Privacy Policy

Our Privacy Commitment

TrueBoard is built on a simple principle: your personal data belongs to you. TrueBoard is a service of Aeris Labs LLC, California ("TrueBoard," "we," "us," or "the Company"). We serve churches and nonprofit organizations, and we take that responsibility seriously. We will never sell your information or share it with third parties in ways other than in connection with the performance of our services to you.

This policy covers the personal information we collect and handle, why we collect certain information, the choices you have, and the rights you can exercise, in connection with our TrueBoard management platform (sometimes referred to as the "App," the "app" or the "Platform") and our website located at trueboard.org and any other websites operated by us that link to this Privacy Policy (the "Sites") and our related online services, email and other electronic communications (together with the Platform and the Sites, the "Service").

What Makes Us Different

• No marketing cookies — We don't track you for advertising.
• No data selling — Your information is not sold to third parties.
• No behavioral tracking — We don't sell ads. No external user analytics services are used.
• No AI training without your consent — We don't train AI models on your files, messages, votes, or minutes unless your organization opts in.
• Minimal data collection — We only collect what we believe is necessary to provide our service.

Our Role: When We Control Data, and When We Process It

TrueBoard handles data in two different capacities, and your rights differ accordingly:

• As a controller, for the account and security data we collect directly from you to run TrueBoard (your name, email address, phone number, profile photo, sign-in details, and some security logs). This policy governs that data, and you can exercise your rights with us directly.
• As a processor, for the governance content your organization creates and uploads — documents, messages, meeting minutes, motions, and votes. Your organization is the controller of that content and decides how it is used and retained. If your request concerns organizational content, we will direct you to your organization.

Data We Collect

We may collect the following kinds of personal information about you. We may also collect other personal information that is not specified or identified below, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

We may collect payment information, such as payment amounts and payment methods used to complete transactions. All payment processing services connected with your use of the Service are provided to you by third-party payment processors. The Company does not access or keep information related to credit cards, banking information, or other sensitive financial information.

Account Information

When you sign in, we receive basic profile information from your identity provider: your name, email address, profile photo, and in some cases phone number. This is used solely to identify you within the app and the Service and personalize your experience.

Organization Data

Documents, files, and organizational data you create belong to your organization. We store this data to provide the Service and make it available to authorized members of your organization. We handle this data as a processor on your organization's behalf. See our Terms of Service for details on organizational data ownership and content licensing.

Security Logs

We log IP addresses and basic session information for security purposes only, including:

• Detecting unauthorized access attempts
• Preventing session hijacking
• Investigating security incidents if they occur

We also will retain your personal information as reasonably necessary to comply with our legal obligations, resolve disputes and enforce our agreements. We may also retain cached or archived copies of your personal information for a reasonable period of time.

Sensitive Information, Including Religious Affiliation

Because the organizations we serve include churches and faith-based organizations, the governance content an organization uploads may reveal sensitive information — for example, an individual's religious affiliation through membership or board records.

We handle any such information only as a processor, on your organization's documented instructions, for the sole purpose of providing the Service. We do not use such information to build profiles, draw inferences, or target advertising. Your organization, as the controller of that content, is responsible for having the appropriate legal basis and any consents required to provide that information and put the information into TrueBoard.

We do not ask you to submit sensitive information about yourself directly to us (for example, in support requests), and we'd prefer you didn't.

Children's Privacy

TrueBoard is built for board and organizational governance by adults, and the Service is not directed to children. We do not knowingly collect personal information from children under age 16 as a controller.

Organizations are responsible for the content they upload. If an organization's content includes information about minors, that content is handled as organizational data under our processor role, and the organization is responsible for any consents required.

If you believe a child has provided us personal information directly, contact us and we will delete it.

How We Use Your Data

We use personal information for the following purposes.

