How BoardCraft handles your information.

1. Who We Are

BoardCraft is the online classroom bulletin board, printable decor, and teacher-seller design service available at boardcraft.app. In this policy, "BoardCraft," "we," "us," and "our" refer to BoardCraft as the operator of the Service.

For privacy questions or requests, contact us at support@boardcraft.app. For privacy-law purposes, BoardCraft is generally the controller of personal information relating to website visitors, account holders, billing administration, marketing communications, and support requests.

If an educator, school, district, organization, or other account holder uploads or creates content containing personal information about students or other people, that account holder may be the controller of that content and BoardCraft may process it as a service provider or processor.

2. Scope

This policy applies to personal information collected through:

• The BoardCraft website, public pages, pricing pages, contact forms, and waitlist forms.
• Account registration, sign-in, email verification, and profile features.
• The editor, dashboard, boards, templates, uploads, folders, thumbnails, and exports.
• Subscriptions, checkout, billing confirmation, billing portals, refunds, and plan administration.
• Support requests, service emails, product messages, cookies, analytics, security tools, and similar technologies.

This policy does not apply to third-party websites, platforms, or services that may be linked from BoardCraft. Their own privacy policies govern those services.

3. Personal Information We Collect

Information you provide

• Name, email address, password credentials, account identifiers, display name, profile image, sign-in method, and email-verification status.
• Board titles, board content, text, designs, templates, folders, thumbnails, export settings, editor actions, and related project data.
• Uploaded files, including images, file names, file type, file size, dimensions, storage identifiers, media identifiers, and related metadata.
• Shared-template titles, thumbnails, design elements, clone activity, and content included in template links.
• Subscription plan, billing-provider identifiers, transaction references, invoices, payment status, refund requests, cancellation status, and account-management details.
• Contact form messages, support requests, waitlist submissions, marketing preferences, consent choices, and other communications.

BoardCraft does not intentionally collect or store full payment card numbers. Payment processing is handled by our billing provider.

Information collected automatically

• IP address, device type, browser type, operating system, language, approximate location derived from IP address, referral URL, and access timestamps.
• Log data, security events, crash reports, diagnostics, performance data, pages viewed, features used, exports started, and account usage statistics.
• Session identifiers, authentication cookies, browser storage data, anti-abuse tokens, cookie-preference records, and similar identifiers.

Information from third parties

• Google, when you use Google sign-in or Google-backed authentication features.
• Freemius, when you purchase, upgrade, cancel, renew, or manage a subscription.
• Email, anti-abuse, analytics, monitoring, and infrastructure providers when they help us deliver messages, protect the Service, diagnose issues, or maintain accounts.

4. How We Use Personal Information

• Create, authenticate, verify, secure, and manage user accounts.
• Provide the editor, save boards, store uploads, generate thumbnails and exports, manage templates, and deliver requested features.
• Process subscriptions, billing, refunds, plan access, export allowances, account administration, and customer support.
• Operate template-sharing and template-cloning features when you choose to use them.
• Send service messages, including account, security, billing, verification, support, and policy notices.
• Send marketing communications where permitted by law and consistent with your preferences.
• Protect the Service, prevent fraud, block misuse, investigate unauthorized access, enforce our terms, and maintain security.
• Troubleshoot errors, monitor performance, understand product usage, improve existing features, and develop new features.
• Comply with legal obligations, resolve disputes, enforce agreements, and protect the rights, property, safety, and security of BoardCraft, users, and others.

5. Legal Bases

Where the GDPR, UK GDPR, or similar laws apply, we process personal information only where we have a valid legal basis, including:

• Performance of a contract, such as creating your account, providing the Service, saving boards, generating exports, and administering subscriptions.
• Legitimate interests, such as security, fraud prevention, service improvement, operational management, support, and legal protection, where those interests are not overridden by your rights.
• Consent, such as for non-essential cookies, certain analytics, marketing communications, or other processing where consent is required.
• Legal obligation, such as tax, accounting, consumer-protection, regulatory, and law-enforcement obligations.
• Establishment, exercise, or defense of legal claims, where needed to resolve disputes or protect legal interests.

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing that happened before withdrawal.

