Privacy Policy

Version 1.3  ·  Effective 22 October 2026

BoardHQ ("we", "us", "our") is committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020. This policy explains what we collect, why we collect it, and how we keep it safe.

1. Who we are

BoardHQ is a board governance and meeting management platform operated in New Zealand.
Privacy Officer: privacy@boardhq.net

2. What we collect

• Account information — your name, email address, and hashed password.
• Organisation data — the name and details of boards and organisations you belong to.
• Meeting content — agendas, minutes, resolutions, voting records, and action items you create or participate in.
• Documents — files you upload to the platform.
• Usage data — IP address, browser type, pages visited, and timestamps, used for security and diagnostics.
• Consent record — the date and version of this policy you agreed to at registration.

3. How we use your information

• To provide and operate the BoardHQ service.
• To send transactional emails (meeting invitations, account activation, password reset).
• To maintain security, detect abuse, and prevent unauthorised access.
• To comply with legal obligations.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Where your data is stored

Data, including uploaded documents, is stored on servers hosted by DigitalOcean (cloud infrastructure) in Sydney, Australia. By using BoardHQ you consent to this storage, including the transfer of your information outside New Zealand. We apply industry-standard security controls including encrypted connections (TLS), password hashing, and access controls.

5. Third-party services

• Amazon Web Services (Amazon SES, Sydney) — transactional email delivery. Your email address and the content of the emails you request (such as meeting invitations) pass through Amazon SES solely so they can be delivered.
• Porkbun — email forwarding for messages you send to our support addresses (for example support@boardhq.net).
• Stripe — payment processing for paid subscriptions. Card details are handled directly by Stripe and are never stored on our servers. Stripe may process payment information outside New Zealand and Australia.
• Microsoft Office Online — when you preview a Word, Excel or PowerPoint file, Microsoft's online viewer fetches that file through a private link that expires after 30 minutes, in order to display it. PDF and image previews do not use Microsoft.
• Google Drive — optional integration you may connect. We only access files in the specific folder you authorise.

6. Your data belongs to your organisation

Meeting minutes, resolutions, documents, and other board content you create belong to your organisation, not to BoardHQ. Admins of your organisation can view and manage all content within their workspace. BoardHQ staff access your data only when required for support or legal compliance, and only with your permission.

7. Data retention, deletion and backups

We retain your personal data for as long as your account is active or as needed to provide services. If you close your account, your personal data is deleted from the live service within 30 days, except where we are required by law to retain it.

Deleting an organisation. When an admin deletes an organisation it is hidden and locked straight away, and held for 14 days so that it can be restored if it was a mistake. After 14 days everything in it is permanently deleted from the live service: its meetings, minutes, resolutions, documents and uploaded files, and the accounts of anyone who belonged to no other organisation. We email the organisation's admins the date this will happen.

Your organisation's records. Minutes and resolutions are your organisation's own records, and many organisations must keep them for up to 7 years to meet legal and audit obligations. BoardHQ is not a long-term archive: export your records (Settings, then Export) before deleting an organisation or closing an account.

Backups. We keep encrypted backups so that we can recover from a failure. Daily backups are kept for 14 days, and one backup a month is kept for up to 12 months. They are held in the same Australian hosting described above, and an encrypted monthly copy is also kept by the operator. Information you delete, including a deleted organisation, can therefore remain in these backups after it has gone from the live service: for up to 14 days in the daily backups and up to 12 months in the monthly ones. Backups are not used for any other purpose, and are restored only to recover from a system failure, after which we delete again anything that should already have been deleted.

8. Your rights

Under the NZ Privacy Act 2020 you have the right to:

• Access the personal information we hold about you.
• Correct any information that is inaccurate.
• Request deletion of your account and personal data.
• Withdraw consent — though this may mean we can no longer provide the service.

To exercise any of these rights, email privacy@boardhq.net. We will respond within 20 working days as required by the Act.

9. Cookies

BoardHQ uses only essential session cookies to keep you signed in. We do not use advertising or analytics cookies.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email. The version number and effective date at the top of this page always show the current version.

11. Complaints

If you have a privacy concern, please contact us at privacy@boardhq.net first. If we cannot resolve it, you may complain to the Office of the Privacy Commissioner.