Privacyboard

Privacy policy

Last validated 5 November 2026

Who we are

Privacyboard

3 Ter Avenue Jeanne d'Arc, 94170, Le Perreux

https://privacyboard.io/

Privacy contact: antoine@unmake.io
Data protection officer: Antoine Milkoff

Scope

This notice describes processing for which we act as controller. Data processed on behalf of customers is governed by their instructions and the applicable data processing agreement.

Our processing activities

Customer accounts and service delivery

Purpose: Create and manage customer accounts and deliver the service the customer asked for
Data: Names, email addresses, account identifiers, usage data
People: Customers and their users
Legal basis: Performance of a contract
Retention: For the duration of the contract, then deleted or archived after 12 months
Service providers: Vercel, Supabase, Resend

Billing and payments

Purpose: Sell subscriptions through a merchant of record (which handles checkout, payment, invoicing and sales tax), track subscription status and keep sales and accounting records
Data: Names, email addresses, billing country, subscription plan and status, order and transaction identifiers (card details and invoices are handled by the merchant of record)
People: Customers and their billing contacts
Legal basis: Performance of a contract and legal obligation
Retention: As required by accounting and tax law, commonly 6 to 10 years (10 years in France)
Service providers: Lemon Squeezy

Website analytics and cookies

Purpose: Understand how the website is used and improve it
Data: IP addresses (not stored by the analytics tool), device and browser data, pages visited, referrer, consent choices
People: Website visitors
Legal basis: Consent (strictly necessary cookies do not need consent)
Retention: Aggregated audience statistics kept for up to 25 months (the analytics tool sets no cookies); consent choices and necessary cookies kept for up to 13 months
Service providers: Vercel

Team collaboration and internal tools

Purpose: Let the team communicate, share files and organize projects and tasks
Data: Names, work email addresses, messages, shared files and comments, task assignments, activity logs
People: Employees, contractors and guests invited to the workspace
Legal basis: Legitimate interests
Legitimate interest pursued: Letting our team communicate and work together efficiently
Retention: During employment or collaboration; accounts closed at departure and content deleted or archived after 12 months
Service providers: Google Workspace, GitHub

Where your data comes from

We collect personal data directly from the people concerned and, in some cases, from third parties such as their employer, our partners or public sources.

Recipients and transfers

We use the following service providers, who may receive personal data on our behalf:

Vercel (Hosting) — Host business websites, online services or other company systems. — United States
Supabase (Database & authentication) — Provide database, authentication and file storage for enabled Supabase services. — France
Resend (Email) — Deliver transactional emails such as account notifications and password resets. — United States
GitHub (Development) — Manage source code, software development and deployment workflows. — United States
OVHcloud (Hosting) — Domain name registrar for privacyboard.io (DNS and email are no longer hosted at OVHcloud). — France
Google Workspace (Collaboration) — Provide internal business email, calendar, document storage and collaboration. — European Union
Anthropic (AI services) — Support business activities or client services with AI capabilities through the Anthropic API. — United States

The following organisations receive personal data and decide how they use it:

Lemon Squeezy (Payments) — Sell Privacyboard subscriptions as merchant of record: checkout, payment, invoicing, sales tax and billing. — United States

Some of these providers process data outside the European Economic Area (Vercel, Resend, GitHub, Lemon Squeezy, Anthropic). Where this happens, we rely on the provider’s certification under the EU-US Data Privacy Framework (Vercel, GitHub); standard contractual clauses approved by the European Commission (Resend, Lemon Squeezy, Anthropic). You can obtain a copy of these safeguards by writing to antoine@unmake.io.

Automated decisions

We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you.

Cookies and similar technologies

Our website also uses cookies or similar technologies that are not strictly necessary, for audience measurement. We ask for your consent before placing them, and you can change or withdraw your choice at any time. The services concerned are listed in our Cookie policy.

Security

We protect personal data with appropriate technical and organizational measures, including multi-factor authentication for administrative access, regular backups, encryption of personal data in transit and at rest.

Whether you must provide your data

Some personal data is needed to provide our service or to meet a legal obligation, such as your contact details to open an account or billing details to issue an invoice. We tell you when we collect it. If you do not provide it, we may not be able to provide the service. Other information is optional.

Your rights

You may ask us for access to your personal data, and for its correction, erasure or restriction. You may also receive your data in a portable format. Where processing relies on your consent, you may withdraw it at any time without affecting what was done before.

Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. You can also object at any time, without giving a reason, to the use of your data for direct marketing, including profiling related to it.

To exercise your rights, contact antoine@unmake.io. We answer within one month, and we may need to verify your identity first.

You may also lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, cnil.fr). People in the United Kingdom can complain to the Information Commissioner’s Office (ico.org.uk).

Notice for people in Switzerland

This section applies to people in Switzerland, under the Federal Act on Data Protection (FADP). It supplements the rest of this notice.

Your rights: you can ask us whether we process your personal data and receive the information the FADP requires, ask for the correction of inaccurate data, receive your data in a common electronic format or have it transferred to another controller, and object to processing or ask for its deletion. Where we take a decision based solely on automated processing that has legal effects on you or affects you significantly, we tell you, and you can give your point of view and ask for a person to review it.
How to make a request: use the form in our privacy center or write to antoine@unmake.io. We answer within 30 days, which we may extend when we tell you why. You can contact the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).
Transfers abroad: some of our providers process data outside Switzerland and the European Economic Area (Vercel, US; Resend, US; GitHub, US; Lemon Squeezy, US; Anthropic, US). We transfer data abroad only to countries the Federal Council recognizes as providing adequate protection or with the safeguards the FADP requires, such as standard contractual clauses recognized by the FDPIC or the provider’s certification under the Swiss-US Data Privacy Framework.