• To provide the service — authenticate you, run your account, and deliver TrueBoard's features. Basis: performance of the contract governing our operation of the Service, or taking steps you request before engaging our services. Where we cannot process your personal information as required to operate the Service on the grounds of contractual necessity, we process your personal information for this purpose based on our legitimate interests as further described in this Privacy Policy. Use of a third party service and any link to one are governed by that third party's own terms and privacy policy, and we are not responsible for it.
• To keep the service secure — detect and investigate unauthorized access and protect the integrity of the platform. Basis: our legitimate interests in security.
• To communicate with you — send transactional messages such as verification codes, invitations, and service notices. Basis: contractual necessity, or your consent for any optional messages.
• To comply with the law — processing is necessary to meet our legal and regulatory obligations and respond to lawful requests. Basis: legal obligation.
• To establish or defend legal claims — where necessary to protect our rights or the rights of others. Basis: our legitimate interests.
• For compliance, fraud prevention, and safety — Basis: processing is necessary to comply with our legal obligations, or based on our legitimate interests in protecting our or others' rights, privacy, safety, or property.
• Artificial intelligence features — where we offer AI-assisted features, we process the content you direct those features to work on in order to produce your result. See "Artificial Intelligence" below. Basis: performance of the contract governing our operation of the Service, or our legitimate interests in providing and improving the Service. Training AI models on your content is done only with your organization's consent.
• With your consent — Basis: processing is based on your consent. Where we rely on your consent you have the right to withdraw it at any time in the manner indicated when you consent or via the relevant Service.

We do not use your personal information for advertising, profiling, or automated decisions that produce legal or similarly significant effects (see "Automated Decisions" below). If we ever need to use your information for a new, unrelated purpose, we will tell you and identify the legal basis first.

Artificial Intelligence

TrueBoard does not currently offer AI-assisted features. We may add them, and this section describes how we would handle your data when we do.

• Providing the Service. Where an AI feature produces a result you asked for — such as summarizing a document or drafting minutes — we process the content that feature works on for that purpose only.
• Your organization can turn it off. Organization administrators will be able to disable AI features for their organization.
• Training requires consent. We do not use your files, messages, votes, or minutes to train AI models unless your organization opts in. Opting in is not a condition of using TrueBoard, and consent can be withdrawn at any time.

Text Messages (SMS)

If you provide a phone number, we use it for verification codes and transactional account messages. We do not send marketing texts without your consent.

Cookies We Use

We use only essential cookies that we believe are required to make the application work, including:

Cookie	Purpose	Duration
tb_session	Keeps you signed in	Until you sign out or it expires
tb_csrf	Protects against cross-site attacks	Session duration
tb_org	Remembers your last visited organization for convenience	6 months

Because we don't use marketing cookies, there's nothing to opt out of.

Anonymous Visit Counts

We count visits to our public website so we know which pages people find useful. This is done entirely on TrueBoard-controlled servers — no cookies, no profile of you as an individual.

For each visit we record the page path, the locale, the host (only the host, not the full URL) of any referring site, and a one-way visitor hash. The hash is built from your IP address combined with a server-side secret that rotates every day. Your IP address is not stored.

Automated Decisions

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. Decisions about your account and access are made by people in your organization, not by an algorithm acting on its own.

How We Protect Your Data

• All data is encrypted in transit.
• Passwords are never stored — we use OAuth with trusted providers, so your password stays with them and we never see it.
• Sessions are cryptographically secured and regularly rotated.
• Access controls ensure only authorized organization members see your data.
• We strive to follow security best practices.

You share responsibility for keeping your account secure — for example, by protecting access to the identity-provider account you use to sign in.

No method of transmission over the internet or method of electronic storage is completely secure, so while we work hard to protect your information, we cannot guarantee absolute security.

Third-Party Services and Sub-Processors

We use a limited number of third-party services to operate:

• Identity Providers — for authentication
• Cloud Infrastructure (Amazon Web Services) — to host and store your data securely in the United States
• Payment Providers — to assist in the processing and collection of payments for the Service
• Email Provider — to send transactional emails such as verification codes, invitations, and notifications
• SMS Provider — to send verification codes and any opt-in notifications

We do not share your data with any third party for marketing or advertising purposes.

How We Share Information

We do not sell your personal information, and we do not share it for advertising. We disclose personal information in certain circumstances including:

• With your organization — authorized members and administrators of your organization can see organizational content and the membership information in connection with their activities related to their board.
• With service providers — service providers or sub-processors that we utilize may use your information only to provide services to us.
• For legal reasons — when we are required to by law, such as a valid subpoena or court order. Where required by law, we notify the affected organization first.
• To protect rights and safety — where reasonably necessary to protect the rights, property, or safety of TrueBoard, our users, or the public, including to investigate fraud or enforce our terms.
• In a business transfer — if TrueBoard or its assets are acquired by or merged with another company, or in the course of bankruptcies, dissolutions, liquidations, or other similar business transactions. In the case of a merger, sale of assets or similar transaction, the successor would receive your data subject to the commitments in this Privacy Policy to the extent applicable.

