What we process, who sees it,
and what the agents may decide

Operator

Michał Piontek, operating Huddleboard

Business address

Jemiołuszki 118, 05-500 Zgorzała, Poland

Tax identification (NIP)

9691453630

Business registration

Registered in CEIDG, Poland’s Central Register and Information on Economic Activity

Phone

+48 669 967 597

Contact

contact@huddleboard.ai

The EU online dispute resolution platform was discontinued in July 2025. You may seek help from a local consumer ombudsman or the Polish Trade Inspection. Information about out-of-court dispute resolution is available from UOKiK. Participation in a particular procedure depends on applicable law and the parties’ agreement; court remedies remain available.

Attachment safeguards (3 November 2026): we validate file formats and hold uploads in private quarantine in AWS Frankfurt while Amazon GuardDuty checks for malware. Files become available only after a clean scan result; missing or failed results keep them blocked. Quarantined copies are deleted after release, rejection or expiry; an S3 lifecycle rule provides backup expiry. Transfer counters associated with accounts and workspaces prevent abuse and excessive usage and are retained for up to two days. Failed or abandoned uploads are removed automatically; deleted files are queued for removal including stored versions. These security checks do not guarantee that every file is safe or lawful.

Michał Piontek is the controller for account administration, service security and correspondence. For personal data a business places in its workspace and controls, Huddleboard acts on that business’s instructions where it is a processor. Before submitting business-controlled personal data, an authorized workspace owner must accept the data-processing agreement in Settings → Workspace. This notice does not itself conclude that agreement. Read the business DPA; no separate signature or email exchange is required. Contact contact@huddleboard.ai for help.

What we process, why, and on what basis

Sources and workspace access

We receive data from you, invited workspace members, connected GitHub repositories and reviews, and the AI services you use. If Google sign-in is enabled, Google supplies your verified email and profile as a separate identity service. Authorized workspace members can see content according to their role. Email and membership information are needed to provide access; AI features require a connected provider account. If you use voice in a huddle, OpenAI receives your microphone audio and Huddleboard stores the transcript. Do not submit sensitive personal data or other people’s information without authority and an appropriate legal basis.

Retention and deletion

Owners can request workspace deletion in Settings → Workspace after stopping active runs and voice sessions. The workspace closes to normal access immediately. Permanent cleanup starts after 24 hours and is due within 30 days of the verified request. This is not a self-service cancellation window. Cleanup covers workspace database records, stored credentials, attachments and their versions, run checkpoints and transcripts.

Backup copies are scheduled to expire within 35 days after primary erasure, so backup deletion may take up to 65 days from the request. Restored backups must have recorded deletions reapplied before access resumes. We retain a minimal deletion ledger containing an opaque workspace or account identifier and cleanup status, without content or email addresses to prevent deleted data returning through a restore.

Deleting a workspace does not delete a shared account used in other workspaces, published GitHub repositories or pull requests, or copies held independently by AI providers. Close your personal account in Settings → Account after resolving sole workspace ownership, or contact us for help. Identity deletion preserves shared content; request removal of personal information embedded in that content separately. If a legal obligation or a specific claim requires limited retention, we restrict it to that purpose and explain the applicable exception. A workspace owner’s export is not a substitute for your individual right of access.

AI providers and voice

Task context, selected source code and PR feedback may be sent through OpenRouter to the selected model provider. Voice in huddles is optional and uses the OpenAI API account connected by the workspace administrator. Microphone audio goes directly from the browser to OpenAI for speech processing. Huddleboard does not store audio files; it saves the transcript as workspace content. Before speaking, a user confirms they have informed anyone whose speech may be captured. The voice disclosure explains OpenAI processing, retention settings, charges and call termination.

API keys are configured for a workspace and can fund requests by its authorized members; they are not isolated to the person who entered them. Bringing your own key does not mean data bypasses Huddleboard. We cannot promise that every provider has the same training or retention policy. Your provider agreement, privacy settings and selected route matter, including for free models. Review OpenRouter’s privacy policy and the selected provider’s terms before sending confidential or personal data.

Hosting and international transfers

Production hosting runs in AWS eu-central-1 (Frankfurt), with Cloudflare DNS and Amazon SES email. Public website files are stored in private Amazon S3 and delivered through the application service; no separate CloudFront distribution is used. Contact correspondence is handled through Google Workspace. This does not establish EU-only processing: GitHub, OpenRouter, downstream model providers and, for voice, OpenAI may process data elsewhere. A provider key or acceptance of this notice is not, by itself, a safeguard for international transfers. Where required, transfers must be covered by an applicable adequacy decision or safeguards such as standard contractual clauses, together with any necessary supplementary measures. Contact us for information about the arrangements applicable to your workspace before submitting data that requires them.

