Version privacy-v3 · 4 October 2026. This notice explains how BoardFlow handles personal information. It is information, not a contract or blanket request for consent.
BoardFlow is operated by Common Scene, the trading name of Carlos Montenegro, sole proprietor, KVK 96085819, Tuigerstraat 60, 1033 PH Amsterdam, the Netherlands. For privacy questions or requests: hello@commonscene.org.
BoardFlow is controller for its own website enquiries and optional product-update subscriptions, general user accounts, sign-in email, beta-access administration and service-security purposes. Project membership, permissions, project-visible names, recovery records and security processing undertaken on the producer's behalf fall under the Project Data Agreement. For personal data that a production puts in its project, the responsible producer normally decides its purpose and use; BoardFlow processes it on that producer's instructions. The actual activities determine these roles; enabling someone to sign in does not by itself make general account administration processing on a producer's behalf.
The public demo uses fictional production information. Required fields are identified in the app or form; without the information needed for a feature, we cannot provide that feature. Please do not include third-party production information in product feedback.
We record the individual contracting party's name or a separate entity's legal name and its representative's name and capacity to document who entered the agreement. A first name alone can be ambiguous; a person's complete name makes the record clearer. This is not an identity check and GDPR does not prescribe a particular name-field format. The record also links the verified account, project, document versions and acceptance time. An optional production label need not be a registered company. Separately, project-visible names identify collaborators within the production and are processed on its instructions.
New beta image uploads are resized and compressed for preview. Downloads provide the stored versions; original-resolution files should be kept separately. Stored-image usage and applicable plan acceptance are recorded to administer the dated account allowance. Existing gallery files are not silently recompressed. These limits do not replace the producer's return/deletion rights or change the disclosed closure process.
For BoardFlow's own controller activities:
For production personal data, the producer determines the lawful basis; BoardFlow follows documented instructions rather than claiming an independent product-improvement purpose. The project-data agreement sets the scope and duties.
We do not sell personal data or use it for third-party advertising. We do not carry out automated profiling or automated decisions with legal or similarly significant effects.
Authorised project members see information within their project permissions. BoardFlow's authorised operator may access information needed for support, security and agreed processing, subject to confidentiality.
The service uses Netlify for website hosting and optional-update/enquiry forms, Supabase for authentication, project records and uploaded files, and Resend for one-time authentication email delivery. Netlify's spam-prevention service handles form/technical signals. Fonts and the Supabase browser library are served from BoardFlow's own website; loading them does not require a separate Google Fonts or third-party library-CDN request.
The project-data agreement identifies the providers that actually process production content. A provider of sign-in email or website assets is not automatically a production-content processor. Information may also be disclosed where legally required, limited to the request's lawful scope.
Some providers or their subprocessors process information outside the EEA. A European database region alone does not mean all processing stays in Europe. Restricted transfers require an applicable GDPR transfer mechanism and any necessary supplementary safeguards; your acceptance of terms is not used as a substitute for those safeguards.
| Provider | Information and purpose | Locations and safeguards |
|---|---|---|
| Supabase | Verified account, authentication, project records and private uploaded files | Supabase Pte. Ltd., Singapore. The database is hosted in Ireland (eu-west-1). Support and service operations may involve other locations through its suppliers. Its Data Processing Addendum provides Standard Contractual Clauses for relevant restricted transfers; see its subprocessor list. |
| Netlify | Website delivery, optional-update/enquiry forms, technical requests, spam prevention and aggregate server-side traffic statistics | Netlify, Inc., United States, using distributed delivery infrastructure and suppliers. Its Data Processing Agreement provides for the EU–US Data Privacy Framework where applicable and Standard Contractual Clauses for transfers not covered by that framework; see its subprocessor information. |
| Resend | Recipient email, sign-in message and delivery information; not your script or gallery | Plus Five Five, Inc., United States. Email data is stored in the US even when an EU sending region is used. Its Data Processing Addendum provides Standard Contractual Clauses; see its subprocessor list. |
Contact hello@commonscene.org for a copy of the relevant safeguards or information about a particular transfer, with necessary protection for confidential information. Supplier lists explain their service chains; they do not mean every listed supplier receives every project file. Changes to Project Data subprocessors follow the Project Data Agreement's notice and objection process.
Website enquiry and optional-update records are kept for up to 24 months after submission or your latest explicit request to continue receiving updates, unless you request earlier removal. Records needed for a later account relationship are assessed separately rather than automatically retaining the original form.
When your beta access expires, your access to projects becomes read-only. Expiry does not itself delete a project or determine another member's access. While the account remains available, you can export current project records and separately download stored project images. These self-service downloads do not by themselves certify a complete return of version history and all operational copies.
