How BoardCraft handles your information.

1. Who We Are

BoardCraft is the online classroom bulletin board, printable decor, and teacher-seller design service available at boardcraft.app. In this policy, "BoardCraft," "we," "us," and "our" refer to BoardCraft as the operator of the Service.

For privacy questions or requests, contact us at support@boardcraft.app. For privacy-law purposes, BoardCraft is generally the controller of personal information relating to website visitors, account holders, billing administration, marketing communications, and support requests.

If an educator, school, district, organization, or other account holder uploads or creates content containing personal information about students or other people, that account holder may be the controller of that content and BoardCraft may process it as a service provider or processor.

2. Scope

This policy applies to personal information collected through:

• The BoardCraft website, public pages, pricing pages, contact forms, and waitlist forms.
• Account registration, sign-in, email verification, and profile features.
• The editor, dashboard, boards, templates, My Uploads, Image Inserts, Previous Image Insert uploads (the former student-photo vault), folders, thumbnails, and exports.
• Subscriptions, checkout, billing confirmation, billing portals, refunds, and plan administration.
• New-account Terms of Service acceptance and account completion.
• Support requests, service emails, product messages, cookies, analytics, security tools, and similar technologies.

This policy does not apply to third-party websites, platforms, or services that may be linked from BoardCraft. Their own privacy policies govern those services.

3. Personal Information We Collect

Information you provide

• Name, email address, password credentials, account identifiers, display name, profile image, sign-in method, and email-verification status.
• Board titles, board content, text, designs, templates, folders, thumbnails, export settings, editor actions, and related project data.
• Uploaded files, including images, file names, file type, file size, dimensions, storage identifiers, media identifiers, and related metadata.
• Images and artwork supplied by adult account holders, including face and student photos, their placement in Image Inserts, positioning settings such as zoom, rotation, and cropping, and resulting boards, previews, thumbnails, and exports.
• Shared-template titles, thumbnails, design elements, clone activity, and content included in template links.
• Subscription plan, billing-provider identifiers, transaction references, invoices, payment status, refund requests, cancellation status, and account-management details.
• The Terms of Service version accepted when creating a new account and the server-recorded acceptance timestamp. This record is separate from marketing or cookie consent; existing accounts are not assigned historical acceptance they did not provide.
• Contact form messages, support requests, waitlist submissions, marketing preferences, consent choices, and other communications.
• Optional declared country of residence, the server-detected country code, signup email-policy version, displayed enrollment mode, separate email choices, and server-recorded enrollment timestamps. Raw IP addresses are not retained in signup email-enrollment records.

BoardCraft does not intentionally collect or store full payment card numbers. Payment processing is handled by our billing provider.

Account identification and authentication information is required to create and secure an account. Our billing provider requires payment and billing information to process a purchase. Without the required information, we cannot provide account access or complete the purchase. Uploads, profile images, and newsletter or waitlist subscriptions are optional. Choosing not to upload a file affects only features that need that file; you can browse public pages without creating an account or subscribing to marketing messages.

Information collected automatically

• IP address, device type, browser type, operating system, language, approximate location derived from IP address, referral URL, and access timestamps.
• Log data, security events, crash reports, diagnostics, performance data, pages viewed, features used, exports started, and account usage statistics.
• Session identifiers, authentication cookies, browser storage data, anti-abuse tokens, cookie-preference records, and similar identifiers.
• Performance measurements, page URLs and routes, network speed, browser and device information, operating system, country, and measurement timestamps collected through Vercel Speed Insights.
• Error details, request context, and diagnostic logs collected through Sentry. Server and edge monitoring may include personal request data, such as IP addresses or identifying request information.

Information from third parties

• Google, when you use Google sign-in or Google-backed authentication features.
• Freemius, when you purchase, upgrade, cancel, renew, or manage a subscription.
• Email, anti-abuse, analytics, monitoring, and infrastructure providers when they help us deliver messages, protect the Service, diagnose issues, or maintain accounts.

