Privacy Policy

1. Introduction

Welcome to Cerboard (“we,” “our,” or “us”). Cerboard is a client onboarding platform that helps web design and development agencies collect files, brand assets, copy, logins, and answers from their clients through a single secure link. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our service.

By using Cerboard, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Password (stored only as a salted hash; we never see it in plain text)
• Your name and agency / business name
• Account preferences and settings

Client and Onboarding Data

To deliver the service, we store the information you and your clients add to an onboarding, which may include:

• Client names, contact emails, and project details you enter
• Files and assets your clients upload (logos, brand documents, images, copy, and similar materials)
• Answers your clients provide to your onboarding questions
• Credentials or logins your clients choose to share with you through an onboarding (stored encrypted at rest)
• Onboarding progress, submission history, and reminder activity

Payment Information

Payment processing is handled by Stripe. We do not store your full card details. We receive and store your subscription status and billing history from Stripe.

Usage and Technical Data

We automatically collect limited technical information such as log data, device and browser type, and IP address to operate, secure, and improve the service.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and operate the service
• Send onboarding links, automatic client reminders, and completion notifications
• Process your subscription payments
• Send service-related communications
• Detect, prevent, and address fraud, abuse, and security issues
• Improve and optimize the service

We do not sell your personal information, and we do not use the content your clients submit for advertising or to train AI models.

4. Our Role and Yours

For the client and onboarding data described above, the agency using Cerboard is the data controller and Cerboard acts as a data processorhandling that data on the agency’s behalf and instructions. You are responsible for having an appropriate legal basis and any necessary consent to collect your clients’ information through Cerboard. For your own account information, Cerboard is the controller.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share information with:

• Service Providers: Supabase (database, file storage, and authentication), Stripe (payments), Resend (transactional email), and our cloud hosting infrastructure
• Legal Requirements: when required by law or to protect our rights, users, or the public
• Business Transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy

6. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (HTTPS) and at rest, secure authentication, and access controls. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the service. You can delete client and onboarding data at any time from within the product, and you can request deletion of your account and associated data by contacting us. Some data may be retained where required for legal or legitimate business purposes.

8. Your Rights

Depending on your location, you may have the right to:

• Access and receive a copy of your personal data
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

To exercise these rights, contact us at support@cerboard.com. If your request concerns data we process on behalf of an agency, we may direct you to that agency or assist them in responding.

9. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising or cross-site tracking cookies.

10. International Data Transfers

We and our service providers may process and store your information in countries other than your own. Where we transfer personal data across borders, we take steps to ensure it remains protected in accordance with this policy and applicable law.

11. Children’s Privacy

Cerboard is a business tool and is not intended for users under 18 years of age. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us so we can remove it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the “Last updated” date.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@cerboard.com.