International Data Transfers

TrueBoard's servers are located in the United States. If you access TrueBoard from outside the United States, your data will be transferred to and processed in the United States.

Your Privacy Rights

We provide the following rights to all users, subject to applicable law:

• Access — request details about the personal information we hold and how it's used, and obtain a copy of your own personal data
• Correct — request correction of inaccurate personal information
• Delete — request deletion of your account and associated personal data (subject to organizational record retention)
• Portability — receive your personal data in a commonly used, machine-readable format
• Restrict / Object — ask us to restrict, or object to, processing based on our legitimate interests
• Non-Discrimination — we will never treat you differently for exercising your privacy rights
• Complain — lodge a complaint with your local data protection or supervisory authority

Exercising the individual rights above — including accessing and obtaining a copy of your own personal data — is always free.

Organization administrators may request an export of their organization's data in a commonly used machine-readable format (such as JSON or CSV). We will make every reasonable effort to fulfill export requests within 30 days. Because we do not currently offer self-service export, these organizational exports are prepared manually, so we may charge a reasonable fee based on the time and materials involved. This fee applies only to a full organizational export prepared as a service — never to an individual exercising the free rights above. We will not delete an organization's data without first giving you a reasonable opportunity to obtain an export.

How to Exercise Your Rights

Email us at info@trueboard.org. We will verify your identity before acting on a request — for example, by confirming control of the account or email address involved. You may use an authorized agent to submit a request where the law allows, with proof of their authority. We will respond within the time required by applicable law. If we decline a request, we will tell you why, to the extent the law allows.

If your request concerns content your organization controls (documents, messages, motions, votes), we will direct you to your organization and support them in responding.

Appeals

If we deny a privacy-rights request, you may appeal by replying to our decision or emailing info@trueboard.org with "Privacy Appeal" in the subject line. We will review the appeal and respond within the time the law requires. If we deny your appeal, you may contact your state attorney general or data protection authority.

California Residents (CCPA/CPRA)

California residents have the rights described above. Categories of personal information we collect include:

• Identifiers (name, email address, account ID)
• Internet activity (IP address, session data)
• Professional information (organization membership, role within organizations)

We do not sell or share personal information, and we have not done so in the past 12 months. We use sensitive personal information only as needed to provide the Service or as otherwise permitted by applicable law.

Other U.S. State Privacy Rights

If you live in a U.S. state with a comprehensive privacy law, you may have rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We do none of those things, so there is nothing to opt out of. You may exercise your access, correction, deletion, and portability rights, and appeal a denial, as described above.

Nevada Residents

Nevada law lets residents opt out of the "sale" of certain personal information. We do not sell personal information, so there is nothing to opt out of. You may still contact us with any questions.

Data Retention and Organizational Records

We retain your personal data only as long as you have an active account or as needed to provide services to your organization, and afterward only as needed to comply with our legal obligations, resolve disputes, defend or bring legal claims, handle complaints, and enforce our agreements. The data may remain cached or archived for a reasonable period of time. Where we cannot delete something for technical reasons, we isolate it and prevent further use.

However, organizational governance records are different. Documents, meeting minutes, motions, votes, and other content created within an organization belong to that organization. Records of your actions as a board member (votes cast, motions made, documents authored) are part of the organization's official record and may be retained even after you leave or delete your account. The organization, as controller, decides when its records are deleted.

Aggregated and De-Identified Data

We may create and use aggregated or de-identified data (such as daily visit counts per page) that cannot reasonably be used to identify you. We maintain such data in de-identified form, do not attempt to re-identify it, and may retain and use it to operate and improve the Service.

Changes to This Policy

The Company may review and update this Privacy Policy periodically. If we materially modify how we collect, use, or share personal information, we will post the updated Privacy Policy on this page. In some cases, we may post a notice on the Services, email you, or other means as may be required by applicable law to inform you of changes to our Privacy Policy.

Contact Us

Questions about this policy or our privacy practices? We're happy to help.

Aeris Labs LLC, California Email: info@trueboard.org