Privacy Policy

1. Our role

For account data, customer company data, billing data, Service usage data and data in support cases sent to us, the Company is the data controller.

For content that customer companies and their users create, upload or import in their workspaces — projects, issues, comments, sprints, releases, custom field values, project documents, Markdown files, attachments, and data imported from Jira or moved in from another customer company ("Customer Content") — the customer company is the data controller and the Company acts as a data processor, on its behalf and on its instructions only. To exercise your rights over data in Customer Content, please contact that company's administrator first.

The customer company's instructions are the Terms of Service and the way the customer company and its users configure and use the Service — for example importing data, moving a project to another customer company, setting up webhooks and connecting AI agents. As data controller, the customer company must have a lawful basis for the personal data that it or its users bring into the Service, including data about third parties such as names in data imported from Jira, and must inform data subjects as the law requires.

2. Personal data we collect

• Account data: name, email address, password (stored only as an irreversible hash), email verification status and language.
• Google or Microsoft sign-in data (when you choose it): the provider's account identifier, name, email address, email verification status and the link to your Google profile picture (if the provider sends one). We never receive your Google or Microsoft password.
• LINE data (when you link a LINE account in your settings): your LINE user ID, LINE display name, the link to your LINE profile picture, whether you have added the BoardMark LINE Official Account as a friend, and your LINE notification settings. We never receive your LINE email address or password, and we do not keep messages you type in the LINE chat.
• Telegram data (when you link a Telegram account in your settings): your Telegram user ID (which is also your private chat ID with the BoardMark bot), your Telegram display name and, if you have one, your username, whether the bot can still message you (it cannot after you block it), and your Telegram notification settings. We never request or receive your phone number, and we do not keep messages you type to the bot.
• Profile picture (when you set one): the settings of a cartoon you build, or a picture you upload or choose to copy from a linked Google or LINE account, which we store ourselves as small image files (uploads are resized in your browser and carry no EXIF or location data). A photo or camera image used with "From a photo" is processed in your browser only and never sent to our servers.
• Two-step sign-in data (when you turn it on): the authenticator app's secret key (stored encrypted), hashes of your recovery codes, when a code was last used, browsers you ask us to "remember" (stored as hashes), and requests to turn two-step sign-in off, with their times, how identity was checked, and who requested, confirmed or cancelled them.
• Device notification (web push) data (when you turn it on): the endpoint address and encryption keys your browser issues, a device name (such as the browser and operating system), language and the time of the last successful delivery, together with your device notification settings.
• Company and tax data: company name, type (individual or juristic person), tax ID, head office or branch, address, billing email, national ID number (only if you enter it) and withholding tax certificates (50 Tawi) you upload.
• Payment data: invoice and payment history, payment references and coupon redemptions (code, customer company, the user who redeemed it and when). Card data is processed by the payment provider; we do not store full card numbers.
• Membership data: the companies you belong to, your role, seat status, teams, project permissions and invitations.
• Customer Content: data contained in the work that you or your colleagues create, upload or import.
• Usage and technical data: IP address, browser and device type (user agent), access times, sessions and signed-in devices, sign-in history (including the sign-in method) and failed sign-in attempts, change history, tokens for AI agents and apps you authorise, the name of the app or AI client you authorise through OAuth or the token's name, the MCP tool used and the request id, which are recorded with changes and in the audit log, the entries in your notification bell, and security logs.
• Correspondence and support cases: messages and emails you send us, and data in support cases — the opener's name and email, a phone number and company name (optional, on the form that needs no sign-in only), category, severity, subject, messages, attachments, diagnostic context attached when you tick the consent box (the open project, the page, browser, app version and the request id of the last error) and a hash of the IP address used to limit submissions.

3. Where the data comes from

Directly from you when you sign up, use the Service or contact us; from a customer company's administrator when you are invited to join; from Google or Microsoft when you choose to sign in with them; from LINE when you link your LINE account; from Telegram when you link your Telegram account; from your browser when you turn on device notifications; from the payment provider about the result of a payment; from a customer company that imports data from Jira (such as the names of assignees, reporters and comment authors in Jira) or moves a project in from another customer company; and from a customer company's administrator who confirms your identity in a request to turn off two-step sign-in.

