Boardify
Launch Canvas
Back to HomeEffective Date: October 2026
GDPR (EU) & DPDP (INDIA) COMPLIANCE FRAMEWORK

Privacy Policy

Boardify (“we”, “our”, or “us”) is dedicated to safeguarding your personal data and digital privacy. This policy outlines how we collect, process, store, and protect your information across our spatial whiteboard and WebMCP autonomous agent platform in accordance with the European Union General Data Protection Regulation (GDPR - Regulation EU 2016/679) and India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Your Data Ownership

You own 100% of your notes, diagrams, sketches, and exported SQL architectures. We never sell your personal data.

Strict Encryption

All data transmitted over 256-bit TLS/SSL encryption. Authentication and data at rest protected via Firebase and Google Cloud.

Global Privacy Rights

Right to Erasure (“Right to be Forgotten”), Right to Correction, Data Portability, and Grievance Redressal guaranteed.

1. Information We Collect

We collect minimal personal data necessary to deliver physical-feel sketching and spatial AI agent execution:

  • Account & Identity Data: When registering via email/password or Google OAuth, we receive your name, email address, profile picture (if Google login), and unique account identifier managed by Firebase Authentication.
  • Canvas Artefacts & Content: Sticky notes, relational SQL ER schemas, connector wires, diagram DSL definitions, and pen stroke paths created during sessions.
  • Payment & Billing Data: Transaction ID, currency (INR / USD), selected plan tier, and payment timestamp processed through Razorpay Standard Checkout. We never store credit card numbers, CVVs, or bank netbanking passwords on our servers.
  • Technical & Telemetry Data: IP address, device capabilities (retina DPR, stylus pressure sensitivity, touch capabilities), browser user-agent, and WebMCP protocol compliance indicators.

2. Legal Grounds for Processing (GDPR Art. 6 & DPDP Act Sec. 4)

We process personal data only when lawful grounds exist:

Contractual Necessity

Fulfilling our agreement to provide whiteboard rendering, cloud syncing, multi-cursor presence, and subscription entitlements.

Explicit User Consent

Freely given, specific, and unambiguous consent collected during signup, cookie consent banner, or AI tool enablement.

Legitimate Interests

Detecting abuse, preventing unauthorized API exploitation, maintaining server security, and ensuring WebMCP tool reliability.

Legal Compliance

Retaining GST transaction receipts and invoices in accordance with applicable tax and corporate accounting laws.

3. Rights of Data Principals (DPDP) & Data Subjects (GDPR)

Under both GDPR and the Indian DPDP Act 2023, you hold comprehensive rights over your personal data:

Right to Access & Summary: You can request a summary of your personal data processed by Boardify and the identity of all sub-processors.
Right to Correction & Updating: You may update inaccuracies in your profile name, email, or credentials anytime in your settings or via password reset.
Right to Erasure (“Right to be Forgotten”): You have the right to request the complete deletion of your account, boards, and personal data from our systems.
Right to Data Portability: Boardify natively enables exporting all canvases to Markdown, JSON graph snapshots, and SVG vector images at any time.
Right to Grievance Redressal: Contact our Grievance Officer directly (see Section 7) for resolution within thirty (30) days as stipulated by DPDP and GDPR.

4. WebMCP Protocol & Autonomous Agents Privacy

Boardify implements the open WebMCP standard (document.modelContext.registerTool). When an AI browser agent interacts with your board:

  • Agent tool executions occur entirely in your local browser sandbox context.
  • No whiteboard data is transmitted to third-party LLM providers unless you explicitly invoke an AI agent with your own API key or ChatGPT browser agent.
  • You may wipe canvas memory or disable agent studio anytime from the top toolbar.

5. Sub-processors & Third-Party Infrastructure

We work with trusted industry sub-processors who meet strict security standards:

Google Cloud & FirebaseAuthentication, Firestore real-time database, and encrypted storage. Compliant with ISO 27001, SOC 2, and GDPR Standard Contractual Clauses (SCCs).
Razorpay Software Pvt. Ltd.Payment gateway processing INR and USD transactions. Certified PCI-DSS Level 1 Service Provider and RBI-authorized payment aggregator.

6. Children's Privacy (DPDP Section 9)

Boardify is designed for professional visual thinkers, engineers, designers, and adult students. We do not knowingly process personal data of children under 18 years of age without verifiable parental/guardian consent. If we identify that a minor's data has been provided without consent, we delete such information immediately.

7. Data Protection & Grievance Officer Contact

In compliance with Rule 3(2) of the Information Technology Rules, 2021, and the DPDP Act, 2023, the designated Grievance and Data Protection Officer for Boardify is:

Designation: Data Protection & Grievance Officer

Entity: Boardify Studio

Email: privacy@boardify.app · grievance@boardify.app

Response Turnaround: Maximum 30 calendar days