay in the EU at rest.
Some data is held or processed outside the EU: the content and delivery logs of emails the platform sends and receives, which our email provider stores in the United States; Stripe's billing operations; and the static parts of the website served from Vercel's global network. For those transfers we rely on the European Commission's Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the provider is certified. The same applies for the UK under its addendum.
Security
Security is enforced in the database, not bolted on in the app. In practice:
- Row-level security on every table: each query is checked against your company membership and permissions inside Postgres, so application code cannot leak across companies. Cross-company access tests run before every release.
- No passwords: sign-in is by a one-time code or Google, anyone can add an authenticator app, and sensitive actions ask you to confirm it is you.
- Encryption in transit (TLS) and at rest.
- Private storage for every document: links are short-lived and minted only after a permission check, and data rooms are view-only and watermarked. Company logos and team photos are public by design.
- An immutable audit log of sensitive actions, readable by the company's admins.
- Least privilege across roles, keys and providers, and daily backups.
No system is perfectly secure. If we learn of a breach affecting your data we will tell the controller without undue delay, and you directly where the law requires.
How long we keep it
- Your account: for as long as it exists. Write to us at contact@helloboardroom.com and we delete it.
- Workspace content: for as long as the company keeps its workspace. The company controls what is added and removed. When a company's admin closes its workspace, everyone except its admins loses access at once, and 30 days later the workspace and its data are deleted, unless the closure is cancelled in that time. Deleted data is never restored from a backup, and leaves the backups as they expire: within seven days for the daily backups, and within 90 days for our encrypted off-site copy.
- Correspondence: for as long as we need it to answer you and to keep a record of the conversation.
- Billing records: for the period tax law requires.
Records the platform keeps about activity are deleted automatically once their period is up, whether or not the workspace is still open:
| Record | Kept for | Why |
|---|---|---|
| Security counters and sign-in confirmation codes | 7 days | Stopping abuse; a confirmation lasts 15 minutes |
| Failed attempts to open a shared link (the IP address hashed) | 30 days | Investigating an attack |
| Payment notifications from Stripe | 90 days | Making sure each payment is recorded once |
| In-app notifications | 12 months | Your recent activity, and last year for context |
| Days on which a shareholder used a company's investor portal | 12 months | Showing the company which shareholders are engaged |
| Data room views and downloads | 24 months | The company's record of a raise and its diligence |
| Activity and audit log (sign-ins, changes, who saw what) | 24 months | Security investigations and audits |
| The company's register and its history, and its own correspondence and records | As long as the workspace | The company's own records; deleted with the workspace |
| Backups | 90 days (7 days for the daily database backups) | Recovering from a failure; never used to restore deleted data |
| Record that a workspace was deleted, and on whose instruction | 6 years | Evidence that a deletion was done |
Your rights
Under the GDPR and the UK GDPR you can ask to:
- see the personal data we hold about you, and get a copy in a portable format;
- correct it;
- have it deleted;
- restrict or object to how it is used;
- withdraw consent where we relied on it;
- complain to a data protection authority. Ours is the Swedish Authority for Privacy Protection (IMY); you can also complain to the authority where you live.
Write to contact@helloboardroom.com. We answer within one month. If your data sits inside a company's workspace, we will pass your request to that company, because it is the controller, and help it respond. Investors can also export their own holdings from the platform at any time.
Children
Boardroom is a business tool and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe we have, write to contact@helloboardroom.com and we will delete it.
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we use your personal data, we email account holders before it takes effect.
Contact
Boardroom Sweden AB, organisation number 559592-6659
Gjutargatan 4A, 112 48 Stockholm, Sweden
contact@helloboardroom.com
For anything about a company's workspace, contact that company first. For anything about Boardroom itself, contact us.