4. How We Use Personal Information

• Create, authenticate, verify, secure, and manage user accounts.
• Provide the editor, save boards, store uploads, generate thumbnails and exports, manage templates, and deliver requested features.
• Store and retrieve images for Image Inserts, combine them with decorative artwork using your positioning settings, and render, save, and export the designs you request.
• Process subscriptions, billing, refunds, plan access, export allowances, account administration, and customer support.
• Operate template-sharing and template-cloning features when you choose to use them.
• Send service messages, including account, security, billing, verification, support, and policy notices.
• Send marketing communications where permitted by law and consistent with your preferences.
• Protect the Service, prevent fraud, block misuse, investigate unauthorized access, enforce our terms, and maintain security.
• Troubleshoot errors, monitor performance, understand product usage, improve existing features, and develop new features.
• Comply with legal obligations, resolve disputes, enforce agreements, and protect the rights, property, safety, and security of BoardCraft, users, and others.

5. Legal Bases

Where the GDPR, UK GDPR, or similar laws apply, we process personal information only where we have a valid legal basis, including:

• Performance of a contract, such as creating your account, providing the Service, saving boards, generating exports, and administering subscriptions.
• Legitimate interests, such as security, fraud prevention, service improvement, operational management, support, and legal protection, where those interests are not overridden by your rights.
• Consent, such as for non-essential cookies, certain analytics, marketing communications, or other processing where consent is required.
• Legal obligation, such as tax, accounting, consumer-protection, regulatory, and law-enforcement obligations.
• Establishment, exercise, or defense of legal claims, where needed to resolve disputes or protect legal interests.

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing that happened before withdrawal.

Optional Firebase Analytics uses your analytics consent. Operational hosting, diagnostics, and security monitoring support our interests in maintaining a reliable and secure Service, subject to applicable law and any consent requirements. Marketing communications require a legal basis appropriate to the communication and your location; subscribing to a newsletter or waitlist is an explicit request for those messages. A cookie choice does not itself subscribe you to marketing emails.

Product updates have a separate email subscription setting. When you allow analytics, BoardCraft can also record clicks from feature announcement links and whether you try the announced feature within seven days of your first click. These observations are associated with your account and help us understand which updates are useful. Declining analytics prevents this optional announcement measurement.

New signups whose selected country of residence and server-detected country are both the United States receive tips and offers and product updates by default when the US signup policy is enabled. Each option is shown separately and can be unchecked before signup. Elsewhere, or when location is unknown or does not match, both email options start unchecked. We record automatic enrollment separately from an explicit opt-in and wait for email verification before applying positive signup enrollment. This policy does not automatically enroll existing accounts or reverse an unsubscribe. You can change each email preference in Account settings or use the preferences link in an email.

6. User Content, Student Information, and Sensitive Data

BoardCraft is designed for teachers, homeschool educators, teacher-sellers, schools, and organizations. You may choose to create boards containing names, photos, classroom materials, or other information about students or third parties.

You are responsible for ensuring that you have the lawful basis, authority, consent, notices, and permissions required before you upload, enter, publish, export, or share personal information about another person.

Image Inserts let you manually position an image inside decorative artwork. This feature does not perform facial recognition, identify people, or create biometric identification templates. Photos may still contain personal information about the people pictured.

New images uploaded through Image Inserts are stored in your account's My Uploads library, where you can reuse and manage them. Images previously uploaded to the student-photo vault remain private and separate under Previous Image Insert uploads; they are not moved into My Uploads. You can select images from either library. Images and related project data are uploaded to and processed by our Service and its providers, rather than remaining only on your device.

Do not upload sensitive information unless you have a clear legal basis and any required written agreement with BoardCraft. Sensitive information may include health information, disability information, government identifiers, financial information, biometric data, religious beliefs, or other highly sensitive personal data.

7. Shared Templates and Public Content

Boards are private by default unless you choose to share, publish, or distribute them. When you create a shareable template link:

• Anyone with the link may be able to view and, where available, clone the template.
• The template title, thumbnail, design elements, and included content may be visible to people who receive the link.
• You should not include student names, student photos, confidential classroom information, or other personal information unless you have the legal right to disclose it.
• Copies made by other users may remain in their accounts after you remove, unpublish, or change the original template.