6. User Content, Student Information, and Sensitive Data

BoardCraft is designed for teachers, homeschool educators, teacher-sellers, schools, and organizations. You may choose to create boards containing names, photos, classroom materials, or other information about students or third parties.

You are responsible for ensuring that you have the lawful basis, authority, consent, notices, and permissions required before you upload, enter, publish, export, or share personal information about another person.

Do not upload sensitive information unless you have a clear legal basis and any required written agreement with BoardCraft. Sensitive information may include health information, disability information, government identifiers, financial information, biometric data, religious beliefs, or other highly sensitive personal data.

7. Shared Templates and Public Content

Boards are private by default unless you choose to share, publish, or distribute them. When you create a shareable template link:

• Anyone with the link may be able to view and, where available, clone the template.
• The template title, thumbnail, design elements, and included content may be visible to people who receive the link.
• You should not include student names, student photos, confidential classroom information, or other personal information unless you have the legal right to disclose it.
• Copies made by other users may remain in their accounts after you remove, unpublish, or change the original template.

Deleting an upload from your library may not immediately remove copies embedded in boards, thumbnails, exports, backups, or shared templates. Media may remain available as needed to preserve an active board, template, export, legal obligation, or legitimate security purpose.

8. How We Share Personal Information

We may share personal information with:

• Service providers and processors that help us operate, host, secure, improve, and support the Service.
• Payment and billing providers that process subscription-related transactions and account-management requests.
• Hosting, authentication, storage, search, analytics, security, email, marketing automation, monitoring, and infrastructure providers.
• Professional advisers, such as lawyers, accountants, auditors, insurers, and consultants, where necessary.
• Government authorities, law enforcement, courts, or regulators, where required by law or necessary to protect rights, safety, or security.
• A buyer, successor, affiliate, or financing party in connection with a merger, acquisition, financing, sale of assets, bankruptcy, or similar transaction.
• Other users or the public when you choose to share a template, publish content, or otherwise make information available through the Service.

We require service providers to process personal information only as needed to provide services to us and subject to appropriate confidentiality and security obligations.

9. Service Providers We Use

Depending on the features you use, BoardCraft may use:

• Firebase and Google Cloud for authentication, databases, file storage, analytics, cloud infrastructure, and server-side processing.
• Cloudinary for image and media storage, transformation, delivery, and optimization.
• Algolia for search features covering boards, assets, letter sets, fonts, users, and related Service content.
• Freemius for subscription checkout, billing administration, payment-related processing, and customer account management.
• MailerSend for transactional email and contact-form email delivery.
• Cloudflare Turnstile for bot prevention, verification, and abuse protection.
• Loops for waitlist, marketing automation, lifecycle messages, and product-related communications.
• Sentry for error reporting, diagnostics, security monitoring, and performance monitoring.
• Google Fonts and related font services for font catalog and font-related functionality.
• Google generative AI services for internal metadata generation for BoardCraft-managed content, where enabled.

We may add, replace, or remove service providers as BoardCraft evolves. We will update this policy when changes materially affect how personal information is handled.

10. International Transfers

BoardCraft may process personal information in Morocco, the United States, the European Economic Area, the United Kingdom, and other countries where we or our service providers operate. These countries may have privacy laws that differ from the laws where you live.

Where required by applicable law, we use appropriate safeguards for international transfers, which may include contractual protections, adequacy decisions, consent, or another legally recognized transfer mechanism. Where Moroccan data-protection requirements apply, we will complete any required CNDP notification, authorization, or transfer formalities before carrying out restricted transfers.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and preserve business records.

• Account, board, and profile data is generally retained while your account remains active and for a limited period afterward as needed for deletion processing, backup rotation, security, disputes, or legal obligations.
• User uploads are retained while available in your library or used by an active board, template, thumbnail, export, or backup, subject to deletion requests and technical limits.
• Billing and transaction records are retained for the period required by tax, accounting, fraud-prevention, chargeback, and legal obligations.
• Support and contact information is retained as needed to respond, resolve issues, and maintain appropriate service records.
• Marketing information is retained until you unsubscribe, withdraw consent, or we no longer need it for the relevant communication.
• Logs and analytics data are retained for a limited period appropriate for security, diagnostics, product analytics, and operations.

