Privacy Policy
1 Scope
This is the privacy policy for BoardVoice itself. Your board is the one that decides what documents to publish; we just host the platform.
BoardVoice is operated by True Anchor LLC ("we," "us," or "our"). This Privacy Policy describes how we collect, use, and disclose personal information when you use the BoardVoice platform, including our website at boardvoice.app and the public meeting sites we host on behalf of governing bodies ("Organizations").
Each Organization determines why and how Organization-submitted records and resident submissions are handled. To the extent privacy law uses those terms, the Organization acts as controller or business and BoardVoice acts as its service provider or processor. Subscriber lists and comment contact details are not public unless the Organization separately discloses them. If you have questions about a specific Organization’s records or comment policy, contact that Organization directly.
2 Information We Collect
We process administrator account and security data, Organization content and audit events, subscriber and resident-submission data, billing data handled through Stripe when billing is used, and technical data needed to operate and secure the Service. Optional integrations process only content an administrator chooses to send.
Account Information (Administrators)
When an Organization administrator creates an account, we collect their name and email address. Firebase Authentication processes credentials and issues authentication tokens. BoardVoice does not store plaintext passwords in Firestore or its application database.
Subscriber Information (Public)
Residents who subscribe to an Organization's email notifications voluntarily provide their name and email address. This information is stored alongside a timestamp and an active/unsubscribed status.
Public Comment Information
Residents who submit public comments provide their name, optionally an email address, and the text of their comment. Comments are tied to a specific meeting and a specific agenda item where applicable.
Public Records Request Information
Residents who submit a public records (FOIA) request through the Service provide their first and last name, an email address, optionally a phone number, and a description of the records being requested. This information is collected to identify the requester, communicate about the request, and maintain it as part of the public records-request file required by applicable law. It is visible only to administrators of the Organization receiving the request.
Technical Information
Vercel and Google/Firebase may receive request and device data generated when their services are used, such as IP address, user agent, timestamps, requested URLs, performance diagnostics, and security events. We use this information for security, abuse prevention, aggregate service measurement, and reliability.
3 How We Use Information
We use your data to run the service and to send the emails you ask for. We do not sell your data, and we do not use it for advertising.
We use the information described above to:
- Provide, maintain, and secure the Service
- Authenticate administrators and enforce access controls
- Send meeting-related email notifications that users have subscribed to
- Deliver administrative and transactional email (account invitations, system alerts)
- Investigate and prevent fraud, abuse, and violations of our Terms
- Comply with legal obligations
We do not sell personal information. We do not share personal information with third parties for their own marketing purposes. We do not use behavioral advertising tracking on BoardVoice-hosted pages.
4 Public Records & Comments
Submitting information to a public body may make it subject to retention or disclosure law even if it is never displayed on the public site.
Public bodies using BoardVoice may be subject to open-meetings, public-records, retention, privacy, and other laws. Content an Organization chooses to publish is visible to visitors and may be indexed by search engines.
When you submit a public comment, the Organization receives your name, comment text, and any optional contact information for review under its policy. The Organization may publish your name and comment text. Email addresses supplied with comments are intended for authorized administrators, not public display.
BoardVoice’s approved, rejected, and published labels govern site display only. They do not determine whether a submission is a public record, exempt record, or retention record. Do not submit sensitive information unless the public body specifically requires it through an appropriate process.
5 Service Providers
We use a small set of well-known vendors to run BoardVoice. Each one only handles the specific data they need to do their job.
