Privacy policy

Who is responsible

The controller under the GDPR is Boardly Systems OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. Write to hello@pathkit.ai about anything on this page. The full details are in the imprint.

What we collect

• Your account. Name, email address, avatar if your sign-in provider has one, and a hash of your password if you set one. The password itself is never stored.
• What you create. Workspaces, boards, the screen images you import, comments, notes, and the settings of your workspace.
• Sign-in and security. Your sessions, with the IP address and browser they came from, and short lived counters that stop somebody guessing passwords.
• How the service runs. Server errors, how long requests took, and how much AI use a workspace has had, so we can fix faults and keep costs within the plan.
• The launch list. Your email address, if you ask to be told when PathKit opens.

Why, and on what legal basis

• To give you the service you signed up for, which is your account, your boards and your team's review. Art. 6(1)(b) GDPR, a contract with you.
• To keep the service secure and working, which covers sessions, rate limits and error records. Art. 6(1)(f) GDPR, our legitimate interest in a service that is safe and runs.
• To mail you when somebody mentions you or replies on a thread you are in. Art. 6(1)(b) GDPR. You can turn this off in Settings, or from the link in any such mail.
• To tell you when PathKit opens, if you joined the launch list. Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time from the same place you gave it.
• To keep billing records for as long as tax law requires. Art. 6(1)(c) GDPR, a legal obligation.

You need an email address to have an account. Everything else is up to you. Nothing about you is decided by automated means in the sense of Art. 22 GDPR. The AI review judges designs, not people.

Who else handles it

These companies process data for us under a data processing agreement, or in Polar's case as the seller of record. Nobody else receives your data, and we sell it to nobody.

• Cloudflare. Hosts the app and stores the screen images you import (Cloudflare R2). Every request, which includes your IP address and browser details, and the images themselves.
• Neon. Runs the database. Your account, your workspaces, boards, comments, notes and everything else you create in PathKit.
• Resend. Delivers the mail PathKit sends. Your email address and the content of the mail, which is a sign-in link, a password reset link, an invitation, or a note about a comment.
• Anthropic. Reads screen images and answers questions about a board, when somebody in your workspace uses the AI review or PathAI. Screen images, screen and control names, descriptions, the question asked of PathAI and the thread it is asked in. Not your email address or password.
• OpenAI. The same job as Anthropic, as a second provider. The same as Anthropic. Only when it is the provider in use, or your workspace added its own OpenAI key.
• Liveblocks. Shows who else is on a board and where their cursor is. Your name, avatar and colour, your cursor position, and which board you have open. Comments are not sent there. Only when live cursors are turned on.
• Figma. Lets you sign in with Figma, and import a Figma file by its link. When you sign in, we receive your Figma id, handle, email address and avatar. When you import, we read the file with your permission.
• Google and GitHub. Let you sign in with an account you already have. We receive your name, email address and avatar from the provider you choose.
• Polar. Takes payment for Pro, as the merchant of record. Your billing and payment details go to Polar directly and never reach us. We receive the plan, the number of seats and the state of the subscription.

A workspace can add its own Anthropic or OpenAI key. The requests made with it are then covered by that workspace's own agreement with the provider.

A share link shows a board to anybody who has the link, without an account. Whoever makes one decides who gets it, and can turn it off.

Transfers outside the EU

Several of the companies above are based in the United States, so your data can be processed there. Where a company is certified under the EU-US Data Privacy Framework, the transfer relies on the adequacy decision for it. Otherwise it relies on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR. Ask us for a copy of the safeguards for any one of them.

Cookies and local storage

PathKit sets only what it needs to work. A session cookie that keeps you signed in, a short lived copy of it so every page does not have to ask the database, and two preferences, which workspace you last opened and which review rules you switched off. Your browser's local storage holds things like the theme and the width of a panel.

There is no analytics, no advertising and no tracking, from us or from anybody else. Because everything stored is strictly necessary for a service you asked for, no consent is needed under Art. 5(3) of the ePrivacy Directive, and you will not see a cookie banner.

How long we keep it

• Your account and what you create, for as long as the account or the workspace exists. Deleting a workspace deletes its boards, comments and notes at once. The image files sit at addresses nobody can guess and are removed from storage separately, so they can outlast the board by a while. Ask us and we remove them straight away.
• Sessions end after 30 days without use, or when you sign out.
• A sign-in link works for 15 minutes and a password reset link for 1 hour. Both work once.
• Earlier versions of a board, up to 60 per board, until the board is deleted.
• The launch list entry, until you leave the list or delete your account.
• Billing records, for the period accounting law sets, which in Estonia is 7 years.

Your rights

Under the GDPR you can ask us

• for a copy of the data we hold about you (Art. 15)
• to correct it (Art. 16)
• to delete it (Art. 17)
• to restrict how we use it (Art. 18)
• to hand it to you, or to somebody else, in a machine readable form (Art. 20)
• to stop using it where we rely on a legitimate interest (Art. 21)
• to withdraw a consent you gave, which stops future use and does not undo past use (Art. 7(3))

Two of these you can do yourself, under Settings, Account. Download my data hands you a copy of what we hold about you, and Delete account removes the account and every workspace only you were in. For anything else, write to hello@pathkit.ai. We answer within a month.

You can also complain to a data protection supervisory authority (Art. 77), in particular the one where you live or work, or the one responsible for us, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Changes

PathKit is in private beta and this page will change as it does. If a change affects what we do with data you have already given us, we will tell you by email before it takes effect.