When you share a board as a template, images attached to Image Insert elements are removed from the shared template and replaced with placeholders. This does not remove photos placed as ordinary images, photos contained in flattened images or exports, student names, or other personal content. Review the template and its preview before distributing the link.

Your own board and its exports can still contain the attached images. Removing an Image Insert image or deleting its upload does not recall downloaded files, screenshots, printed materials, or copies already distributed outside BoardCraft. See the Data Retention section below for how upload deletion affects stored content.

8. How We Share Personal Information

We may share personal information with:

• Service providers and processors that help us operate, host, secure, improve, and support the Service.
• Payment and billing providers that process subscription-related transactions and account-management requests.
• Hosting, authentication, storage, search, analytics, security, email, marketing automation, monitoring, and infrastructure providers.
• Professional advisers, such as lawyers, accountants, auditors, insurers, and consultants, where necessary.
• Government authorities, law enforcement, courts, or regulators, where required by law or necessary to protect rights, safety, or security.
• A buyer, successor, affiliate, or financing party in connection with a merger, acquisition, financing, sale of assets, bankruptcy, or similar transaction.
• Other users or the public when you choose to share a template, publish content, or otherwise make information available through the Service.

Providers receive information needed for their roles in operating the Service. Some providers, including payment and sign-in providers, may also process information under their own privacy policies. This policy does not certify that any particular provider agreement or transfer safeguard has been completed.

9. Service Providers We Use

Depending on the features you use, BoardCraft may use:

• Firebase and Google Cloud for authentication, databases, file storage, analytics, cloud infrastructure, and server-side processing, including storage of Image Insert project data and processing needed for previews and exports.
• Vercel for website and application hosting, request handling, and Speed Insights performance measurement. Speed Insights measures page URLs and routes, browser and device information, operating system, network speed, country, timestamps, and web performance metrics.
• Cloudinary for image and media storage, transformation, delivery, and optimization, including images uploaded for Image Inserts.
• Algolia for search features covering boards, assets, letter sets, fonts, users, and related Service content.
• Freemius for subscription checkout, billing administration, payment-related processing, and customer account management.
• MailerSend for transactional email and contact-form email delivery.
• Cloudflare Turnstile for bot prevention, verification, and abuse protection.
• Loops for newsletter and waitlist subscriptions, contact synchronization, lifecycle messages, and product-related communications. Contact data can include email, name, account ID, plan and subscription status, account role, board count, account and activity timestamps, and indicators of board creation, exports, uploads, or template publishing.
• Sentry for error reporting, diagnostic logs, server and edge performance monitoring, and security-related diagnostics. Server and edge configurations allow personal request data; diagnostic information is not necessarily anonymous.
• Google Fonts and related font services for font catalog and font-related functionality.
• Google generative AI services for internal metadata generation for BoardCraft-managed content, where enabled.

When you allow Firebase Analytics, we associate usage events with your account identifier if you are signed in. Events can include page paths, board identifiers, and feature activity. Sentry and Vercel operational monitoring currently run independently of that optional analytics choice. Their presence does not mean all monitoring is anonymous or that rejecting Firebase Analytics disables all diagnostics.

Loops contact synchronization and lifecycle events are sent from our servers when the integration is enabled. The browser marketing cookie toggle does not control those transfers or your email subscription status. To unsubscribe from marketing messages or object to related processing, email support@boardcraft.app. Essential account, security, billing, and requested support messages may continue. Unsubscribing does not automatically erase contact data; we may retain a suppression record to respect your preference.

We may add, replace, or remove service providers as BoardCraft evolves. We will update this policy when changes materially affect how personal information is handled.

10. International Transfers

BoardCraft may process personal information in Morocco, the United States, the European Economic Area, the United Kingdom, and other countries where we or our service providers operate. These countries may have privacy laws that differ from the laws where you live.

Applicable law may require a recognized transfer mechanism, contractual safeguards, and Moroccan CNDP notification or authorization before a restricted transfer takes place. Our specific transfer arrangements and CNDP filings have not been established. Naming a provider or a country in this policy is not confirmation that a transfer safeguard or authorization is in place. Contact us to request information about the arrangements applicable to your data. This disclosure does not replace any transfer requirements imposed by law.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and preserve business records.