BoardVoice relies on the following service providers ("subprocessors") to operate. Each processes data only as needed to provide their service and under their own published privacy terms:
| Provider | Purpose | Data Processed |
|---|---|---|
| Google Firebase | Database, file storage, and authentication | Account info, Organization content, public comments, subscriber lists, public records requests, audit log entries |
| Vercel | Application hosting, serverless functions, aggregate web analytics, and performance measurement | Request and device data, IP addresses, requested URLs, performance diagnostics |
| Resend | Transactional email delivery | Recipient email addresses, email content |
| Stripe | Subscription checkout and billing administration when paid billing is enabled or used | Billing contact and transaction information submitted to Stripe |
| Anthropic | Optional AI-assisted administrative features | Content an administrator intentionally submits to an AI-assisted feature |
| CloudConvert | Optional document conversion for packets and previews | Documents selected for conversion |
| Google (Drive API) | Optional document library integration | Drive authorization tokens and document metadata when an Organization connects Drive |
| Google Fonts | Web-font delivery on BoardVoice marketing and legal pages | Request and device data needed to deliver font files |
We do not share personal information with any other third parties except (a) to comply with a valid legal process, (b) to protect the rights, property, or safety of BoardVoice, our users, or the public, or (c) in connection with a corporate transaction such as a merger or asset sale, in which case we will provide notice before any personal information is transferred.
6 Browser Storage & Analytics
We use browser storage and authentication tokens to operate and secure BoardVoice, plus aggregate analytics and performance measurement. We do not use advertising cookies or behavioral advertising.
BoardVoice uses browser storage and authentication tokens to maintain administrator sessions, security state, selected-board and interface preferences, and short anti-abuse submission timestamps. Anti-abuse timestamps are used to limit rapid repeat submissions.
A one-way PIN verifier and related security state may be stored with the administrator account; BoardVoice does not store the plaintext screen-lock PIN.
We use Vercel Web Analytics and Speed Insights for aggregate usage and performance measurement. We do not use advertising cookies or behavioral advertising on BoardVoice-hosted pages.
7 Security
We use HTTPS, authentication, role- and board-scoped authorization, private source collections, and separate sanitized public projections to reduce unauthorized access. Our infrastructure providers also apply their own platform safeguards. These controls reduce risk but cannot eliminate it.
No online service is completely secure. You are responsible for protecting your account credentials. If you believe your account has been compromised, contact us immediately at connect@boardvoice.app.
8 Retention
We retain information while it is needed to provide the Service, honor user choices, resolve disputes, or meet applicable legal obligations. Each Organization remains responsible for identifying and following the records-retention schedule that applies to its public body.
Subscribers who unsubscribe may be retained in an inactive or suppression record so the system can honor that choice. Account closure and deletion requests are reviewed against operational needs and applicable public-record obligations. Administrators should request and verify an export before closing an account.
9 Your Rights & Choices
You can unsubscribe, request a copy of your data, or ask us to delete it. For published public comments, you will generally need to ask the Organization that published them, because they own the public record.
Subscribers may unsubscribe at any time using the link in any notification email. Administrators may request correction or account closure through available account controls or support, subject to Organization authority, retention duties, security requirements, and applicable law.
Depending on where you live, you may have the right to (a) know what personal information we hold about you, (b) request access or a copy, (c) request correction of inaccurate information, (d) request deletion, or (e) object to certain processing. To exercise any of these rights, email connect@boardvoice.app. We will respond within the period required by applicable law.
If your request concerns content that was published by an Organization as part of a public meeting record, we will forward the request to the Organization, which is the data controller for that content. Public records laws may limit the Organization's ability to remove approved meeting content once it has been published.
10 Children
Administrative accounts are intended for authorized adults. Public sites are general-audience civic-information pages and are not directed to children under 13. We do not knowingly request personal information from children under 13. Organizations must configure and operate public-submission features consistently with applicable law.
If you believe a child submitted personal information, contact the responsible Organization or BoardVoice. Any response will account for the Organization’s authority and applicable public-records, retention, and privacy obligations.
11 Changes to this Policy
We may update this Privacy Policy from time to time. For material changes we will provide notice by email to Organization administrators or by a prominent notice within the Service at least 30 days before the change takes effect. The "Effective" date at the top of this page shows when the policy was last updated.
12 Contact
Questions about this Privacy Policy or a privacy-related request can be sent to:
True Anchor LLC
Michigan, USA
connect@boardvoice.app
boardvoice.app