Privacy Policy

BoardScore Pty Ltd (ABN pending) ("BoardScore", "we", "us", "our") operates the BoardScore governance platform at boardscore.io. We are an Australian company and your account data is stored and processed on Australian infrastructure. The one exception is our AI features: where your organisation uses them, the content of those requests is processed by an AI provider outside Australia. Sections 6 and 11 explain exactly what is sent, and how your organisation can route that processing through its own provider instead.

We collect only the information necessary to provide and improve our services. The types of personal information we collect include:

• Account information: name, email address, and organisational role when you create an account or are invited by your organisation.
• Organisation information: organisation name and details provided during onboarding.
• Usage data: information about how you interact with the platform, including pages visited, features used, and session duration.
• Technical data: IP address (encrypted at rest), browser type, device information, and operating system.
• Support data: any information you provide when contacting our support team.

We do not collect sensitive information as defined under the Privacy Act unless it is directly relevant to the governance assessments you choose to conduct within the platform.

We use your personal information for the following purposes:

• Providing and operating the BoardScore platform and your organisation's account.
• Authenticating your identity and managing access permissions.
• Sending transactional communications such as account invitations, password resets, and service notifications.
• Improving the platform through aggregated, de-identified usage analytics.
• Responding to support enquiries and providing technical assistance.
• Complying with legal obligations and enforcing our terms of service.

We do not use your personal information for marketing purposes without your explicit consent. We do not sell or rent your personal information to third parties.

We implement multiple layers of security to protect your data:

• Encryption at rest: personally identifiable information is encrypted with AES-256-GCM at the column level before storage, with unique initialisation vectors per value.
• Encryption in transit: all communications are encrypted via TLS with automatic certificate management.
• Tenant isolation: each organisation's data is stored in a dedicated database schema. There are no shared data tables between organisations.
• Access control: role-based access control with five distinct roles and capability-based permissions.
• Audit logging: all access and permission changes are logged with full attribution.
• Infrastructure: Australian-hosted, distroless container images, non-root execution, and pre-commit secret scanning.

For a detailed description of our security architecture, please visit our Security page.

We use a limited number of third-party services to operate the platform. Each is selected for its security posture and compliance practices:

• Kinde: identity provider for authentication. Kinde processes your email address and authentication credentials. We do not store passwords.
• Stripe: payment processor for subscription billing. Stripe processes your payment details directly — we do not store credit card numbers or bank account details.
• Anthropic: AI provider for the platform's AI features. Where those features are used, Anthropic processes the content of the request outside Australia. Section 6 sets out what is sent and what your options are.
• Cloud hosting: infrastructure hosted within Australian data centres.
• OpenTelemetry-compatible observability: for application monitoring and error tracking. Logs containing personal information are encrypted.

We do not share your personal information with third parties for their own marketing or advertising purposes.

Parts of the platform use a large language model: evidence grading, assessment narratives, risk assessment, and framework commentary. Where your organisation uses these features, the content they operate on is sent to an AI provider for processing and the result is returned to your organisation's account. This section describes that processing specifically, because it is the one place your content is handled outside our own infrastructure.

• What is sent: the assessment content or uploaded evidence the feature operates on, together with the instructions telling the model what to do with it. Where evidence grading is part of your plan, a document is graded automatically when it is uploaded.
• What is not sent: passwords, authentication tokens, payment details, and the content of any other organisation. Every request is assembled from your own organisation's data alone.
• Where it is processed: our AI provider is Anthropic, which processes requests outside Australia. This is a disclosure to an overseas recipient for the purposes of Australian Privacy Principle 8 — see section 11.
• Training: under our commercial agreement with Anthropic, content sent through their API is not used to train their models.
• What we record: the model used, token counts, duration and cost are recorded in your organisation's own database schema so you can see your AI usage. Generated output is stored alongside the assessment it belongs to. Neither is shared with other organisations.

Bring your own key. An organisation may supply its own AI provider credential under Organisation settings → AI provider key. Requests are then sent to the provider and endpoint you nominate, governed by your own agreement with that provider and billed to your account rather than ours — which is how an organisation with a data-residency obligation we cannot meet can meet it itself. Your credential is encrypted with AES-256-GCM before storage; it is never displayed again and no part of our API can return it.

Choosing not to use AI. AI narrative generation is off by default and is switched on by an organisation administrator. The remaining AI features come with the plan modules your organisation subscribes to; if you need them disabled for your organisation, contact us at privacy@boardscore.io.

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy:

• Active account data is retained for the duration of your organisation's subscription.
• Upon account termination, personal information is deleted within 90 days, except where retention is required by law.
• Audit logs are retained for a minimum of 7 years to support compliance and regulatory requirements.
• Aggregated, de-identified analytics data may be retained indefinitely as it cannot be linked to individuals.

Under the Australian Privacy Principles, you have the following rights:

• Access: you may request a copy of the personal information we hold about you.
• Correction: you may request correction of inaccurate or outdated information.
• Complaint: you may lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached.
• Erasure: you may request deletion of your personal information, subject to our legal retention obligations.

To exercise any of these rights, contact us at privacy@boardscore.io. We will respond to all requests within 30 days.

BoardScore uses only essential cookies required for platform functionality, such as session management and authentication state. We do not use third-party advertising cookies or cross-site tracking technologies.

If we introduce optional analytics cookies in the future, we will update this policy and seek your consent before setting them.

BoardScore is Australian-built and Australian-hosted: your account data is stored and processed on Australian infrastructure. Personal information is disclosed to overseas recipients in two circumstances:

• AI processing: where your organisation uses the platform's AI features, the content of those requests is processed by our AI provider outside Australia, as described in section 6. An organisation that needs this processing to happen somewhere specific can supply its own provider credential and nominate its own endpoint.
• Service providers: our identity provider and payment processor may process limited account data outside Australia, in accordance with their own privacy policies and applicable data protection laws.

We take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles. We do not transfer personal information overseas in any other circumstance.

BoardScore is a business-to-business platform designed for corporate governance professionals. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have collected information from a minor, we will take steps to delete it promptly.

We may update this privacy policy from time to time to reflect changes in our practices or legal obligations. We will notify you of material changes by posting a notice on the platform or sending an email to your registered address. The effective date at the top of this page indicates when the policy was last revised.

If you have any questions, concerns, or requests regarding this privacy policy or our handling of your personal information, please contact us:

• Email: privacy@boardscore.io
• Entity: BoardScore Pty Ltd
• Location: Australia

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.