Privacy controls

Voice uses OpenAI’s global API endpoint and does not promise EU-only processing or zero retention; the connected account’s settings apply. Current text-completion requests require no-collection and zero-retention routing filters. An unavailable compliant route causes failure rather than a less restrictive retry. These filters do not guarantee provider conduct, override account logging or eliminate operational metadata, transient processing or legal exceptions.

Optional Google Analytics measures website and app usage only with your consent. No advertising tracking is enabled. Do Not Track does not change necessary storage or enable analytics. The dated analytics notice explains this processing and how to withdraw consent. Mandatory rights remain available wherever applicable; this Poland/EU-first launch does not claim exemption from other countries’ laws.

Your rights

• Access
• Rectification
• Erasure
• Restriction
• Portability
• Objection
• Withdraw consent
• Complain to a supervisory authority

Michał Piontek handles privacy requests at contact@huddleboard.ai. We respond without undue delay, normally within one month. Where a lawful extension is needed, we explain it within that first month. We may request proportionate identity verification. You may complain to the President of the Personal Data Protection Office (UODO) in Poland or another competent supervisory authority. These rights apply subject to their legal conditions. Where processing relies on consent, you can withdraw it without affecting prior lawful processing. Privacy questions are handled directly by the operator at the address above.

Google Analytics is integrated on the website and app, gated by explicit consent. The website footer and app Settings → Account → Analytics let you change your choice. Authentication uses a separate necessary refresh cookie. Earlier cookie choices from before the analytics notice do not enable tracking.

Agents are software and are identified by role and model in the app. Generated titles, criteria and estimates can appear automatically while drafting. Story triage may propose subtasks or create them automatically depending on workspace settings. Successful code runs can publish branches and regular PRs, and addressing PR feedback can post replies. These actions use configured permissions; not every generated text waits for approval.

We use general-purpose models through OpenRouter and do not build our own. Uses the AI Act prohibits are not permitted. The service is intended for project and software-development work, not for making decisions about employment, credit, education eligibility or other similarly significant matters about people. This use restriction is not a certification of any regulatory classification.

The operator is a one-person microenterprise within the applicable EUR 2 million financial limit. The Polish Accessibility Act exempts services provided by microenterprises; this is not an exemption from every accessibility obligation. WCAG 2.2 AA remains our design goal, not a certification. We will reassess eligibility if the business changes.

Known limitations

Complex board interactions, live updates and generated content require further assistive-technology testing. This statement does not claim that every control meets a particular target size or contrast ratio.

Feedback & enforcement

Report accessibility issues to contact@huddleboard.ai. Include the affected page, the barrier and any assistive technology used. We review reports and discuss an accessible alternative where possible. Applicable statutory complaint and enforcement rights remain available; no certification of accessibility is claimed.

Motion respects prefers-reduced-motion: the ambient glow, the travelling beams and the cursor halo all stop.

Agreement and eligibility

These terms govern access to Huddleboard, provided by the operator identified above. You may use it as an individual or on behalf of a business you are authorized to represent. The launch is intended primarily for users in Poland and the European Union. You must be at least 18. This describes our launch focus, not a technical country restriction or a waiver of mandatory rights. The agreement begins when you verify your identity and explicitly accept these terms. It continues indefinitely, with no minimum commitment; you can end use at any time. For Polish consumers, the Polish version prevails in case of differences, without limiting mandatory rights; accepting the privacy notice is not consent to unrelated data processing. You can download and keep this dated document. The Polish version and a model withdrawal form are linked above.

Access and acceptable use

Huddleboard provides project boards, AI-assisted planning, agent runs, GitHub workflows and huddles with optional voice. An internet connection and a supported modern browser are required. Before using voice, inform everyone whose speech may be captured. You must have authority to connect a workspace, repository or provider account and to submit the content you provide. Keep credentials secure and do not use the service for unlawful content, infringement, unauthorized access or abuse of other users or providers.

Customer-connected OpenRouter accounts

OpenRouter remains on its global endpoint. Connecting a key authorizes Huddleboard to use it for this workspace; it does not accept a provider agreement on your behalf or prove transfer coverage. Use an account you are authorized to connect, with authority for workspace members to use it. Review and comply with OpenRouter’s terms, including the applicable Model Terms in section 5. Do not use a model whose terms you cannot accept. Mandatory consumer rights remain unchanged.

