Boards Privacy Policy
This policy explains what information we collect when you use Boards by Brand Expert ("the Service"), how we use it, and the choices you have. We comply with the Protection of Personal Information Act, 2013 (POPIA).
1. Information we collect
- Account information: your name, email address and password (stored as a secure hash — we never see your password).
- Workspace content: the boards, tasks, notes, files, financial entries, social media captions and schedules your team creates in the Service.
- Connected social accounts: when you connect a social media account (e.g. Facebook, Instagram, YouTube, TikTok, LinkedIn), we store the account's display name and an identifier so we can publish the posts you schedule and retrieve performance statistics for them. We do not receive or store your social media passwords — connections use each platform's official authorisation flow, and you can disconnect an account at any time inside the Service.
- Usage information: basic technical logs (such as sign-in times and errors) needed to run and secure the Service.
2. How we use your information
- To provide the Service: boards, task management, scheduling and publishing the social media posts you approve, and showing you their performance.
- To send service emails: invitations, password resets, deadline digests and notifications you or your workspace configure.
- To process payments and manage subscriptions.
- To provide optional AI features (described below).
We do not sell personal information, and we do not use your workspace content for advertising.
3. Social platform data (including Meta platforms)
When you connect Facebook or Instagram accounts, we access only what is needed to operate the features you use: publishing posts you schedule, retrieving engagement statistics (such as likes, comments and reach), and — where you enable interaction monitoring — receiving comments and messages on your posts so your team can respond from your workspace.
Platform data is used solely to display it to authorised members of your workspace and to route it to the people you designate. It is retained only while your account remains connected, and is deleted when you disconnect the account or delete your workspace. You may also request deletion at any time via the contact below.
4. AI features
Optional AI features (caption drafting, task assistance, daily briefs) send the relevant text — for example a post's topic or a board's task titles — to Anthropic's Claude API for processing. This content is used only to generate the response you asked for. AI features are off unless you invoke them, and are metered by credits so you control usage.
5. Service providers
- Supabase — database, authentication and file storage.
- Vercel — website hosting.
- PostPeer — a third-party posting processor we currently use to publish scheduled posts to social platforms and retrieve post statistics on your behalf. PostPeer receives the post content and the identifiers of the accounts you connected.
- PayFast — payment processing. We never see or store your card number.
- Anthropic — AI processing for the optional AI features described above.
6. Data retention and deletion
Your content is retained while your workspace is active. When you delete content, it is removed from the live Service immediately and from backups on their rotation cycle. You can delete your account and workspace entirely by contacting us; connected social accounts can be disconnected in-app at any time, which removes our access.
Meta data deletion: to request deletion of any data obtained from Facebook or Instagram, disconnect the account in the Service or email us at the address below; we will confirm deletion within 30 days.
7. Your rights (POPIA)
You may request access to, correction of, or deletion of your personal information, and you may object to processing. Contact us and we will respond within a reasonable time. You may also lodge a complaint with the Information Regulator of South Africa.
8. Security
Data is encrypted in transit, access is controlled per workspace with row-level security, passwords are hashed, and payment details are handled entirely by PayFast.
9. Children
The Service is intended for business use by people 18 and older.
10. Changes
If we make material changes to this policy we will notify workspace owners by email and update the date above.
11. Contact
Brand Expert · brandexpert.co.za
Email: boards@brandexpert.co.za