4. Purposes and legal bases

• To create and maintain your account, authenticate you, provide the Service you request and send the emails it needs — email verification, password reset, invitations, work notifications by email, by LINE, by Telegram or on your devices where you turn them on, and entries in the notification bell, including sending events to webhooks that administrators set up: performance of a contract (section 24(3)).
• To run two-step sign-in, handle requests to turn it off, and send account security alerts by email and — where you have linked or turned them on — by LINE, by Telegram and on your devices; security alerts cannot be turned off: performance of a contract and legitimate interests (sections 24(3) and 24(5)).
• To receive and answer support cases, investigate problems and help users who cannot complete two-step sign-in themselves, including checking the requester's identity: performance of a contract and legitimate interests (sections 24(3) and 24(5)).
• To email our staff when a new account signs up (name, email, sign-up method, email verification status and the customer company created or joined) and when a support case is opened or a customer replies (the opener's name and email, the customer company, the subject and an excerpt), so that we can look after customers and the Service: legitimate interests (section 24(5)).
• To let a customer company's administrators review the use of their company through the audit log: legitimate interests of the Company and of the customer company (section 24(5)).
• To calculate fees, issue invoices, tax invoices and receipts, collect payment and follow up on payment: performance of a contract and compliance with law, such as the Revenue Code and accounting law (sections 24(3) and 24(6)).
• To keep the Service secure, prevent unauthorised access, fraud and spam, limit request rates, investigate anomalies and keep evidence of actions: legitimate interests (section 24(5)).
• To operate, troubleshoot and improve the Service and to answer your questions: legitimate interests (section 24(5)).
• To comply with orders of competent authorities or courts: legal obligation (section 24(6)).

We do not send you marketing messages without your consent, which you may withdraw at any time. We do not sell personal data, and we do not use Customer Content to train artificial intelligence models.

If you do not provide data that is needed to enter into the contract or required by law, we may be unable to provide some or all of the Service to you.

5. Disclosure

We disclose personal data only as necessary, to:

• administrators and members of the same customer company, who see your name, email, profile picture, role and workspace activity according to their permissions;
• the administrators of every customer company you belong to, who can view and export that company's audit log, including your sign-ins (time, sign-in method, IP address and browser or device) and actions taken through AI agents (client name, token kind, MCP tool and request id);
• all members of a customer company, including AI agents that members connect with their own permissions, who can see and answer the support cases opened on behalf of that company;
• administrators of a customer company you belong to, when our staff handle a request to turn off your two-step sign-in: they may be asked to confirm your identity, which shows them your name and email and that such a request exists;
• the receiving customer company, when an administrator of your customer company approves moving a project to it: the project's content, including the names of the original reporters, assignees and comment authors (as text), is copied to that company, which is the controller of that copy;
• service providers processing data on our behalf — server and storage hosting, backup storage, email delivery and payment processing (Omise, through the Company's payment gateway) — who are contractually bound to use it only to provide their services to us;
• Google or Microsoft, only when you choose to sign in with them; their own policies govern your use of their services;
• LINE, only when you link a LINE account: to sign you in and to deliver the work notifications you turn on and account security alerts through the BoardMark LINE Official Account, so the notification text (such as the project name, the issue key and title, and who made the change) passes through LINE's systems; LINE's own policies govern your use of LINE;
• Telegram, only when you link a Telegram account: to sign you in and to deliver the work notifications you turn on (companies on a paid plan: Pro or Premium) and account security alerts through the BoardMark bot, so the notification text (such as the project name, the issue key and title, short excerpts and names) passes through Telegram's systems; Telegram's own policies govern your use of Telegram;
• the push service your browser uses — Google (Firebase Cloud Messaging), Mozilla, Apple or Microsoft — only when you turn on device notifications; notification content is encrypted from us to your browser, so that provider sees only delivery data such as the endpoint address, size and time;
• webhook destinations set up by a project administrator or company administrator, such as Slack, Microsoft Teams, Google Chat, Discord or the customer company's own systems, which receive the data of the chosen events — such as the issue key and title, status, the names of the person who acted and the assignee, and an excerpt of a comment (at most 300 characters) — but no one's email address; these deliveries follow the customer company's instructions;
• Atlassian (Jira), when a customer company's administrator imports data from Jira Cloud: we use the Jira account email and API token the administrator enters to connect to that Jira site during that import only, and we do not store the API token in our database or logs; an import from CSV files uses only the data in the files;
• AI agents or apps that you or users of your company connect through MCP or a token, which can access data only within the permissions of the user who authorised them; the provider of such an agent is a third party of your choosing;
• government authorities, courts or officers with legal power, when we are required to disclose;
• a successor in a merger, sale or transfer of business, who must protect the data in line with this policy.