• Account, board, and profile data is retained to maintain your account and saved content. After a deletion request, retention depends on processing that request, remaining content dependencies, applicable backup settings, open security investigations or disputes, and required legal records.
• User uploads, including My Uploads and Previous Image Insert uploads, are generally retained while available in your library. Media and derived copies may also remain where needed for saved content, shared-template dependencies, thumbnails, exports, or backups, subject to deletion requests, technical limits, and the purposes described above.
• Billing and transaction records are retained for the period required by tax, accounting, fraud-prevention, chargeback, and legal obligations.
• Support and contact information is retained while a request remains unresolved and where needed for related disputes, service history, or legal obligations.
• Marketing contact data is retained for subscriptions and lifecycle communications, subject to your requests and applicable law. Unsubscribing stops marketing messages but may leave a suppression record; ask separately if you want your personal information deleted.
• Logs and analytics retention depends on provider settings, diagnostic needs, open security investigations, and legal obligations. Backups depend on the storage provider's settings and rotation or deletion processes.

Fixed deletion periods for logs, backups, support records, and stored exports have not been established. The criteria above describe the reasons data may remain; they do not promise automatic deletion on a fixed schedule. Contact us for information about a particular record or to request deletion.

When server-side export is enabled, we send board data to our export worker and store the generated file in Google Cloud or Firebase storage. The generated download link expires after 24 hours. Link expiry does not delete the stored file, and we do not currently promise automatic file deletion after 24 hours. Cancelling a subscription changes billing and access; it does not itself delete your account, boards, uploads, or stored exports.

Removing or replacing an image in an Image Insert changes that element; it does not delete the source image from My Uploads or Previous Image Insert uploads. To remove the stored upload, use the deletion control in the library where it is stored. Deleting an upload can make it unavailable in saved designs that reference it, including private boards, and does not necessarily erase all copies immediately. Media retained for shared-template dependencies, other library references, backups, or applicable legal and security needs may persist.

For a request to delete personal information across the Service, follow the Your Privacy Rights section below. BoardCraft cannot delete copies that you or others have downloaded, printed, or distributed outside the Service.

We may retain de-identified or aggregated information for longer periods where it can no longer reasonably identify you.

12. Cookies and Similar Technologies

BoardCraft uses cookies, local storage, session technologies, and similar tools to operate the Service. These may include:

• Strictly necessary technologies for authentication, session management, security, account access, fraud prevention, requested billing and editor actions, verification, routing, and consent choices.
• Analytics technologies to understand performance and use of the Service, only where enabled by your consent when consent is required.
• Security technologies such as anti-bot and abuse-prevention tools.
• Optional functional storage for editor settings, recent colors and fonts, and walkthrough progress, persisted only when you enable functional preferences.

You can manage cookies through your browser settings and the "Cookie settings" control in the site footer. Withdrawing analytics consent disables future Firebase Analytics collection on that browser. It does not automatically delete previously collected information. Accessible BoardCraft Google Analytics cookies are removed, and consent changes are shared with other tabs on the same site origin. Browser controls can clear remaining storage; contact us for a personal-data deletion request. Functional consent withdrawal removes persisted optional preferences. Choices are valid for 180 days, and an active browser Global Privacy Control signal keeps optional Firebase Analytics and browser marketing off. The marketing toggle controls optional browser marketing technologies, rather than server-side contact synchronization or email preferences. Disabling certain cookies may affect sign-in, account access, checkout, or other Service functionality. Please review our Cookie Policy for more details.

13. Security

We use reasonable technical, administrative, and organizational measures designed to protect personal information against unauthorized access, loss, alteration, misuse, and disclosure.

These measures may include authentication controls, email verification, access restrictions, protected media delivery, server-side authorization checks, security monitoring, secure service-provider arrangements, role-based administrative access, and abuse-prevention tools.

No system is completely secure. You are responsible for keeping your account credentials confidential and notifying us promptly if you believe your account has been accessed without authorization.

14. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of personal information.
• Request restriction of processing.
• Object to certain processing, including certain marketing or legitimate-interest processing.
• Request data portability.
• Withdraw consent where processing is based on consent.
• Opt out of certain targeted advertising, sale, or sharing activities where applicable.
• Complain to a relevant data-protection authority.