Notice for people in Canada

This section applies to people in Canada, under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Québec, the Act respecting the protection of personal information in the private sector (as amended by Law 25). It supplements the rest of this notice.

Consent: we collect, use and disclose personal information with your consent, express or, where appropriate, implied, except where the law allows otherwise. You can withdraw your consent at any time, subject to legal or contractual restrictions, and we will tell you what that means for the service.
How we collect it: directly from you, through our website, our forms and the use of our service, and from third parties such as your employer, our partners or public sources, and through cookies and similar technologies on our website.

Person in charge of the protection of personal information: Antoine Milkoff, reachable at antoine@unmake.io.

Your rights: you can ask to access the personal information we hold about you and to have it corrected. Residents of Québec can also ask us to stop disseminating it or to de-index it, to receive it in a structured, commonly used technological format, and to be told about decisions based exclusively on automated processing and to have them reviewed.
How to make a request: use the form in our privacy center or write to antoine@unmake.io. We answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Québec, to the Commission d’accès à l’information (cai.gouv.qc.ca).
Storage and processing outside Canada: some of our providers process personal information outside Canada (Vercel, US; Supabase, France; Resend, US; GitHub, US; Lemon Squeezy, US; OVHcloud, France; Google Workspace, EU; Anthropic, US). It may then be accessible to the courts and authorities of those countries. Before communicating personal information of Québec residents outside Québec, we assess whether it will be adequately protected.
Tracking technologies: technologies that can identify, locate or profile you are turned off by default, and turned on only if you choose to.
How long we keep it: Contract duration + 12 months.

Notice for residents of Brazil

This section applies to people in Brazil, under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018). It supplements the rest of this notice.

Legal bases: we process personal data on the legal bases of Article 7 of the LGPD, such as your consent, the performance of a contract with you, compliance with a legal or regulatory obligation and our legitimate interests. The legal basis of each activity is given above.
Data protection officer (encarregado): Antoine Milkoff, reachable at antoine@unmake.io.
Your rights (Article 18 of the LGPD): you can ask us to confirm whether we process your data, to access it, to correct incomplete, inaccurate or outdated data, to anonymize, block or delete data that is unnecessary, excessive or processed unlawfully, to port it to another provider, and to delete data processed with your consent. You can ask which public and private entities we share your data with, be told what happens if you refuse consent, and withdraw your consent at any time. You can also ask for a review of decisions taken solely on automated processing that affect your interests.
How to make a request: use the form in our privacy center or write to antoine@unmake.io. We answer within 15 days of your request. If you are not satisfied, you can file a petition with the National Data Protection Authority (ANPD, gov.br/anpd).
International transfers: some of our providers process data outside Brazil (Vercel, Supabase, Resend, GitHub, Lemon Squeezy, OVHcloud, Google Workspace, Anthropic). We transfer data only as allowed by Article 33 of the LGPD, for example to countries the ANPD recognizes as adequate or under the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024).

Notice for people in Chile

This section applies to people in Chile, under Law 19.628 on the protection of personal data as amended by Law 21.719. It supplements the rest of this notice.

Legal bases: we process personal data with your consent or on another basis the law allows, such as the performance of a contract with you, compliance with a legal obligation or our legitimate interests. The basis of each activity is given above.
Your rights: you can ask to access your personal data, to rectify it, to delete it and to object to its processing. You can also ask for it to be blocked while a request is examined, receive it in a structured, commonly used format, and not be subject to decisions based solely on automated processing that significantly affect you.
How to make a request: use the form in our privacy center or write to antoine@unmake.io. We answer within 30 days, which may be extended once by 30 days. If you are not satisfied, you can file a complaint with the Personal Data Protection Agency (Agencia de Protección de Datos Personales).
International transfers: some of our providers process data outside Chile (Vercel, Supabase, Resend, GitHub, Lemon Squeezy, OVHcloud, Google Workspace, Anthropic). We transfer data only to countries with an adequate level of protection or with the safeguards the law requires, such as contractual clauses.

Notice for people in Australia

This section applies to people in Australia, under the Privacy Act 1988 and the Australian Privacy Principles. It supplements the rest of this notice.

Your rights: you can ask to access the personal information we hold about you and to have it corrected. You can opt out of direct marketing at any time, and deal with us anonymously or under a pseudonym where that is practicable.
How to make a request or a complaint: use the form in our privacy center or write to antoine@unmake.io. We answer within 30 days. If you are not satisfied with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (OAIC, oaic.gov.au).
How we hold it: electronically, in our systems and with the service providers listed in this notice (main storage: France), protected by the security measures described above. We destroy or de-identify personal information we no longer need.
Disclosure overseas: we are likely to disclose personal information to service providers located in or processing data in US, France, EU.
Automated decisions: We do not use computer programs to make, or substantially help make, decisions that could significantly affect your rights or interests.

Changes to this notice

We may update this notice. The date of the last review is shown at the top of this page.