Legal & transparency What we process, who sees it, and what the agents may decide How Huddleboard handles workspace data, AI providers, GitHub access and service usage. Effective 28 October 2026. The planned contact for privacy, support and accessibility is contact@huddleboard.ai. Pre-launch notice: contact@huddleboard.ai is not operational yet. Activating and testing this mailbox, with daily monitoring, is required before accepting real users. The contact details and service procedures below describe the planned launch. Version 2026-10-28 · Poland/EU-first launch · Adults (18+) · Individual and business use. Huddleboard is free; connected AI providers charge separately for usage. Cookie choices Withdrawing consent is one click, from any page. Legal notice operator identity · e-commerce & ePrivacy disclosure Operator Michał Piontek, operating Huddleboard Business address Jemiołuszki 118, 05-500 Zgorzała, Poland Tax identification (NIP) 9691453630 Business registration Registered in CEIDG, Poland’s Central Register and Information on Economic Activity Phone +48 669 967 597 (tel:+48669967597) Contact contact@huddleboard.ai (mailto:contact@huddleboard.ai) The EU online dispute resolution platform was discontinued in July 2025. You may seek help from a local consumer ombudsman or the Polish Trade Inspection. Information about out-of-court dispute resolution is available from UOKiK (https://polubowne.uokik.gov.pl/). Participation in a particular procedure depends on applicable law and the parties’ agreement; court remedies remain available. Privacy notice GDPR · effective 28 October 2026 Michał Piontek is the controller for account administration, service security and correspondence. For personal data a business places in its workspace and controls, Huddleboard acts on that business’s instructions where it is a processor. Before submitting business-controlled personal data, an authorized workspace owner must accept the data-processing agreement in Settings → Workspace. This notice does not itself conclude that agreement. Read the business DPA (https://huddleboard.ai/dpa); no separate signature or email exchange is required. Contact contact@huddleboard.ai for help. What we process, why, and on what basis Data | Purpose | Legal basis | Kept | Account & access | email sign-in, workspace membership and authentication | Contract (Art. 6(1)(b)); legitimate interests in secure workspace access (Art. 6(1)(f)) | Account data while your account is active; account closure is available in Settings → Account or on request. Login-code records are deleted 24 hours after expiry. | Terms acknowledgement | record the terms version you explicitly accepted after sign-in | Contract and legitimate interests in documenting the service agreement | Account lifetime; reviewed on account closure. Includes version, date, sign-in method and policy hash, not an additional IP address. Workspace deletion alone preserves it. | Workspace content & GitHub data | tickets, attachments, repository context, PR feedback and agent work | Contract for your own use; documented customer instructions where we act as processor | While the workspace is active; primary workspace data erased within 30 days of a verified deletion request. | Run traces & cost records | show agent actions, usage, reviews and errors | Contract; customer instructions for customer-controlled content | Workspace lifetime, then the workspace deletion schedule. | Huddle transcripts | conversation history and agent updates | Contract; customer instructions for customer-controlled conversations | Workspace lifetime, then the workspace deletion schedule. Inform participants before using voice transcription. | Security & server logs | prevent abuse, investigate incidents and secure the service | Legitimate interests in security (Art. 6(1)(f)) | At most 30 days; current AWS service logs use shorter 7–14 day periods. | Provider API credentials | authenticate workspace task and voice requests | Contract; customer instructions | Encrypted while configured, replaced or removed through settings, and erased with the workspace. Revoke the original key with its provider separately. | Support & rights requests | answer requests, resolve complaints and meet legal duties | Contract, legal obligations (Art. 6(1)(c)) and legitimate interests in handling claims | Until resolved, then only for applicable legal obligations or the limitation period of a relevant claim. We explain any exception to an erasure request. | Sources and workspace access We receive data from you, invited workspace members, connected GitHub repositories and reviews, and the AI services you use. If Google sign-in is enabled, Google supplies your verified email and profile as a separate identity service. Authorized workspace members can see content according to their role. Email and membership information are needed to provide access; AI features require a connected provider account. If you use voice in a huddle, OpenAI receives your microphone audio and Huddleboard stores the transcript. Do not submit sensitive personal data or other people’s information without authority and an appropriate legal basis. Retention and deletion Owners can request workspace deletion in Settings → Workspace after stopping active runs and voice sessions. The workspace closes to normal access immediately. Permanent cleanup starts after 24 hours and is due within 30 days of the verified request. This is not a self-service cancellation window. Cleanup covers workspace database records, stored credentials, attachments and their versions, run checkpoints and transcripts. Backup copies are scheduled to expire within 35 days after primary erasure, so backup deletion may take up to 65 days from the request. Restored backups must have recorded deletions reapplied before access resumes. We retain a minimal deletion ledger containing an opaque workspace or account identifier and cleanup status, without content or email addresses to prevent deleted data returning through a restore. Deleting a workspace does not delete a shared account used in other workspaces, published GitHub repositories or pull requests, or copies held independently by AI providers. Close your personal account in Settings → Account after resolving sole