We may retain de-identified or aggregated information for longer periods where it can no longer reasonably identify you.

12. Cookies and Similar Technologies

BoardCraft uses cookies, local storage, session technologies, and similar tools to operate the Service. These may include:

• Strictly necessary technologies for authentication, session management, security, account access, fraud prevention, billing, verification, routing, and user preferences.
• Analytics technologies to understand performance and use of the Service, only where enabled by your consent when consent is required.
• Security technologies such as anti-bot and abuse-prevention tools.
• Preference technologies that remember editor settings, cookie choices, or interface choices.

You can manage cookies through your browser settings and, where available, BoardCraft cookie preferences. Disabling certain cookies may affect sign-in, account access, checkout, or other Service functionality. Please review our Cookie Policy for more details.

13. Security

We use reasonable technical, administrative, and organizational measures designed to protect personal information against unauthorized access, loss, alteration, misuse, and disclosure.

These measures may include authentication controls, email verification, access restrictions, protected media delivery, server-side authorization checks, security monitoring, secure service-provider arrangements, role-based administrative access, and abuse-prevention tools.

No system is completely secure. You are responsible for keeping your account credentials confidential and notifying us promptly if you believe your account has been accessed without authorization.

14. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of personal information.
• Request restriction of processing.
• Object to certain processing, including certain marketing or legitimate-interest processing.
• Request data portability.
• Withdraw consent where processing is based on consent.
• Opt out of certain targeted advertising, sale, or sharing activities where applicable.
• Complain to a relevant data-protection authority.

To make a request, email support@boardcraft.app with the subject line "Privacy Request." We may request information reasonably necessary to verify your identity and may deny or limit requests where permitted by law, including where a request would affect the rights of others, compromise security, or conflict with legal obligations.

15. California Privacy Notice

This section applies to California residents to the extent the California Consumer Privacy Act, as amended, applies to BoardCraft. During the preceding 12 months, BoardCraft may have collected:

• Identifiers, such as name, email address, account ID, IP address, and online identifiers.
• Commercial information, such as subscription plan, purchase status, transaction references, invoices, and billing status.
• Internet or network activity, such as browser data, device information, usage data, logs, diagnostics, analytics information, and security events.
• User-generated content, such as boards, uploaded files, templates, thumbnails, exports, and support communications.
• Approximate location information derived from IP address.
• Sensitive personal information, such as account credentials, only as needed to provide and secure the Service. We do not use sensitive personal information to infer characteristics about you.

We collect these categories from you, your device, your use of the Service, and the third-party providers described in this policy. We use and disclose them for the purposes described above.

California residents may have the right to know, access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing when they exercise privacy rights. BoardCraft does not sell personal information for monetary consideration, does not knowingly share personal information for cross-context behavioral advertising, and does not provide personal information to third parties for their own direct marketing purposes.

Authorized agents may submit requests on behalf of California residents, subject to verification of authority.

16. Children's Privacy

BoardCraft is intended for adult educators, creators, schools, and organizations. It is not directed to children under 13 or the minimum age required by applicable law.

We do not knowingly collect personal information directly from children through individual BoardCraft accounts. If you believe a child has provided personal information directly to BoardCraft without appropriate authorization, contact us at support@boardcraft.app.

Teachers, schools, districts, and organizations are responsible for ensuring that any student information they upload, export, or include in BoardCraft is processed lawfully.

17. Automated Decision-Making

BoardCraft may use automated systems to administer account access, plan limits, export allowances, security checks, email-gating, abuse prevention, and account restrictions.

We do not use personal information to make decisions that produce legal or similarly significant effects on individuals without appropriate notice or safeguards.

18. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or Service features. When we make material changes, we will update the "Last updated" date and may provide additional notice through the Service, by email, or through another appropriate method.

19. Contact Us

For privacy questions, requests, or concerns, contact BoardCraft at support@boardcraft.app. Where applicable, you may also have the right to lodge a complaint with your local data-protection authority, the Moroccan CNDP, a European Economic Area supervisory authority, or the UK Information Commissioner's Office.