Request project or account closure through Settings where the relevant control is available, or contact hello@commonscene.org. The app checks a recent verified sign-in and project authority, records your explicit instruction and runs confirmed live-data deletion automatically in the background. New uploads are blocked immediately when closure starts. Active uploads must settle safely before the final return or deletion. During a transition from older upload permissions, previously issued capabilities may need to expire first; the app shows any resulting delay. A complete return ZIP includes current records, relevant recoverable history and all stored project images; return-first closure waits for your confirmation that you saved it. Progress and a private receipt remain available after account removal. Submitting is not proof of completed erasure: provider recovery copies, operator-held exports and other-device copies have separate removal processes, and assistance remains available. The producer chooses return followed by deletion or deletion only under the Project Data Agreement. That process covers current records, relevant recoverable history, stored image bytes and remaining copies. We handle a verified instruction without undue delay, explain any restriction or delay, and distinguish completed deletion from remaining protected copies. Beta expiry is not permission to retain production content indefinitely. Account deletion requires resolution of projects you own; removing an app member or asking to close their account does not itself instruct deletion of another producer's project.
Minimal closure evidence records the instruction reference, account/project identifiers, scope, timestamps, progress, deletion counts and any return manifest hash; it contains no script or image bytes. A private receipt token permits status access after account deletion and must be kept private. This evidence follows the same necessity-based limit of up to five years after closure described below. Account-administration information is retained while needed to provide the requested account, resolve access or complete closure. We assess removal when an account is closed, the service relationship ends, or unresolved access/closure work is completed. Read-only project availability is ongoing processing, not a reason to keep unrelated account information indefinitely. Necessary legal obligations or claims are considered separately. Minimal agreement evidence—party, verified account/contact, authority, covered project, accepted version and time—is kept only as needed to establish or defend the relationship, for up to five years after it ends, with earlier removal where no longer necessary. A specific legal obligation or identified claim may justify longer retention of the necessary evidence, with its basis documented. This does not permit retaining scripts, images or other production content as general agreement evidence.
BoardFlow-managed routine security logs are limited to what is necessary and retained for up to 90 days. Necessary records of a specific incident, investigation or legal claim may be retained longer for that documented purpose, with access restricted and necessity reassessed. This is an operator retention policy, not a universal 90-day purge of supplier systems.
Provider-held technical records and recovery copies have different purposes and lifecycles. Supabase and Netlify retain service records under their applicable data-processing terms for service operation, security, legal requirements and return/deletion. Their contract-termination provisions do not mean that closing one BoardFlow project closes the whole supplier account. BoardFlow requests removal of identifiable project copies under its control or its suppliers' control when processing for that project ends; any remaining restricted recovery copy is identified in the closure response, with its deletion or expiry status. No fixed universal supplier-backup period is represented here. Resend publishes 30-day email/log retention for Free, Pro and Scale plans and seven-day backup retention; its remaining-data period after closing the Resend account is not a project-deletion deadline.
Browser emergency drafts and downloads can contain project data independently of the cloud copy. Deleting a cloud project cannot erase a file or draft already held on another person's device. The responsible producer manages copies under their control and gives authorised collaborators appropriate instructions for handling or deleting their copies. BoardFlow remains responsible for copies it or its subprocessors hold.
Recovery versions are not independent backups of all image bytes. Routine operator-managed encrypted recovery packages are not currently being captured or rotated. If introduced, their retention policy permits at most four weekly copies per project, each kept for no more than 30 days; it does not promise continuous backups or a guaranteed recovery window. Any exception must concern a specific lawful requirement or identified claim, be limited to necessary records and have a documented review date. After closure, remaining recovery copies are restricted from ordinary use and removed or allowed to expire within the applicable limit; if restored, the deletion instruction is reapplied. Supplier-held copies follow their separately described lifecycles, not a universal 30-day provider purge.
Depending on the circumstances, you can request access, correction, deletion, restriction or portability, object to legitimate-interest processing, and withdraw consent. Withdrawal does not affect earlier lawful processing.
Contact BoardFlow about its own controller activities. We may seek only the information reasonably needed to verify a request and normally respond within one month. If the law permits an extension, we will explain it within that first month.
For information entered about you by a production, contact that production as controller. If you contact BoardFlow, we will direct or pass the request to the responsible producer where appropriate and assist it under the project-data agreement.
You may complain to the Dutch Autoriteit Persoonsgegevens or the competent supervisory authority where you live, work or believe an infringement occurred.
BoardFlow uses encrypted connections, verified accounts, server-side project-membership restrictions, private image storage and controlled editing. The Project Data Agreement describes processing and security measures; no online service can guarantee absolute security.
The app uses browser storage for authentication/session state, display preferences, the last selected project and emergency recovery drafts. A draft is cleared after a successful cloud save or when you explicitly choose the cloud copy. Failed saves and sign-out do not automatically discard unsaved drafts; there is no timed automatic expiry for them. You can remove them by clearing this site's browser data, which also removes its stored sign-in state and preferences. A browser draft is not a guaranteed cloud save or server backup. Use your own browser profile, sign out on shared devices and keep downloaded files secure.
The website currently has no advertising or client-side behavioural tracking. Netlify Web Analytics derives aggregate traffic statistics from server-side request logs without adding browser analytics cookies. Necessary functional storage is not used for cross-site advertising. If non-essential tracking is introduced, we will explain it and obtain prior consent where required, with clear refusal and withdrawal controls.
We may update this notice as the service and actual data handling change. We will identify the version and explain material changes to affected users before a new use begins, obtaining consent where the law requires it. Updating a notice alone does not authorise a new processing purpose.