workspace ownership, or contact us for help. Identity deletion preserves shared content; request removal of personal information embedded in that content separately. If a legal obligation or a specific claim requires limited retention, we restrict it to that purpose and explain the applicable exception. A workspace owner’s export is not a substitute for your individual right of access. AI providers and voice Task context, selected source code and PR feedback may be sent through OpenRouter to the selected model provider. Voice in huddles is optional and uses the OpenAI API account connected by the workspace administrator. Microphone audio goes directly from the browser to OpenAI for speech processing. Huddleboard does not store audio files; it saves the transcript as workspace content. Before speaking, a user confirms they have informed anyone whose speech may be captured. The voice disclosure (https://huddleboard.ai/legal/voice) explains OpenAI processing, retention settings, charges and call termination. API keys are configured for a workspace and can fund requests by its authorized members; they are not isolated to the person who entered them. Bringing your own key does not mean data bypasses Huddleboard. We cannot promise that every provider has the same training or retention policy. Your provider agreement, privacy settings and selected route matter, including for free models. Review OpenRouter’s privacy policy (https://openrouter.ai/privacy) and the selected provider’s terms before sending confidential or personal data. Hosting and international transfers Production hosting is planned in AWS eu-central-1 (Frankfurt), with Cloudflare DNS and Amazon SES email. AWS is not activated for this local pre-launch verification. This does not establish EU-only processing: GitHub, OpenRouter, downstream model providers and, for voice, OpenAI may process data elsewhere. A provider key or acceptance of this notice is not, by itself, a safeguard for international transfers. Where required, transfers must be covered by an applicable adequacy decision or safeguards such as standard contractual clauses, together with any necessary supplementary measures. Contact us for information about the arrangements applicable to your workspace before submitting data that requires them. Privacy controls Voice uses OpenAI’s global API endpoint and does not promise EU-only processing or zero retention; the connected account’s settings apply. Current text-completion requests require no-collection and zero-retention routing filters. An unavailable compliant route causes failure rather than a less restrictive retry. These filters do not guarantee provider conduct, override account logging or eliminate operational metadata, transient processing or legal exceptions. The site has no product analytics or cross-site advertising tracking. Do Not Track does not change necessary authentication or preference storage, and an absent signal does not enable tracking. We will disclose changes and obtain consent where required. Mandatory rights remain available wherever applicable; this Poland/EU-first launch does not claim exemption from other countries’ laws. Your rights Access Rectification Erasure Restriction Portability Objection Withdraw consent Complain to a supervisory authority Michał Piontek handles privacy requests at contact@huddleboard.ai (mailto:contact@huddleboard.ai). We respond without undue delay, normally within one month. Where a lawful extension is needed, we explain it within that first month. We may request proportionate identity verification. You may complain to the President of the Personal Data Protection Office (UODO) in Poland or another competent supervisory authority. These rights apply subject to their legal conditions. Where processing relies on consent, you can withdraw it without affecting prior lawful processing. Privacy questions are handled directly by the operator at the address above. Service providers and connected services recipients depend on the features and providers you choose Vendor | What they do | Location | Scope | Amazon Web Services (planned) | hosting, database, storage, logs and SES email | Frankfurt planned; service-specific | Production launch requirement; not active in local verification | Cloudflare | DNS; additional services depend on deployment | Global DNS infrastructure | Domain resolution; this inventory does not claim a proxy is enabled | GitHub | repository access, branches, pull requests, reviews and comments | provider-dependent | Connected repository account; provider terms also apply | OpenRouter and selected model providers | task inference through the workspace’s key | provider-dependent | review provider agreements and settings | Google (when enabled) | optional sign-in; verified email and profile (openid, email, profile) | provider-dependent | Separate identity service; disabled unless configured | OpenAI (voice) | speech processing for optional huddle voice through the workspace’s OpenAI account | provider-dependent; global API endpoint | Only when a workspace connects an OpenAI key and members use voice; provider terms also apply | Cookies authentication and local preferences The reviewed website does not integrate a product-analytics tracker. The preference panel stores your choice locally; accepting analytics does not currently enable an analytics service. Authentication uses a refresh cookie on the app. We will update this inventory and request consent where required before introducing non-essential tracking. You can reopen preferences from the footer. Name | Purpose | Type | Life | ab_refresh (default name) | refreshes a signed-in session; HttpOnly cookie | necessary | 30 days by default; deployment configurable | agentboard.theme (local storage) | remembers your chosen app theme | user preference | until changed or browser storage is cleared | ab-sign-in-next (session storage) | return path after sign-in | requested navigation | removed when read, or when the tab session ends | taskboard:setup: / project-setup: (session storage) | workspace and repository setup progress | requested setup | until cleared by the relevant setup flow or the tab session ends | agentboard.pending-undo (session storage) | deleted issue identifier, key, title