BayesBoard (bayesboard.com and app.bayesboard.com) is a product of Best Business Brands LLC ("BBB", "we", "us"), an Illinois limited liability company, at 20 N Wacker Dr #1000, Chicago, IL 60606, USA. See bestbusinessbrands.com.
This policy explains what personal data BayesBoard handles, why, where it is kept, and what you can do about it. It covers the BayesBoard website, the editor, accounts, the board API and the MCP server that uses it.
Who is responsible
Best Business Brands LLC is the controller of the personal data described here. Our privacy lead is Oksana Sudoma. Write to [email protected] or to our postal address above.
Guest mode stays in your browser
You can use the editor without an account. In guest mode your boards are saved only in your browser's local storage, on your device. They are not sent to us, and clearing your browser data deletes them.
What we collect, why, and on what legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Account details: email address, a hashed password, and, if you sign in with Google or GitHub, the name, email and profile picture that provider shares | To create your account and sign you in | Contract |
| Your boards: hypotheses, evidence, experiments, outcomes, edges, priors and likelihood ratios, drawings, comments and the files you attach | To store, show and sync your boards | Contract |
| Share links you create | To show a read-only copy of a board to anyone who has the link | Contract |
| API access: API keys you create (we keep a hash, a short prefix, a name and when each was last used), the bearer token sent with requests to the board API or the MCP server, and the requests made with it | To authenticate automation on your behalf and keep it secure | Contract |
| Billing details for Pro: your email, Stripe customer and subscription identifiers, plan and payment status | To take payment, manage your plan and keep accounts | Contract; legal obligation (tax and accounting records) |
| Technical data: IP address, browser, pages and API routes requested, error and security events | To deliver the service, rate-limit abuse and keep it secure | Legitimate interest in running a secure service |
| Analytics, only if you accept analytics cookies: pages viewed, the referring site, approximate location (country and city, from your IP address), device and browser type, and a random identifier in a cookie | To see which pages are read and improve the site | Consent, which you can withdraw at any time (see our Cookie Policy) |
| Messages you send us | To reply and give support | Legitimate interest in answering questions; contract where you are a customer |
We do not sell personal data, we do not use it for advertising, and we do not send your boards to AI models. The probabilities on a board are your own judgments; we do not analyse them to profile you.
Who we share it with
We share personal data only with providers who help us run BayesBoard, under contracts that require them to protect it and use it only for us:
- Hetzner Online GmbH (Germany): the servers that run BayesBoard and our self-hosted Supabase (accounts and sign-in, the board database and file attachments), with their backups.
- Cloudflare, Inc.: DNS, HTTPS, content delivery and attack protection in front of the site.
- Stripe, Inc.: card payments and subscriptions for Pro. Stripe collects your card details directly; we never see or store your full card number.
- Google (Google Ireland Limited and Google LLC): Google Analytics 4, only if you accept analytics cookies. Advertising features are off, and we never send Google your name, email or boards.
- Google and GitHub, only if you choose to sign in with them: they confirm your identity to us under their own privacy policies.
We may disclose data if the law requires it, or to protect our rights or the security of the service. We do not sell or share personal data for cross-context behavioural advertising, as those terms are used in California law.
Where your data is kept, and transfers outside the EU
Accounts, boards and attachments are stored in our self-hosted Supabase on Hetzner servers in the European Union (Germany). Our company is in the United States, and some providers (Cloudflare, Stripe, Google, GitHub) are US companies. When personal data from the EU, EEA, UK or Switzerland goes to a country without an adequacy decision, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. Ask us for a copy of the relevant safeguards.
How long we keep it
| Data | Kept for |
|---|---|
| Account, boards, comments and attachments | While your account is open. When you delete a board or attachment, it is removed from the live system; when you close your account, everything is deleted within 30 days |
| Share links | Until you revoke the link or delete the board |
| Billing records | 7 years after the end of the tax year (tax law) |
| Encrypted backups | Up to 6 months, then rotated out. A nightly encrypted backup is kept on servers in the EU and used only to recover from an incident. If a backup is ever restored, accounts closed in the meantime are deleted again |
| Analytics data in Google Analytics | Event data 2 months (Google Analytics retention setting); the analytics cookies expire after 2 years or when you withdraw consent |
| Server and security logs | About 30 days, longer only while investigating an incident |
Your rights
You can ask us to:
- tell you what we hold about you and give you a copy (access and portability; you can also export any board as JSON yourself);
- correct it;
- delete it, including your whole account (the "right to be forgotten");
- restrict or object to how we use it;
- withdraw a consent you gave, such as to analytics, at any time.
How to ask: email [email protected] from the address on your account. We may ask you to confirm your identity, and we answer within 30 days. If a request is complex we may take up to two more months, and we will tell you why within the first 30 days. There is no charge.
If you are in the EU, EEA or UK, you can also complain to your data protection authority. If you are a US resident, you may have rights under your state's privacy law; the process above applies to them too, and we will not treat you differently for using them.
Security
We protect data with encryption in transit (HTTPS), row-level security that keeps each account's boards separate in the database, rate limits on sign-in and the API, restricted staff access, and monitoring. API keys and tokens act as you: keep them secret, revoke a key in your dashboard, and sign out of all sessions or change your password if a token may have leaked. If a breach puts your data at risk, we will tell you and the relevant authority as the law requires (in the EU, the authority within 72 hours).
Children
BayesBoard is not directed at children, and we do not knowingly collect data from anyone under 16.
Changes
We will post any change here with a new date. If a change affects how we use data you already gave us, we will tell you before it takes effect.