Privacy Policy

Last updated: February 25, 2026

1. Overview

AI Board of Directors ("the Service") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights regarding that data.

2. Data We Collect

Data Type	What We Store	Where
Account info	Email address, hashed password	Supabase Auth
Deliberation history	Questions, context, responses, synthesis	Supabase Postgres
Usage logs	Deliberation count per month	Supabase Postgres
Subscription info	Plan status, Stripe customer ID	Supabase Postgres + Stripe
Payment info	Handled entirely by Stripe	Stripe (PCI compliant)

3. Data We Do NOT Collect

API Keys: Your API keys for Anthropic, OpenAI, and Google are never stored on our servers. They are:

Stored only in your browser's session storage (cleared when you close the tab).
Transmitted to our backend over HTTPS only during active requests.
Held in server memory solely for the duration of a single HTTP request.
Never written to disk, database, or logs on our servers.

4. How We Use Your Data

Account info: To authenticate you and manage your account.
Deliberation history: To provide you with access to your past deliberations. Your history is private — only you can see your own data.
Usage logs: To enforce subscription tier limits (free tier: 5/month).
Subscription info: To manage your billing and provide the correct tier of service.

We do not sell, share, or monetize your data in any way beyond providing the Service to you.

5. Third-Party Services

Supabase

We use Supabase for authentication and database hosting. Your account data and deliberation history are stored in Supabase's infrastructure, which provides encryption at rest and in transit. Supabase Privacy Policy.

Stripe

Payment processing is handled entirely by Stripe. We never see or store your credit card details. Stripe Privacy Policy.

AI Providers (Anthropic, OpenAI, Google)

When you run a deliberation, your questions are sent to these providers using your own API keys. Your relationship with these providers is direct — their privacy policies and data handling practices apply to the content you send through their APIs. We recommend reviewing each provider's data usage policies.

6. Data Security

All data in transit is encrypted via HTTPS/TLS.
Database data is encrypted at rest by Supabase.
Row Level Security ensures users can only access their own data.
API keys are never persisted — they exist in server memory only during request processing.
Authentication uses industry-standard JWT tokens.

7. Data Retention

Deliberation history: Retained for as long as your account is active. Free tier users' history is limited to the most recent 10 deliberations in the UI (all are stored).
Usage logs: Retained indefinitely for analytics and billing purposes.
Account data: Retained until you delete your account.

8. Your Rights

You have the right to:

Access: View all data we hold about you (available through the app and upon request).
Deletion: Request complete deletion of your account and all associated data by contacting us.
Export: Request an export of your deliberation history.
Correction: Update your email address through the settings panel.
Withdraw consent: Delete your account at any time.

These rights apply regardless of your location, in compliance with GDPR (EU), CCPA (California), and similar data protection regulations.

9. Cookies

We use only essential cookies required for authentication (Supabase session management). We do not use tracking cookies, analytics cookies, or advertising cookies.

10. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

For privacy-related questions or data requests, contact us at privacy@rishonlgcy.tech.