6. International transfers

We store and process the Service's data in Thailand, on Amazon Web Services (AWS) in the Asia Pacific (Thailand) region, Bangkok: the database, files and attachments, and backups.

Some service providers may process part of the data outside Thailand, such as the content delivery network (Amazon CloudFront) that delivers the web pages and app files, our email delivery provider, LINE for LINE sign-in and LINE notifications, Telegram for Telegram sign-in and Telegram notifications, browser push services for device notifications, Atlassian when data is imported from Jira, and Google's storage, from which your browser downloads a face-detection model when you use "From a photo" (section 10). In that case we transfer data in accordance with sections 28 and 29 of the PDPA and put appropriate contractual safeguards in place with those providers. Webhook destinations and AI agents, which may be outside Thailand, are destinations that the customer company or the user chooses and instructs us to send data to.

We have no other hosting region: customer companies and users outside Thailand are served from the same region, so their data is transferred to and stored in Thailand. Section 14 explains how this transfer is protected for people in the European Economic Area (EEA) and the United Kingdom.

7. Retention

• Account data and Customer Content: kept for as long as the account or workspace exists, until it is deleted as described in this section.
• Deleting your account: when you delete your account you choose either to keep your data for 1 year so that you can come back (the default), or to delete it permanently now. If you keep it, your account is suspended at once: you are signed out on every device, your tokens and connected apps are revoked, and your data is moved to an archive for 1 year. Within that year you can sign in again to restore your account, or choose "start fresh" to delete the old data immediately and begin with a new account. After 1 year the data is deleted for good automatically; we email you a reminder 30 days before. If you choose to delete permanently now, we remove your data from live systems immediately.
• When your account is suspended and kept for 1 year, we immediately delete your device-notification devices, the browsers remembered for two-step sign-in, your sessions and your profile picture. Your two-step sign-in settings and recovery codes (stored encrypted or as hashes) are kept so that we can verify you when you restore your account, and are deleted with the account when it is deleted for good.
• Customer companies you own alone (you are their only administrator, including your individual company): their data is archived, restored or deleted together with your account. Content you wrote in other customer companies, such as issues, comments and docs, stays with those companies as part of their records; your name remains there as plain text.
• LINE data: kept only while your LINE account is linked, and deleted when you unlink it or delete your account (whether you keep your data for 1 year or delete it permanently now).
• Telegram data: kept only while your Telegram account is linked, and deleted when you unlink it (in your settings or with the bot's /unlink command) or delete your account (whether you keep your data for 1 year or delete it permanently now).
• Customer companies or projects deleted by an administrator: can be restored for 30 days and are then deleted for good, or earlier when a company administrator chooses to delete them now. If a customer company on the Premium plan chooses "keep history after permanent deletion" when deleting a project, we build an archive of that project (every version of its Markdown files and the change history, including the names of the people who made the changes, but no attachments) and keep it until a company administrator deletes it or the customer company is deleted for good.
• Attachments deleted by a user or a company administrator: removed from live systems at once and cannot be restored; copies in backups are removed as the backups rotate, as set out in this section.
• Profile picture: kept until you change or remove it, or your account is suspended or deleted; copies cached by browsers or the content delivery network may still show for a while.
• Two-step sign-in data: kept while you use two-step sign-in and deleted when you turn it off or a request to turn it off takes effect. A remembered browser ("remember this device") lasts 30 days. Notes our staff make about the identity check in a request to turn off two-step sign-in are kept for 1 year.
• Device-notification devices: kept until you remove the device, the browser's push service reports that the subscription is no longer valid, or your account is suspended or deleted.
• Delivery records of emails, LINE messages, Telegram messages, device notifications and webhooks (including the webhook delivery history administrators see) and entries in the notification bell: 30 days.
• Notices we send to all users (such as notice of changes to the Terms or this policy): a record of which account it was sent to, when, and the result (with the reference printed in the email), kept for 3 years as proof of notice; notice entries in the notification bell are kept for 90 days, or until 30 days after the effective date when announced in advance.
• Support cases (messages, attachments, diagnostic context and the IP address hash): kept while the customer company that owns the case exists, and no longer than 2 years after the case is closed. The link for viewing a case sent without signing in works until 30 days after the case is closed.
• The Jira email and API token used for an import: not stored, used only while the import runs; working data of an import is cleared when the import finishes or expires.
• Requests to delete data under section 9: once we have verified the request, we delete the data from live systems without undue delay, except data we must keep by law as set out in this section.
• Backups: copies of deleted data in backups are removed as the backups rotate, within 30 days.
• Invoices, tax invoices, receipts and supporting accounting and tax records: kept for at least 5 years from the date of issue, or longer where the law requires, even after an account or customer company is deleted.
• A customer company's audit log: 1 year, then deleted automatically, or deleted with the customer company when it is deleted for good.
• Other security logs: kept for as long as needed for security, audit and the establishment or defence of legal claims.

