MindBoard Privacy Policy
Last updated: 7 October 2026
This policy explains what personal data MindBoard collects, why, and what you can do about it. It covers the MindBoard app at board.mindboard.me and mindboard.me, including the request-access form on each. A request sent from either form goes into the same record, stored with our database provider, Supabase, in the European Union (Ireland).
1. Who we are
MindBoard LLC (შპს მაინდბოარდ), registered in Georgia, identification code 437980598, registered address: 51 Meskheti St., Borjomi, Georgia, is the controller of the personal data described in this policy. Contact: info@mindboard.me.
For the content coaches put into their own boards, including anything about their clients, the coach is the controller and we act on their behalf. See section 5.
2. What we collect
When you request access: your name, your email address, and what you tell us about your practice. On mindboard.me that is the field you mainly work in and any note you add, and we also record which language version of the page you used.
When you have an account: your email address and your password. Your password is handled by our authentication provider and stored only in hashed form; we cannot see it.
Your boards: everything you create in them: board names and descriptions, figures and their names, labels, arrangements, and the mats you use. A board password, if you set one, is stored only in hashed form.
Session statistics: when two or more people are in a board together, we record when that session started and ended, the highest and lowest number of people present at any one moment, the first mat used, and how many times the inside view and undo were used. These are linked to the board's owner, not to guests, and never to what is on the board. We use them only in aggregate, to understand how MindBoard is used.
Guests: a guest joins with a display name. The name is shown to the others in the session while it lasts. We do not store it.
Emails: the invitation, password-reset and account emails we send you, and any correspondence with us.
Invoices and payments: your name or company name, billing details, and the record of what you paid and when.
Technical data: our hosting providers record technical information about requests to the Service, such as IP addresses and timestamps, in their logs, which are kept for security and troubleshooting. Our database provider keeps these logs for one day on our current plan; our hosting provider keeps them for a short period under its own policies.
We do not use advertising, third-party analytics or tracking, and we do not sell personal data.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Reviewing your access request and creating your account | Taking steps at your request before entering a contract |
| Providing the Service: signing you in, storing and syncing your boards, sending account emails | Performance of our contract with you |
| Invoicing and accounting | Legal obligation |
| Session statistics, to improve MindBoard | Our legitimate interest in understanding how the product is used, kept to aggregate figures |
| Keeping the Service secure and investigating misuse | Our legitimate interest in a secure service |
| Telling you about important changes to the Service or these policies | Performance of our contract with you |
We will only send you marketing email if you ask for it, and you can stop it at any time.
These bases come from the EU General Data Protection Regulation (GDPR) and the Law of Georgia on Personal Data Protection.
4. Who processes data for us
We use these service providers ("sub-processors"). Each processes data only on our instructions.
| Provider | What for | Where the data is |
|---|---|---|
| Supabase | Database, sign-in, real-time sync between participants | European Union (Ireland) |
| DigitalOcean | Serving the app's files to your browser | European Union (Frankfurt, Germany) |
| Google (Google Workspace) | Sending account emails and handling our email | Google's data centres, which may be outside the EU, including in the United States |
| A bank in Georgia (named on your invoice) | Receiving invoice payments | Georgia |
We may also disclose data when the law requires it, for example to tax authorities.
5. Your clients' information in your boards
MindBoard is not designed to hold client records, and our Terms of Service ask coaches not to enter health information or other special categories of data. If a coach puts information about a client into a board, the coach is the controller of it and we process it on the coach's behalf, under the data processing terms in our Terms of Service. If you are a coach's client and want to exercise your rights over that information, please contact your coach. If you contact us, we will pass your request on to them.
6. International transfers
Our database is in the EU. MindBoard LLC is based in Georgia and administers the Service from there, and some of our providers are based in the United States. Our providers' data processing agreements include the European Commission's Standard Contractual Clauses for transfers out of the EU.
7. How long we keep it
- Account and boards: for as long as your account exists. After you close your account, we delete them within 30 days.
- Session statistics: for as long as your account exists. When you close your account, your session statistics are immediately separated from your account. What remains are counts and timestamps, with no name, email or board content.
- Access requests: while your account exists. A request that is not approved is deleted after 12 months.
- Backups: we do not currently keep separate backups. If we start, deleted data will be removed from them within 30 days.
- Invoices and payment records: for the period Georgian tax law requires (currently six years).
- Email: notification emails about access requests stay in our mailbox until we delete them.
8. Your rights
You can ask us to:
- give you a copy of your personal data (you can also export any board yourself as a JSON file or a PNG image);
- correct it;
- delete it, or close your account;
- restrict or object to how we use it, including the session statistics;
- give it to you in a portable format.
Email info@mindboard.me. We will answer within one month. You can also complain to a data protection authority: in Georgia, the Personal Data Protection Service; in the EU, the authority in the country where you live or work.
9. Security
Data is sent over encrypted connections. Your boards are stored in a database hosted in the European Union, protected by access rules that let only the board's owner read or change it directly. When Shared Access is on, anyone you give the board's link (and its password, if you set one) can join, see and change the board during the session. The live session runs over a channel that can only be reached with a secret key, which is given only to people who pass that check and is replaced when you turn sharing off or change the password. Passwords and board passwords are stored only in hashed form. Only MindBoard's administrator can reach account data, and only to run the Service.
10. Cookies and browser storage
MindBoard does not use cookies for tracking or advertising. The app itself sets no cookies; our hosting provider's network (Cloudflare) sets one short-lived security cookie, __cf_bm, to protect the site from automated traffic. The app uses your browser's local storage to keep you signed in and to remember display preferences on your device. All of this is strictly necessary for the Service to work, so no consent is needed. The app loads no third-party scripts, fonts or other files.
11. Age
MindBoard is for professionals aged 18 or over. We do not knowingly collect data from anyone under 18 who has an account.
12. Changes to this policy
If we change this policy in a way that matters, we will email account holders at least 30 days in advance.
13. Contact
MindBoard LLC — info@mindboard.me — 51 Meskheti St., Borjomi, Georgia