Before sending personal data, establish the agreements and transfer safeguards for the actual parties and recipients. Customer instructions do not release Huddleboard from its own obligations. Do not send employment/HR records, financial or health information, identity documents or unrelated secrets to AI unless the required provider arrangements and safeguards have first been established. Remove unnecessary personal data from task and repository context.

AI output and spending

AI output can be incorrect or incomplete. Review generated code, dependencies, licences and test evidence before deployment. Starting a run authorizes use of the selected provider through your connected account. Estimates are not quotes, and budget guards cannot guarantee a final invoice because usage is reported after requests. Free-model availability can change. Huddleboard does not merge pull requests on your behalf.

Your content

You retain existing rights in content you supply. You authorize the processing, storage and transmission needed to provide the requested features, including to connected providers. This does not guarantee that generated output is exclusive, copyright-protected or free from third-party rights.

Availability, changes and responsibility

Availability depends on hosting, network and connected providers; there is no contractual uptime guarantee. We remain responsible as required by law for the service we supply. Nothing here excludes liability that cannot lawfully be excluded or limits mandatory consumer remedies for a service that does not conform to the agreement. Third-party provider agreements govern their own services and charges.

We may update the service and these terms for security, legal requirements or changes to functionality. Material changes will be notified in the service or by email before they take effect where required. The notice will explain the change, effective date and any right to end use. Changes do not remove rights already accrued.

Complaints and ending use

Send service complaints or account-closure requests to contact@huddleboard.ai, identifying the affected account and describing the issue. Consumer complaints receive a response within 14 days. You can stop using Huddleboard at any time. Disconnecting Huddleboard does not cancel independent provider agreements or charges already incurred. We may restrict access when necessary to address unlawful use or an immediate security risk; any applicable consumer remedies remain available.

Information on consumer rights is available from UOKiK. Information on privacy-request deadlines is available from UODO.

Polish law governs the service. This choice does not remove mandatory consumer protections that apply in your country of habitual residence. Jurisdiction follows applicable law; these terms do not require consumers to use an exclusive Polish court.

Switching and retrieval

You may request transfer of your exportable workspace data and digital assets to another provider or your own infrastructure at contact@huddleboard.ai. We charge no switching, data-egress or early-termination fee and require no advance notice period. We verify your authority, agree a start date without undue delay and provide reasonable assistance, data security and continuity during the transition. The normal maximum transition is 30 calendar days. If this is technically impossible, we explain the reasons within 14 working days of the request and identify an alternative period, no longer than seven months. You may extend the transition once for a period appropriate to your needs. Mandatory shorter periods or stronger rights prevail.

Exportable data include your inputs, outputs and relevant usage metadata, task content, comments, huddle transcripts, attachments, run artifacts and portable workspace configuration to which you have rights. They exclude authentication secrets, another customer's data and our protected internal software or trade secrets where exclusion is legally permitted and does not impede switching. The self-service NDJSON manifest lists its contents and exclusions; attachment and object-backed artifact records are not the corresponding file bytes. We provide assistance to obtain those files and any other exportable items missing from that snapshot in a structured, commonly used, machine-readable format. We cannot guarantee that a different SaaS product will reproduce Huddleboard's functionality.

After the transition ends, we allow at least 30 calendar days to retrieve the exportable data and assets. A short-lived download link or a prepared file's seven-day expiry does not shorten this retrieval period; we regenerate the download or provide a secure alternative. Tell us when the switch is completed. The affected service agreement ends when switching is successfully completed; after the agreed retrieval period we erase the transferred workspace's data under the retention schedule, subject to mandatory retention. You may instead request deletion without switching. A separate deletion request starts erasure, so ask for switching before deletion if you still need a migration copy. We explain completion, retrieval and erasure dates in writing. You and the destination provider must cooperate reasonably and supply the technical information needed without sharing unnecessary credentials.

Model withdrawal form

Complete and send this only if you wish to withdraw. To: Michał Piontek, Jemiołuszki 118, 05-500 Zgorzała, Poland; contact@huddleboard.ai. I/We hereby give notice that I/We withdraw from my/our contract for the Huddleboard service. Date of agreement: ____. Consumer name(s): ____. Consumer address: ____. Account email (optional, to identify the agreement): ____. Date: ____. Signature(s), only for a paper form: ____. Using this form is optional.

Mandatory digital-service remedies, including conformity and withdrawal remedies where applicable, and protections for qualifying sole traders remain available. The service is free, so there is no Huddleboard price to refund; separate provider charges remain governed by their agreements.