Privacy Policy

1. Information We Collect

Information you provide directly

When you create an account, sign up for a free trial, or contact us, we collect:

• Email address (required for account creation and alert delivery)
• Name and organization (optional, provided during onboarding)
• Payment information (processed by Stripe; we do not store card numbers)
• Alert preferences and filter settings
• Communications you send us (support requests, feedback)

Information collected automatically

When you use our platform, we automatically collect:

• Log data: IP address, browser type, pages visited, timestamps
• Device information: browser version, operating system
• Usage data: features used, search queries, alert configurations
• Cookies and similar tracking technologies (see Section 6)

Public data we process

Our platform delivers board intelligence sourced from BoardEx (via WRDS institutional license), enriched with CRSP market data and SEC 13F filings. This data is sourced from institutional databases and public government records and does not constitute personal data we collect about our users.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Board Scan platform
• Send board change alerts and digest emails you have configured
• Process payments and manage your subscription
• Respond to your support requests and communications
• Send product updates, feature announcements, and platform notices
• Analyze usage patterns to improve platform performance and features
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your data to train machine learning models for purposes unrelated to your use of the platform.

3. Data Sharing and Disclosure

We share your information only in the following circumstances:

Service providers

We share data with trusted service providers who help us operate the platform, including:

• Stripe (payment processing)
• Resend (transactional email delivery)
• Cloudflare (infrastructure, DDoS protection)
• Hetzner (cloud infrastructure hosting)

These providers are contractually required to protect your data and may only use it to perform services on our behalf.

Legal requirements

We may disclose your information if required by law, court order, or government authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you before your data is subject to a different privacy policy.

4. Data Retention

We retain your account information for as long as your account is active. If you cancel your subscription, we retain your data for 90 days to allow account reactivation, after which it is deleted from our production systems.

Email alert logs and delivery records are retained for 12 months. Aggregated, anonymized usage statistics may be retained indefinitely.

You may request deletion of your account and personal data at any time by contacting us at [email protected].

5. Security

We implement industry-standard security measures to protect your information:

• All data transmitted between your browser and our servers is encrypted via TLS 1.3
• Database contents are encrypted at rest
• Access to production systems is restricted to authorized personnel with two-factor authentication
• We conduct regular security reviews of our codebase and infrastructure
• Payment data is handled entirely by Stripe, a PCI-DSS Level 1 certified provider

No method of transmission over the internet is 100% secure. While we take commercially reasonable precautions, we cannot guarantee absolute security of your data.

6. Cookies

We use cookies and similar technologies for the following purposes:

• Authentication: to keep you logged into the platform across sessions
• Preferences: to remember your alert settings and display preferences
• Analytics: to understand how users navigate and use the platform

We do not use third-party advertising cookies. You may configure your browser to refuse cookies, but this may prevent certain platform features from functioning correctly.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request that we correct inaccurate or incomplete data
• Deletion: request that we delete your personal data
• Portability: request your data in a machine-readable format
• Objection: object to certain processing activities

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

8. Data Sources and Third-Party Content

Director data is sourced from BoardEx via WRDS institutional license. Market enrichment is sourced from CRSP daily files and SEC 13F filings. We do not warrant the accuracy, completeness, or timeliness of any data sourced from BoardEx, CRSP, or SEC filings. Data accuracy is subject to the underlying source database quality.

Board Scan is not affiliated with, endorsed by, or sponsored by BoardEx, WRDS, CRSP, or the SEC.

9. Children's Privacy

Our platform is intended for professional use and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact us at [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the effective date above. Your continued use of the platform after changes are posted constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: