Privacy Policy

Our privacy policy and how we use your data

Last updated: July 16, 2026

boardingon.ai is an early-stage product. This Privacy Policy is a good-faith draft written by our team, not by a lawyer, and it is not legal advice. We are having it reviewed by legal counsel before the first real employee data is onboarded, and we will update this page when that review is complete. If a specific point matters to you, please reach us first at hello@boardingon.ai.

boardingon.ai ("boardingon.ai", "we", "us") provides AI-assisted employee-onboarding software. This Privacy Policy explains what information we handle across our marketing website, sign-up, and the app, how we use it, and the choices you have.

Our two roles: controller and processor

We handle information in two different capacities, and it matters which applies to you. For our own marketing site and for the people who sign up and administer an account (their name, work email, company, and billing details), we act as a data controller and this Privacy Policy governs. For the employee data and company documents a customer company puts into the platform, we act as a processor: we handle that data only on the customer company's instructions to provide the Service, and the customer company — the employer — is the controller of it.

Information we collect

We collect the following categories of information:

  • Account and administrator data — the name, work email, company details, and billing information of the person who sets up and manages an account.
  • New-hire personal data — added by the customer company for the people it onboards: names, email addresses, role, onboarding progress, and the files or links a hire uploads as proof of completed steps.
  • Company content — the material a customer uploads for the AI to work from, such as role descriptions, SOPs, notes, and recording links. These documents may themselves contain other people's personal data.
  • Technical and usage data — basic information collected automatically to operate and secure the Service and to understand website usage, such as IP address, browser type, and activity (including via cookies and analytics — see our Cookie Policy).

How we use information

We use information to provide and improve the Service: to create and manage accounts, generate and track onboarding plans, keep managers informed of progress, secure the platform, handle billing, respond to support requests, and communicate with you about the Service. We use a customer's employee data only to deliver the Service to that customer — not for our own independent purposes. We do not sell personal data.

AI processing

The Service's AI features are powered by Anthropic (Claude), which we access through its commercial API. Content you provide is sent to Anthropic only to generate results for your company. Under Anthropic's current commercial terms, your inputs and outputs are not used to train Anthropic's models; Anthropic retains them only briefly to detect abuse and keep the service safe, and then deletes them. AI output is a draft for a person to review — it can be wrong, and it is not used to make automated decisions about anyone. Subprocessor terms can change; we describe Anthropic's practices as they stand today.

How information is shared and our subprocessors

We do not sell your personal information. We share information with the service providers below (our "subprocessors") that help us run the platform, under contracts requiring appropriate confidentiality and security. Most act only on our instructions as our processors; some — such as Google Analytics on our public website — also process certain data under their own terms, as described in our Cookie Policy. We may also disclose information where required by law or in connection with a business transfer. Each customer company's data is kept within its own tenant space and is not shared with other companies.

  • AnthropicAI model processing — drafts onboarding plans and coaching suggestions from the content you provideUnited States
  • SupabaseManaged database, authentication, and file storage for your account and onboarding dataUnited States
  • VercelApplication hosting and content deliveryUnited States and global edge network
  • Google AnalyticsUsage analytics for our public marketing websiteUnited States
  • ResendDelivery of transactional and notification email (invites, reminders, status updates)United States
  • SentryApplication error monitoring and diagnosticsUnited States

This is the current list of subprocessors we use. We will update it when we add or replace a provider.

International data transfers

Our providers are based primarily in the United States, so your information may be processed there and in other countries. Where a transfer requires it, we work to put appropriate safeguards in place, such as standard contractual clauses; the specific safeguards are being confirmed as part of the legal review noted at the top of this page. We do not promise that data stays in any one country or region.

Data retention

We retain account information for as long as an account is active and as needed to provide the Service and to meet legal, security, or operational needs. Employee data and company content are retained according to the customer company's instructions and are deleted or returned when its use of the Service ends. We use these criteria-based timeframes rather than fixed dates.

Deletion and your rights

Depending on where you are, applicable law may give you rights over your personal information. Where those rights apply, they may include:

  • access to the personal information we hold about you;
  • correction of inaccurate information;
  • deletion of your information;
  • a copy of your information in a portable form (export);
  • restriction of, or objection to, certain processing; and
  • for California residents, the rights to know and delete, and to opt out of the sale of personal information (we do not sell it). We will not discriminate against you for exercising your rights.

To make a request, contact us at hello@boardingon.ai. When deletion is requested, note that copies may persist briefly in secure backups before they are overwritten on their normal cycle.

If you are an employee or new hire

If your personal data is in the platform because your employer onboards you with boardingon.ai, your employer is the controller of that data. Please direct access, correction, or deletion requests to your employer. If you contact us directly, we will forward your request to the relevant customer company and assist them in responding; we have no direct relationship with the individuals whose data we process on a customer's behalf.

Security

We use technical and organizational measures designed to protect your information, including encryption in transit, per-company data isolation enforced at the database layer, permission-based access, and error monitoring. No method of transmission or storage is completely secure, so we describe these as measures we take, not a guarantee, and we do not claim any security certification we do not hold.

Cookies and analytics

We use cookies that are necessary to run the Service and, on our public website, Google Analytics to understand usage. Details, and how to manage cookies, are in our Cookie Policy.

Children

The Service is a workplace tool and is not directed to children. We do not knowingly collect personal information from anyone under the age at which they can lawfully work, and we will delete such information if we learn we have collected it.

Changes

We may update this policy from time to time. We will post the updated version with a new date above and, for material changes, take reasonable steps to let you know.

Contact

Questions about this policy, or to make a privacy request: hello@boardingon.ai.