To make a request, email support@boardcraft.app with the subject line "Privacy Request." We may request information reasonably necessary to verify your identity and may deny or limit requests where permitted by law, including where a request would affect the rights of others, compromise security, or conflict with legal obligations.

You can use the same email route to request deletion of your account and associated personal information, or access to or portability of personal information we hold about you. These requests are handled through support. Downloading a board as a PNG, PDF, or ZIP is a design export, not an export of all personal information held about you.

We respond within the deadlines required by applicable law. Where the GDPR or UK GDPR applies, requests generally require a response without undue delay and within one month, subject to applicable identity verification and other timing rules. Where permitted for complex or multiple requests, the period may be extended by up to two further months; we will notify you of an extension and its reasons within the initial period. Different rights or jurisdictions may have different deadlines.

You do not need a BoardCraft account to raise a privacy concern or submit a request about a photo or other information depicting or identifying you. A parent or authorized guardian may also submit a request on behalf of a child. Include enough information to help us locate the content, such as a board or template link or the account holder's details if known, without sending unnecessary sensitive information. We may verify your authority to act for another person and, where we process content on behalf of a school or other account holder, coordinate with that controller as appropriate. This does not limit our own obligations under applicable law.

15. California Privacy Notice

This section applies to California residents to the extent the California Consumer Privacy Act, as amended, applies to BoardCraft. During the preceding 12 months, BoardCraft may have collected:

• Identifiers, such as name, email address, account ID, IP address, and online identifiers.
• Commercial information, such as subscription plan, purchase status, transaction references, invoices, and billing status.
• Internet or network activity, such as browser data, device information, usage data, logs, diagnostics, analytics information, and security events.
• User-generated content, such as boards, uploaded files, templates, thumbnails, exports, and support communications.
• Approximate location information derived from IP address.
• Sensitive personal information, such as account credentials, only as needed to provide and secure the Service. We do not use sensitive personal information to infer characteristics about you.

We collect these categories from you, your device, your use of the Service, and the third-party providers described in this policy. We use and disclose them for the purposes described above.

California residents may have the right to know, access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing when they exercise privacy rights. BoardCraft does not sell personal information for monetary consideration, does not knowingly share personal information for cross-context behavioral advertising, and does not provide personal information to third parties for their own direct marketing purposes.

Authorized agents may submit requests on behalf of California residents, subject to verification of authority.

Where the CCPA applies, requests to know, delete, or correct personal information generally require a response within 45 calendar days of receipt. Where permitted, this can be extended by a further 45 calendar days when reasonably necessary, with notice and an explanation within the initial period. These timelines do not replace shorter deadlines that may apply to other requests.

16. Children's Privacy

BoardCraft is intended for adult educators, creators, schools, and organizations. It is not directed to children under 13 or the minimum age required by applicable law.

We do not knowingly collect personal information directly from children through individual BoardCraft accounts. If you believe a child has provided personal information directly to BoardCraft without appropriate authorization, contact us at support@boardcraft.app.

Adult account holders may supply information about children, including student photos used in Image Inserts. We process that information to provide the requested features as described in this policy. This is distinct from collecting information directly from children through their own accounts.

Teachers, schools, districts, and organizations must ensure that student information they upload, export, or include in BoardCraft is processed lawfully, including obtaining parental or guardian consent and school authorization where required. Their responsibilities do not replace BoardCraft's own obligations under applicable law.

17. Automated Decision-Making

BoardCraft may use automated systems to administer account access, plan limits, export allowances, security checks, email-gating, abuse prevention, and account restrictions.

We do not use personal information to make decisions that produce legal or similarly significant effects on individuals without appropriate notice or safeguards.

18. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or Service features. When we make material changes, we will update the "Last updated" date and may provide additional notice through the Service, by email, or through another appropriate method.

19. Contact Us

For privacy questions, requests, or concerns, contact BoardCraft at support@boardcraft.app. Where applicable, you may also have the right to lodge a complaint with your local data-protection authority, the Moroccan CNDP, a European Economic Area supervisory authority, or the UK Information Commissioner's Office.