8. Security

We apply appropriate organisational and technical measures, including TLS encryption in transit, hashing of passwords and tokens, role-based access control, logging of staff access, regular backups and protection of tax documents against modification or deletion. You are responsible for keeping your password and tokens confidential.

In addition, two-step sign-in secret keys and webhook URLs and secrets are stored encrypted with AES-256-GCM, recovery codes are stored as hashes, device notification content is encrypted from us to your browser, JSON webhook deliveries are signed so that the receiver can verify them and are sent only to public https addresses, every request to turn off two-step sign-in waits 24 hours and is notified to the account owner, and our staff cannot sign in as you.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee and you as required by law.

9. Your rights

Under the PDPA you have the right to:

• access your personal data and obtain a copy;
• receive your data, or have it sent or transferred, in a machine-readable format;
• object to the collection, use or disclosure of your data;
• have your data erased, destroyed or anonymised;
• have the use of your data restricted;
• have your data corrected so that it is accurate, up to date, complete and not misleading;
• withdraw consent where we rely on consent;
• lodge a complaint with the Office of the Personal Data Protection Committee.

To exercise these rights, contact us as described in section 12. We may ask you to verify your identity first and will respond within 30 days of receiving your request. We may refuse a request where the law allows — for example, where tax law requires us to keep records — and will tell you why. You can also change your password and manage linked Google, Microsoft or LINE accounts, two-step sign-in, signed-in devices, device-notification devices, notification settings and your profile picture yourself in your account settings.

10. Cookies and browser storage

The Service uses only cookies and browser storage that are strictly necessary for it to work or that remember choices you make:

• the board_session cookie, which keeps you signed in, for 14 days from your last use and at most 30 days from signing in;
• the board_oidc cookie, which protects signing in or linking with Google, Microsoft, LINE or Telegram against request forgery, for at most 10 minutes;
• the board_mfa cookie, for the second step of signing in when you use two-step sign-in, for 15 minutes;
• the board_trust cookie, when you choose "remember this device" in the second step of signing in, for 30 days;
• the ib_lang cookie, which remembers the language you chose on the website and in the app, and the ib_mywork cookie, which remembers whether you hid or showed the "My work" panel, for 1 year;
• browser settings kept in local storage and session storage — such as the light or dark theme, board views and your starred and recent projects — which are not sent to our servers;
• the app's service worker, installed in browsers that support device notifications, used only to receive and show device notifications (not to store web pages on your device), which keeps the device name, language and the Service's public key in your browser.

We do not use advertising cookies or third-party analytics cookies. If you disable strictly necessary cookies, you will not be able to sign in.