and undo context | requested undo | cleared by undo handling or when a stale entry is read; otherwise until the tab session ends. The 8-second UI offer is not a storage-expiry timer. | taskboard.consent (local storage) | remembers website cookie preferences; legacy internal name | preference storage | until browser storage is cleared; no timed expiry | AI transparency AI Act Art. 50 · GDPR Art. 22 Agents are software and are identified by role and model in the app. Generated titles, criteria and estimates can appear automatically while drafting. Story triage may propose subtasks or create them automatically depending on workspace settings. Successful code runs can publish branches and regular PRs, and addressing PR feedback can post replies. These actions use configured permissions; not every generated text waits for approval. You always know it's a machine In huddles an agent's update is marked as derived from its runs. Nothing an agent writes is presented as a colleague's words. A person decides Agents can publish branches and pull requests under the workspace’s permissions and repository policy. Merging remains a human decision. Budget guards limit new work; in-flight usage can exceed a cap. Do not use agent output as the sole basis for decisions with legal or similarly significant effects on people. The trace is the receipt Runs record available steps, model, usage, cost and artifacts to help explain how an output came about. Traces follow the workspace retention and deletion schedule above. We use general-purpose models through OpenRouter and do not build our own. Uses the AI Act prohibits are not permitted. The service is intended for project and software-development work, not for making decisions about employment, credit, education eligibility or other similarly significant matters about people. This use restriction is not a certification of any regulatory classification. Accessibility statement Accessibility and feedback The operator is a one-person microenterprise within the applicable EUR 2 million financial limit. The Polish Accessibility Act exempts services provided by microenterprises; this is not an exemption from every accessibility obligation. WCAG 2.2 AA remains our design goal, not a certification. We will reassess eligibility if the business changes. Known limitations Complex board interactions, live updates and generated content require further assistive-technology testing. This statement does not claim that every control meets a particular target size or contrast ratio. Feedback & enforcement Report accessibility issues to contact@huddleboard.ai (mailto:contact@huddleboard.ai). Include the affected page, the barrier and any assistive technology used. We review reports and discuss an accessible alternative where possible. Applicable statutory complaint and enforcement rights remain available; no certification of accessibility is claimed. Motion respects prefers-reduced-motion: the ambient glow, the travelling beams and the cursor halo all stop. Terms & consumer rights version 2026-10-28 · individual and business use Free app, provider usage Huddleboard has no subscription or seat fees. OpenRouter bills task usage to your connected account under its own pricing and tax terms. OpenAI bills optional voice to the workspace’s connected account; time allowances are estimates, not guaranteed caps. Consumer rights Where statutory withdrawal rights apply, consumers may withdraw from an online service agreement within 14 days of conclusion. Send an unambiguous statement to contact@huddleboard.ai identifying your account and agreement. No special form is required. Starting to use the app does not itself waive mandatory rights. Cancelling There is no paid Huddleboard plan to cancel. Owners can export workspace data in Settings → Workspace or through the API and request deletion in Settings → Workspace. The retention schedule above applies. Personal-account closure is available in Settings → Account. Data-rights requests and help remain available at contact@huddleboard.ai. Content and generated output You retain your rights in content you supply. Generated code may be inaccurate or subject to third-party or open-source rights. We do not claim ownership of your content. You grant only the permissions needed to operate the features you request, subject to connected-provider terms; review code before use. Agreement and eligibility These terms govern access to Huddleboard, provided by the operator identified above. You may use it as an individual or on behalf of a business you are authorized to represent. The launch is intended primarily for users in Poland and the European Union. You must be at least 18. This describes our launch focus, not a technical country restriction or a waiver of mandatory rights. The agreement begins when you verify your identity and explicitly accept these terms. It continues indefinitely, with no minimum commitment; you can end use at any time. For Polish consumers, the Polish version prevails in case of differences, without limiting mandatory rights; accepting the privacy notice is not consent to unrelated data processing. You can download and keep this dated document. The Polish version and a model withdrawal form are linked above. Access and acceptable use Huddleboard provides project boards, AI-assisted planning, agent runs, GitHub workflows and huddles with optional voice. An internet connection and a supported modern browser are required. Before using voice, inform everyone whose speech may be captured. You must have authority to connect a workspace, repository or provider account and to submit the content you provide. Keep credentials secure and do not use the service for unlawful content, infringement, unauthorized access or abuse of other users or providers. Customer-connected OpenRouter accounts OpenRouter remains on its global endpoint. Connecting a key authorizes Huddleboard to use it for this workspace; it does not accept a provider agreement on your behalf or prove transfer coverage. Use an account you are authorized to connect, with authority for workspace members to use it. Review and comply with OpenRouter’s terms, including the applicable Model Terms in section 5 (https://openrouter.ai/terms). Do not use