Boards Privacy Policy
This policy explains what information we collect when you use Boards by Brand Expert ("the Service"), how we use it, and the choices you have. We comply with the Protection of Personal Information Act, 2013 (POPIA).
1. Information we collect
- Account information: your name, email address and password (stored as a secure hash — we never see your password).
- Workspace content: the boards, tasks, notes, files, financial entries, social media captions and schedules your team creates in the Service.
- Connected social accounts: when you connect a social media account (e.g. Facebook, Instagram, YouTube, TikTok, LinkedIn), we store the account's display name and identifier, the access tokens that keep the connection working, and the ID of the person who connected it, so we can publish the posts you schedule and retrieve performance statistics for them. Where you use the inbox, we also store comments and messages on your accounts, including the name and platform ID of the person who wrote them. We do not receive or store your social media passwords — connections use each platform's official authorisation flow, and you can disconnect an account at any time inside the Service.
- Usage information: basic technical logs (such as sign-in times and errors) needed to run and secure the Service.
2. How we use your information
- To provide the Service: boards, task management, scheduling and publishing the social media posts you approve, and showing you their performance.
- To send service emails: invitations, password resets, deadline digests and notifications you or your workspace configure.
- To process payments and manage subscriptions.
- To provide optional AI features (described below).
We do not sell personal information, and we do not use your workspace content for advertising.
3. Social platform data (including Meta platforms)
When you connect Facebook or Instagram accounts, we access only what is needed to operate the features you use: publishing posts you schedule, retrieving engagement statistics (such as likes, comments and reach), and — where you enable interaction monitoring — receiving comments and messages on your posts so your team can respond from your workspace.
Platform data is used solely to display it to authorised members of your workspace and to route it to the people you designate. It is retained only while your account remains connected, and is deleted when you disconnect the account or delete your workspace. You may also request deletion at any time via the contact below.
4. Google user data (YouTube and Google Calendar)
When you connect a Google account to a board, we request only the access needed for the features you enable, and nothing more. Google user data is used solely to provide those features inside the Service — it is never used for advertising and is never sold.
- YouTube — upload & manage videos (
youtube.upload,youtube.force-ssl): to publish videos and Shorts you schedule from a board, to manage or update those videos, and to post replies to comments on your channel from within the Service. - YouTube Analytics — read-only (
yt-analytics.readonly): to display your channel's views, watch time, likes, comments and subscriber figures on the board's analytics widget. - Google Calendar — read-only (
calendar.readonly): to read and display your calendar events inside a board alongside your content schedule. We do not create, edit or delete calendar events.
This data is stored only while the Google account remains connected to a board, and is deleted when you disconnect the account or delete the board or workspace.
Limited Use. Boards by Brand Expert's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use data obtained through Google Workspace APIs (including Google Calendar) or any other Google API to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models. Google user data is used only to provide or improve the user-facing features that are visible and in active use within the Service; it is not transferred or sold for advertising, market research or any purpose unrelated to those features; and it is accessed by humans only where you give explicit consent, where required for security or to comply with applicable law, or in aggregated and anonymised form for internal operations.
5. AI features
Optional AI features (caption drafting, task assistance, daily briefs) send the relevant text — for example a post's topic or a board's task titles — to Anthropic's Claude API for processing. This content is used only to generate the response you asked for. AI features are off unless you invoke them, and are metered by credits so you control usage. Data obtained from Google APIs is not sent to these AI features and is not used to train any AI or machine-learning models.
6. Service providers
- Supabase — database, authentication and file storage.
- Vercel — website hosting.
- PostPeer — a third-party posting processor we currently use to publish scheduled posts to social platforms and retrieve post statistics on your behalf. PostPeer receives the post content and the identifiers of the accounts you connected.
- PayFast — payment processing. We never see or store your card number.
- Anthropic — AI processing for the optional AI features described above.
7. How we share, transfer and disclose data
We do not sell your personal information or your Google user data, and we do not share it with third parties for their own purposes. The only recipients of your data are the service providers listed above, each acting on our instructions to run the Service: Supabase (database and file storage), Vercel (hosting), Anthropic (optional AI features), PostPeer (scheduled posting and statistics) and PayFast (payments).
Beyond these providers, we disclose or transfer data only in the following cases: where you direct us to (for example, publishing a video you scheduled to your own YouTube channel or posting a comment reply, which is then governed by that platform's own terms and privacy policy); where required by law or valid legal process; or in connection with a merger, acquisition or sale of assets, in which case we will notify affected users. We do not transfer your personal information or Google user data to any other third party.
8. Data retention and deletion
Your content is retained while your workspace is active. When you delete content, it is removed from the live Service immediately and from backups on their rotation cycle. You can delete your account and workspace entirely by contacting us; connected social accounts can be disconnected in-app at any time, which removes our access.
Meta data deletion: to delete data obtained from Facebook or Instagram, disconnect the account in the Service, remove the app from your Facebook settings, or email us at the address below. See our data deletion page for the steps and what is removed. Email requests are confirmed within 30 days.
Google data deletion: to remove data obtained from Google, disconnect the Google account on the board or email us at the address below; disconnecting removes our access and deletes the stored tokens and data immediately.
9. Your rights (POPIA)
You may request access to, correction of, or deletion of your personal information, and you may object to processing. Contact us and we will respond within a reasonable time. You may also lodge a complaint with the Information Regulator of South Africa.
10. Security
Data is encrypted in transit, access is controlled per workspace with row-level security, passwords are hashed, and payment details are handled entirely by PayFast.
11. Children
The Service is intended for business use by people 18 and older.
12. Changes
If we make material changes to this policy we will notify workspace owners by email and update the date above.
13. Contact
Brand Expert · brandexpert.co.za
Email: boards@brandexpert.co.za