When you use "From a photo" to make a profile picture, your browser downloads a face-detection model (MediaPipe) from Google's storage (storage.googleapis.com), so Google receives your IP address and browser details as with any file download. This happens only when you use that option, and your photo is not sent anywhere.

11. Minors

The Service is designed for organisations and adults. We do not knowingly collect data about minors; if we learn that a minor's data was provided without the consent of the person exercising parental authority, we will delete it.

12. Contact

For questions or to exercise your rights over personal data, contact I C Develop Company Limited (Head Office) at the address, email and phone numbers at the end of this document, with the subject "Personal data request".

13. Changes to this policy

We may update this policy from time to time. We will publish the new version on this page with its effective date and, for material changes, notify users by email or in the Service reasonably in advance.

14. People in the EU / EEA and the UK (GDPR)

This section applies in addition to the rest of this policy when the EU General Data Protection Regulation (GDPR), or the UK GDPR and the UK Data Protection Act 2018, apply to our processing of your personal data — for example, when you use the Service from the European Economic Area (EEA) or the United Kingdom, or your customer company is established there.

Our roles are those in section 1: we are the controller of account, customer company, billing, usage and support case data, and a processor of Customer Content on behalf of the customer company, which is its controller. We process Customer Content on the customer company's documented instructions — the Terms of Service, this policy and the customer company's settings — and with the commitments of a processor under Article 28 GDPR: confidentiality of our staff, security measures (section 8), the service providers in section 5 as sub-processors, help with data subjects' requests and personal data breaches, and deletion or return of the data when the service ends (section 7). A customer company that needs a signed data processing agreement can ask us as described in section 12.

Our legal bases under Article 6(1) GDPR match section 4:

• performance of a contract (Article 6(1)(b)) — your account, the Service you request and the emails and notifications it needs, two-step sign-in, support cases and billing;
• compliance with a legal obligation (Article 6(1)(c)) — invoices, tax invoices, receipts and the accounting records Thai law requires, and orders of competent authorities;
• legitimate interests (Article 6(1)(f)) — keeping the Service secure and preventing abuse, the audit log for customer company administrators, alerts to our staff about new accounts and support cases, and operating and improving the Service; you may object to this processing at any time;
• consent (Article 6(1)(a)) — only where we ask for it, such as marketing messages; you may withdraw it at any time without affecting processing before the withdrawal.

The data is stored in Thailand (section 6), for which there is no adequacy decision of the European Commission or the United Kingdom. We protect transfers of personal data from the EEA to Thailand with the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), and transfers from the United Kingdom with the UK International Data Transfer Addendum to those clauses. These clauses form part of our agreement with each customer company in the EEA or the United Kingdom, and we put the same kind of safeguards in place with the service providers outside Thailand that process the data for us. You can ask us for a copy of the clauses as described in section 12.

You have the right to access, rectify and erase your personal data, to restrict or object to its processing (including processing based on legitimate interests), to data portability and to withdraw consent. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. To exercise these rights, contact us as described in section 12; we answer within one month (extendable by up to two further months for complex requests, in which case we will tell you). For Customer Content, we pass your request to the customer company, which is the controller, and help it answer. We keep data for the periods in section 7.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live or work or where an alleged infringement took place, or in the United Kingdom with the Information Commissioner's Office (ICO).

15. California residents (CCPA)

This section applies to residents of California, United States, to the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies to us.

In the last 12 months we collected the categories of personal information described in section 2 — identifiers (such as name, email and IP address), commercial information (billing and invoices), internet or other electronic network activity (usage and security logs) and professional information (your customer company and role) — from the sources in section 3, for the business purposes in section 4; we disclosed them for those purposes to the recipients in section 5, and we keep them for the periods in section 7.

We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We use sensitive personal information (such as account passwords, stored only as hashes) only to provide the Service and keep it secure, not to infer characteristics about you.

You have the right to know which personal information we collect, use and disclose about you and to access it, to have it deleted or corrected, and not to be discriminated against for exercising these rights. Because we do not sell or share personal information, there is nothing to opt out of. You or an authorised agent can make a request as described in section 12; we will verify your identity (and the agent's authority) and answer within 45 days.