a model whose terms you cannot accept. Mandatory consumer rights remain unchanged. Before sending personal data, establish the agreements and transfer safeguards for the actual parties and recipients. Customer instructions do not release Huddleboard from its own obligations. Do not send employment/HR records, financial or health information, identity documents or unrelated secrets to AI unless the required provider arrangements and safeguards have first been established. Remove unnecessary personal data from task and repository context. AI output and spending AI output can be incorrect or incomplete. Review generated code, dependencies, licences and test evidence before deployment. Starting a run authorizes use of the selected provider through your connected account. Estimates are not quotes, and budget guards cannot guarantee a final invoice because usage is reported after requests. Free-model availability can change. Huddleboard does not merge pull requests on your behalf. Your content You retain existing rights in content you supply. You authorize the processing, storage and transmission needed to provide the requested features, including to connected providers. This does not guarantee that generated output is exclusive, copyright-protected or free from third-party rights. Availability, changes and responsibility Availability depends on hosting, network and connected providers; there is no contractual uptime guarantee. We remain responsible as required by law for the service we supply. Nothing here excludes liability that cannot lawfully be excluded or limits mandatory consumer remedies for a service that does not conform to the agreement. Third-party provider agreements govern their own services and charges. We may update the service and these terms for security, legal requirements or changes to functionality. Material changes will be notified in the service or by email before they take effect where required. The notice will explain the change, effective date and any right to end use. Changes do not remove rights already accrued. Complaints and ending use Send service complaints or account-closure requests to contact@huddleboard.ai, identifying the affected account and describing the issue. Consumer complaints receive a response within 14 days. You can stop using Huddleboard at any time. Disconnecting Huddleboard does not cancel independent provider agreements or charges already incurred. We may restrict access when necessary to address unlawful use or an immediate security risk; any applicable consumer remedies remain available. Information on consumer rights is available from UOKiK (https://prawakonsumenta.uokik.gov.pl/prawo-odstapienia-od-umowy/). Information on privacy-request deadlines is available from UODO (https://www.uodo.gov.pl/pl/493/4098). Polish law governs the service. This choice does not remove mandatory consumer protections that apply in your country of habitual residence. Jurisdiction follows applicable law; these terms do not require consumers to use an exclusive Polish court. Switching and retrieval You may request transfer of your exportable workspace data and digital assets to another provider or your own infrastructure at contact@huddleboard.ai. We charge no switching, data-egress or early-termination fee and require no advance notice period. We verify your authority, agree a start date without undue delay and provide reasonable assistance, data security and continuity during the transition. The normal maximum transition is 30 calendar days. If this is technically impossible, we explain the reasons within 14 working days of the request and identify an alternative period, no longer than seven months. You may extend the transition once for a period appropriate to your needs. Mandatory shorter periods or stronger rights prevail. Exportable data include your inputs, outputs and relevant usage metadata, task content, comments, huddle transcripts, attachments, run artifacts and portable workspace configuration to which you have rights. They exclude authentication secrets, another customer's data and our protected internal software or trade secrets where exclusion is legally permitted and does not impede switching. The self-service NDJSON manifest lists its contents and exclusions; attachment and object-backed artifact records are not the corresponding file bytes. We provide assistance to obtain those files and any other exportable items missing from that snapshot in a structured, commonly used, machine-readable format. We cannot guarantee that a different SaaS product will reproduce Huddleboard's functionality. After the transition ends, we allow at least 30 calendar days to retrieve the exportable data and assets. A short-lived download link or a prepared file's seven-day expiry does not shorten this retrieval period; we regenerate the download or provide a secure alternative. Tell us when the switch is completed. The affected service agreement ends when switching is successfully completed; after the agreed retrieval period we erase the transferred workspace's data under the retention schedule, subject to mandatory retention. You may instead request deletion without switching. A separate deletion request starts erasure, so ask for switching before deletion if you still need a migration copy. We explain completion, retrieval and erasure dates in writing. You and the destination provider must cooperate reasonably and supply the technical information needed without sharing unnecessary credentials. Model withdrawal form Complete and send this only if you wish to withdraw. To: Michał Piontek, Jemiołuszki 118, 05-500 Zgorzała, Poland; contact@huddleboard.ai. I/We hereby give notice that I/We withdraw from my/our contract for the Huddleboard service. Date of agreement: ____. Consumer name(s): ____. Consumer address: ____. Account email (optional, to identify the agreement): ____. Date: ____. Signature(s), only for a paper form: ____. Using this form is optional. Mandatory digital-service remedies, including conformity and withdrawal remedies where applicable, and protections for qualifying sole traders remain available. The service is free, so there is no Huddleboard price to refund; separate provider charges remain governed by their agreements.