Privacy Policy
What personal data Moxboard collects, why, where it is stored and the rights you have.
This policy explains how FTU, Lda ("Moxboard", "we"), a company incorporated in Portugal (NIPC 513004572, Porto, Portugal), handles personal data when you visit moxboard.app, help.moxboard.app or use the Moxboard app at app.moxboard.app.
If you have a question or want to exercise a right, write to us through help.moxboard.app/contact and start your message with "Privacy". We answer within 30 days.
1. Two roles: controller and processor
- We are the controller for the data we need to run Moxboard: your account, billing, support requests, security logs and product analytics.
- We are a processor for the content your team puts in a workspace: projects, tasks, comments, attachments, and the names and emails of the people you invite. The workspace owner (usually your company) decides what goes in and is the controller. We process that content only to provide the service, under the data processing terms in section 9 of our Terms.
2. What we collect
| Data | Examples | Why | Legal basis |
|---|---|---|---|
| Account | name, email, password (stored only as a hash), language, profile photo | create and secure your account | contract |
| Workspace content | projects, tasks, comments, files, activity history | provide the service | contract (on behalf of the workspace owner) |
| Invitations | email and role of people you invite | send the invitation | contract / legitimate interest of the workspace owner |
| Billing | company name, billing email, address, VAT number, invoices, plan and size | charge, issue invoices, meet tax law | contract and legal obligation |
| Payment card | handled entirely by Stripe; we only see brand, last 4 digits and expiry | take payments | contract |
| Notifications | your notification choices; Slack user ID if you connect Slack | send the email and Slack messages you chose | contract |
| Imports | an Asana personal access token, if you import from Asana | copy your data into Moxboard | contract; the token is deleted when the import ends |
| Support | messages you send us and a hashed IP to prevent spam | answer you and protect the form | legitimate interest |
| Security logs | IP address, browser, sign-in times | keep accounts safe, investigate abuse | legitimate interest |
| Product analytics | pages visited, clicks, which features are used, device type, country | understand what to improve | legitimate interest |
We do not sell personal data, we do not use it for advertising and we do not use workspace content to train AI models.
3. Analytics without cookies
We use PostHog (EU cloud, Frankfurt) to understand how Moxboard is used. It runs without cookies or browser storage. On our public pages visitors are counted with a daily anonymous hash computed by PostHog; inside the app events are linked to your account so we can see which features help teams. IP addresses are discarded. Session recordings, when enabled, mask all text and every input field, so the content of your tasks is never recorded. Events never include task titles, descriptions or comments.
You can object to product analytics at any time by writing to us; we will exclude your account.
4. Who processes data for us (sub-processors)
| Provider | What for | Where |
|---|---|---|
| Supabase | database, authentication, file storage | EU (Ireland) |
| Vercel | hosting of the website and app | EU and global edge network (Vercel Inc., USA) |
| Stripe and Link (Stripe Managed Payments) | payments, receipts, VAT and sales tax, as merchant of record | EU (Ireland) and USA |
| Resend (Amazon SES) | sending emails | EU (Ireland); Resend Inc., USA |
| PostHog | product analytics | EU (Germany) |
| Slack | notifications, only if you connect your Slack account | USA |
| Google Fonts | typefaces on the website and app | global (Google, USA) |
Where a provider is in, or may give access from, a country outside the EU/EEA, the transfer is covered by the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
AI apps you connect yourself. You can connect Moxboard to an AI assistant such as Claude (by Anthropic) through our MCP server. This only happens if you choose to connect it, for the workspaces you pick, and with read-only or read-and-edit access. When you then ask the assistant about your work, the tasks, comments and names it reads are sent to that app's provider to answer you, under that provider's own terms and privacy policy. That provider is not our sub-processor: you decide to use it, as with any other app you share data with. The assistant only sees what you can see in Moxboard, never sees attachment contents, and you can disconnect it at any time in Integrations. Workspace admins can turn AI apps off for their workspace.
5. How long we keep data
- Account and workspace content: while the account or workspace exists. Deleted workspaces and their files are removed from the live database right away and from backups within 30 days.
- Inactive Free workspaces: deleted after 180 days without activity, with an email warning at 150 days.
- Billing records and invoices: 10 years, as Portuguese tax law requires.
- Support requests: up to 2 years after they are closed.
- Security logs: up to 12 months.
- Analytics events: up to 12 months.
6. Your rights
You can ask to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent where we rely on it. You can export a workspace yourself at any time (CSV or ZIP). For content in a workspace that belongs to someone else, we will pass your request to the workspace owner.
You also have the right to complain to the Portuguese data protection authority, the CNPD (www.cnpd.pt), or to the authority in your country.
7. Security
Data is encrypted in transit (TLS) and at rest. Every request is checked against your workspace and role (row-level security), attachments are private and served through expiring links, and private projects are visible only to the people chosen. Card data never touches our servers.
8. Children
Moxboard is a tool for work and is not intended for anyone under 16.
9. Changes
If we change this policy in a way that matters, we will tell workspace admins by email before the change applies. The date at the top shows the latest version.