Legal information

Privacy Notice

Website and prototype · Version dated 2 September 2026

This notice explains how BoardFlow handles information from the public website, interest form, demo and current prototype. The prototype is still experimental: it does not yet offer individual accounts or production-ready access controls.

1. Who is responsible

BoardFlow is operated by Carlos Montenegro, sole proprietorship, KVK 96085819, Tuigerstraat 60, 1033 PH Amsterdam, the Netherlands. For privacy questions or requests, email carlos.montenegrovela@gmail.com.

2. Information we handle

Website and interest list

When you join the list, we collect your email address, role, interests and readiness, plus any optional name or comments you provide. The form also records the notice version and submission source so we can demonstrate what you agreed to. Hosting and security systems may receive your IP address, browser and device information, requested page, time, referrer, error data and spam signals.

Demo and prototype

The public demo uses fictional production information. If you use a non-demo project, BoardFlow may store project names, scripts, scenes, shot lists, schedules, call sheets, notes, images, crew or cast names, roles and contact details, editor names and technical activity needed to save and protect the project. The app also uses browser local storage and session storage for project state, preferences and access status.

Do not place special-category data, highly confidential material or third-party personal data in the prototype unless you are authorised to do so and have an appropriate legal basis. Anyone who receives a project link and its access information may be able to reach that project.

3. Why we use information and our legal bases

• Requested emails: to send BoardFlow development and possible-access updates, based on your consent. You may withdraw it at any time.
• Product research: to understand roles, workflow problems and aggregate interest, based on our legitimate interest in developing BoardFlow. You may object to this use.
• Demo and prototype: to provide the functionality you request and save projects, based on steps taken at your request, performance of any applicable agreement, and our legitimate interest in operating and improving the prototype.
• Security, operations and limited audience measurement: to prevent abuse, diagnose errors, maintain the service and understand aggregate page traffic through Netlify’s server-side, cookieless Web Analytics, based on our legitimate interests and, where applicable, legal obligations.

We do not sell personal information, use it for third-party advertising, or make decisions about people through automated profiling. Required form fields are marked. Without an email, role, readiness choice and consent, we cannot add you to the update list.

4. Providers and international transfers

We use:

• Netlify to host the site and receive form submissions. Netlify and its spam-prevention providers process form and technical information for us.
• Supabase to host the prototype database and uploaded files.
• Google Fonts and jsDelivr to deliver fonts and the Supabase browser library; their servers receive ordinary request information such as an IP address and browser details.

These providers may use subprocessors or process limited information outside the European Economic Area. Where required, transfers are protected through an adequacy decision or contractual safeguards such as the European Commission’s Standard Contractual Clauses. You may request more information or a copy of the relevant safeguards by contacting us.

5. How long we keep information

• Interest-list records are kept for up to 24 months after submission, unless you renew your interest, enter a later BoardFlow relationship or ask us to remove them sooner.
• Prototype project information is kept while the project is actively used or until the project is deleted or deletion is requested, subject to limited security logs and provider backup cycles.
• Security, request and error records are retained only as long as reasonably needed for operations, abuse prevention and legal obligations.

Anonymous statistics that no longer identify anyone may be kept. A deletion request can be refused or limited only where the law permits or requires continued retention.

6. Your rights

Depending on the circumstances, you may ask to access, correct, delete, restrict or receive your personal data, withdraw consent, or object to processing based on legitimate interests. Withdrawal does not affect earlier lawful processing. We may ask for information needed to verify your identity and normally respond within one month.

You may complain to the Dutch Autoriteit Persoonsgegevens or the competent authority where you live, work or believe an infringement occurred.

7. Security and prototype limits

We use encrypted connections, managed hosting and access restrictions appropriate to the current prototype. No online service can promise absolute security. BoardFlow’s present shared-link and client-side access model is not a substitute for individual authentication or project-membership controls. Use the demo for evaluation and avoid confidential real-world production data until those controls and the appropriate customer agreements are in place.

8. Cookies, local storage and future analytics

The website does not currently run advertising, cross-site tracking or client-side behavioural analytics. Netlify Web Analytics is enabled and derives aggregate traffic information from hosting-server logs without placing analytics cookies or adding browser tracking code. The app uses browser storage for requested functionality, including project state, preferences and session access. These functional technologies are not used for cross-site advertising.

If non-essential analytics, tracking cookies or similar technology is introduced, it will not be activated merely because this notice mentions it. Before activation, we will identify the provider, data, purpose and duration; update this notice; and request prior consent where required. Any consent interface will allow an equally clear refusal and an easy way to withdraw consent. Refusing non-essential tracking will not block normal use.

9. Your responsibilities when adding other people

If you add crew, cast or another person’s information, you are responsible for having a lawful reason, giving any required notice, keeping it accurate and limiting access. Where BoardFlow processes that information on behalf of a production or customer, the parties must put the legally required processor terms in place before production use.

10. Changes

We may update this notice as BoardFlow, its providers or its data use changes. Material changes will be highlighted and, where required, communicated before a new use begins. The current version date remains at the top of this page.