Privacy Policy

• Account details — your name, email address, and company name.
• Files you upload — the spreadsheets (CSV/Excel) you choose to upload, and the numbers inside them.
• Payment details — handled entirely by Stripe. We never see or store your card number.
• Basic usage data — which pages you visited and when, plus browser type and IP address, so we can keep the product working.

Files you upload while signed in are encrypted in transit (TLS/HTTPS) and encrypted at rest on our hosting provider's servers. Access is restricted to your account — other customers cannot see your data, and our team does not browse it. We may access an individual account's data only when you ask us to for support, or where we're legally required to.

To write the plain-English insights and commentary in your reports, we send the relevant numbers from your file to our AI provider, Anthropic (Claude), through their business API.

• Your files and financial data are never used to train any AI model — not ours, and not our AI provider's. Our agreement with Anthropic states that inputs and outputs are not used to train their models.
• Data is sent only to generate your report — it is not retained for any other purpose.
• We do not use your data to build features or benchmarks for other customers.

We do not sell your personal or financial data, and we do not share it with advertisers or data brokers — ever. The only companies that touch your data are the service providers we need to run BoardMetric, and each of them is contractually bound to protect it:

• Our hosting, database, and authentication provider (Supabase infrastructure)
• Stripe — payment processing only
• Anthropic (Claude) — AI insight generation only, with no model training (see section 3)

We keep your data for as long as your account is open. You can delete an individual uploaded file at any time from inside the app, which removes it and any reports built from it.

To delete your entire account and everything in it, email hello@boardmetric.app from your account email address. We'll delete your account, files, and reports within 30 days and confirm when it's done. Some records we're legally required to keep (for example payment records for tax purposes) are retained as required by law.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Just email hello@boardmetric.app — we'll respond within 30 days.

If you are located in the European Union or California, you have additional rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data, subject to legal retention requirements.
• Right to portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing of your personal data in certain circumstances.
• CCPA — Do Not Sell — we do not sell your personal information. California residents may submit data access or deletion requests by emailing hello@boardmetric.app.

To exercise any of these rights, email us at hello@boardmetric.app. We will respond within 30 days.

We use essential cookies to keep you signed in, and basic analytics (Google Analytics) to understand which pages people use. We do not run advertising or cross-site tracking pixels on BoardMetric.

BoardMetric is a business tool and is not intended for anyone under 18.

BoardMetric uses Anthropic's Claude API across the product: answering your questions in chat, reading and interpreting spreadsheets you upload, generating forecasts and written reports, and maintaining the short "business memory" notes that let the assistant remember context between conversations. This constitutes automated processing of personal and financial data. Key facts:

• Your data is sent to Anthropic solely to generate the output you requested.
• Your data is not used to train, fine-tune, or improve any AI model.
• AI outputs are suggestions only — no automated decision carries legal effect on you.
• You can contact us to request that AI processing not be applied to your data, in which case AI features will not be available to your account.

If you are located in the EU, our lawful basis for this processing is the performance of our contract with you (Article 6(1)(b) GDPR). Anthropic acts as a data processor on our behalf under a Data Processing Agreement.

If we change anything meaningful — especially about how your data is used — we'll email you before it takes effect.