Introduction
This Privacy Policy describes how Gladeboard ("we", "us", or "our") collects, uses, and shares information about you when you use our services. Effective Date: August 4, 2026. Version: 7a0f277c.
If you have questions about this policy, please contact us at hello@myglade.app.
Information We Collect
We collect the following categories of personal data for the purposes described below. Under GDPR Article 6, we rely on the lawful bases shown for each processing purpose:
| Category | Fields collected | Purpose | Lawful basis |
|---|---|---|---|
| Account Information | Email address, Name (optional, from sign-up), Username (optional, chosen during onboarding), Password (stored only as a hash), Onboarding preferences | To create and authenticate your account, and to send you service email such as address confirmation | Performance of a contract (Article 6(1)(b)) |
| Session Data | Session token, Session creation and expiry time, IP address, Browser user-agent | To keep you signed in and to protect your account against unauthorised access | Performance of a contract (Article 6(1)(b)) |
| Board Content | Boards, cards and connectors, Images, video posters and file attachments you add | To store your boards in your account and sync them to every device you sign in on. We do not read the contents of your boards; the server counts how many boards a workspace holds, because that is what the free plan meters | Performance of a contract (Article 6(1)(b)) |
| Billing Information | Stripe customer and subscription identifiers, Plan, billing cycle, seat count and renewal date | To take payment for a paid plan and to know which plan your account is on. Card details are handled by Stripe and never reach our servers | Performance of a contract (Article 6(1)(b)) |
| Technical Logs | IP address, User-agent, Timestamp, Endpoint requested | To operate and secure the service, and to diagnose faults | Legitimate interests (Article 6(1)(f)) |
Automated Decision-Making and Profiling
We do not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Article 22.
Data Retention
We retain your data for the following periods:
| Category | Retention period |
|---|---|
| Account Information | Until you delete your account |
| Session Data | Until the session expires or you sign out; sessions roll forward for up to one year of use |
| Board Content | Until you delete the content, or your account |
| Billing Information | For as long as required by tax and accounting law |
| Technical Logs | 30 days |
Whether You Are Required to Provide This Data
For each category of personal data we collect, we set out below whether you are required to provide it — by law, under our contract with you, or as a precondition to entering into a contract — or whether provision is voluntary, together with the consequences of failing to provide it.
| Category | Requirement | Consequences |
|---|---|---|
| Account Information | Required to enter into a contract | We cannot create or operate an account for you. |
| Session Data | Required to enter into a contract | We cannot keep you signed in. |
| Board Content | Required to enter into a contract | We cannot sync your boards between your devices. |
| Billing Information | Required to enter into a contract | We cannot sell you a paid plan. |
| Technical Logs | Voluntary | Your browser sends this with every request; it cannot be withheld while using the service. |
Third-Party Services
We share data with the following third-party services:
| Service | Purpose | Privacy policy |
|---|---|---|
| Stripe | Payment processing | View |
| Vercel | Hosts the website, the web app and the API. Sees request metadata including IP address. | View |
| Supabase | Hosts the Postgres database holding accounts, sessions, subscriptions and synced boards (US region). | View |
| Stripe | Takes payment for paid plans and stores card details. We never receive your card number. | View |
| Resend | Sends transactional email — currently only the address-confirmation message. | View |
| Google Fonts | Serves the two typefaces the website uses. Your browser requests them directly, which discloses your IP address to Google. | View |
| Google (favicon service) | Fetches the site icon shown on a link card. This discloses the hostname of a link you saved — not the full URL, and not the contents of your board. | View |
Your Rights
You have the following rights regarding your personal data:
- Right to access your personal data
- Right to correct inaccurate data
- Right to request deletion of your data
- Right to receive your data in a portable format
- Right to restrict how we process your data
- Right to object to processing
- Right to opt out of the sale of your personal information
- Right to non-discriminatory treatment for exercising your rights
GDPR Supplemental Disclosures
This section applies to individuals in the European Economic Area (EEA) under the General Data Protection Regulation (GDPR).
Data Controller: Sardorbek Samejonov, 8355 Oakdale Ct, Mason, OH 45040, United States
We have not appointed a Data Protection Officer. Our processing activities do not meet the thresholds in GDPR Article 37(1) that would require one.
You have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or place of the alleged infringement. A list of EEA supervisory authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en.
Where we transfer your personal data outside the EEA, we rely on one or more of the safeguards permitted under Chapter V of the GDPR: (a) transfers to countries the European Commission has determined provide an adequate level of data protection (the current list is published at commission.europa.eu/.../adequacy-decisions_en); (b) Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c); and (c) Binding Corporate Rules approved under Article 47 where applicable. You may request further information about the specific safeguards applied to a particular transfer by contacting us at hello@myglade.app.
UK Privacy Rights (UK-GDPR)
This section applies to individuals in the United Kingdom under the UK General Data Protection Regulation (UK-GDPR), as tailored by the Data Protection Act 2018.
Data Controller: Sardorbek Samejonov, 8355 Oakdale Ct, Mason, OH 45040, United States
We have not appointed a Data Protection Officer. Our processing activities do not meet the thresholds in GDPR Article 37(1) that would require one.
The supervisory authority for data protection in the UK is the Information Commissioner's Office (ICO). If you believe we have not handled your data in accordance with UK data protection law, you have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint.
If we transfer your personal data outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with the UK-GDPR, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses where applicable.
California Privacy Rights (CCPA)
If you are a California resident, you have the following additional rights:
- Right to Know — You may request disclosure of the personal information we collect, use, and share about you.
- Right to Delete — You may request deletion of personal information we have collected about you.
- Right to Opt-Out — You may opt out of the sale of your personal information.
- Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights.
Submitting requests. To exercise any of these rights, contact us using one of the methods below. We will respond within the timeframes required by CCPA §1798.130.
- Email: hello@myglade.app
Contact Us
Contact us:
- Legal Name: Sardorbek Samejonov
- Address: 8355 Oakdale Ct, Mason, OH 45040, United States
- Email: hello@myglade.app
- Website: https://myglade.app