Privacy notice
Summary
- T19 runs Doodle board. We keep your data in the EU.
- For your account and billing details, T19 is the controller. For what is on your boards, we are your processor and you are the controller. The customer data processing agreement explains this.
- We name every service that handles your data in the list of sub-processors below. We do not sell personal data or use board content for advertising.
Who we are
Doodle board is run by T19. To ask about your personal data, email support@doodleboard.co.uk.
Your rights
You can ask us for a copy of your personal data. You can ask us to correct it, delete it or limit how we use it. You can also object to how we use it. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk. For board content, ask the account holder first: they decide what is done with it.
Personal data we hold
This table is written from our data inventory. Each row is one piece of personal data. It gives the reason we hold it, our lawful basis, how long we keep it and where it is stored.
| Data | Why we use it | Lawful basis | How long we keep it | Where it is stored |
|---|---|---|---|---|
| Account name | Names the account on screen (a person's name for a Solo account, the team's name for a Team account) so people know which account they are in. | Contract (providing the service the account holder signed up for) | Life of the account, then 30 days after it is closed or its subscription ends | Our database (Neon), Frankfurt, Germany (EU) |
| Company name | Puts the company name on invoices and screens for a Team account. | Contract | Life of the account, then 30 days after it is closed or its subscription ends | Our database (Neon), Frankfurt, Germany (EU); the same details are copied to our payment provider (Stripe) for invoices |
| Company name asked for in a Solo to Team upgrade | Holds the company name between the Upgrade to Team screen and the payment provider confirming the change. It is copied to accounts.company_name when the upgrade completes. | Contract | Removed as soon as the upgrade completes. If the upgrade never completes, it goes with the account, 30 days after it is closed or its subscription ends. | Our database (Neon), Frankfurt, Germany (EU) |
| Email address | Signs a person in, sends them password reset, invitation and account emails, and tells us who to contact about their account. | Contract | Life of the account, then 30 days after it is closed or its subscription ends. When an admin removes a person, their address is replaced straight away. | Our database (Neon), Frankfurt, Germany (EU) |
| Display name | Shows who owns a board and who is on the team. | Contract | Life of the account, then 30 days after it is closed or its subscription ends. When an admin removes a person, their name is replaced straight away. | Our database (Neon), Frankfurt, Germany (EU) |
| Password (stored scrambled) | Checks a person's password at sign-in. It is a salted Argon2id hash; the password itself is never stored. | Contract | Life of the account, then 30 days after it is closed or its subscription ends. Replaced when an admin removes the person. | Our database (Neon), Frankfurt, Germany (EU) |
| Two-step sign-in secret (stored encrypted) | Checks the authenticator code that admins and reviewers must give. It is stored encrypted, and the key is kept separately from the database. | Legitimate interests (protecting accounts that can change billing and users) | Life of the account, then 30 days after it is closed or its subscription ends. Cleared when an admin removes the person. | Our database (Neon), Frankfurt, Germany (EU) |
| Who a signed-in session belongs to | Keeps a person signed in. The row holds the user and a keyed hash of the session token, never the token. | Contract | Until the session ends. Deleted 1 day after it expires or after it has been idle for 24 hours. All a person's sessions go when they are removed, when they reset their password or when the account is closed. | Our database (Neon), Frankfurt, Germany (EU) |
| Who is signed in on the Doodle board phone or tablet app | Keeps a person signed in to the app. The row holds the user and keyed hashes of the access and refresh tokens, never the tokens. | Contract | Until the person signs out of the app. The refresh token lasts 30 days and is replaced each time it is used. Deleted 1 day after it expires. All a person's app sign-ins go when they are removed, reset their password, hand over the admin role or close the account. | Our database (Neon), Frankfurt, Germany (EU) |
| Who a password reset link was sent to | Lets a person set a new password from a link in an email. The row holds the user and a hash of the token. | Contract | Valid for 1 hour, then deleted 1 day after it is used or expires | Our database (Neon), Frankfurt, Germany (EU) |
| A new email address waiting to be confirmed | Lets a person change the email address they sign in with, by opening a link we send to the new address. The row holds the new address and a hash of the token. | Contract | Valid for 1 hour, then deleted 1 day after it is used or expires | Our database (Neon), Frankfurt, Germany (EU) |
| Sign-in and form attempt counts | Counts attempts (sign-in, reset, sign-up, invitations) to stop password guessing and spam. The key holds a keyed hash of an address or account, never the address itself. | Legitimate interests (security and preventing abuse) | Each count lasts for its window (at most 1 day) and is deleted 2 days after the window starts | Our database (Neon), Frankfurt, Germany (EU) |
| Who did something recorded in the security log | Shows who signed in, changed a role, removed a person, cancelled or closed an account, and when. Entries hold the user, the account or target ID, the action, the time and the request ID, never a password, token or board content. | Legitimate interests (security and accountability) | 90 days | Our database (Neon), Frankfurt, Germany (EU) |
| Board title | Names a board so its owner and team can find it. It is typed by the customer and may hold personal data. | Contract; for board content Doodle board acts as processor on the customer's instructions under the data processing agreement | Life of the board. Deleted 30 days after the board is deleted, or after the account is closed or its subscription ends. | Our database (Neon), Frankfurt, Germany (EU) |
| Board content | Holds what is on a board (notes, shapes, drawings) so it can be reopened and shared. It is the only copy of the board and may hold personal data. | Contract; for board content Doodle board acts as processor on the customer's instructions under the data processing agreement | Life of the board. Deleted 30 days after the board is deleted, or after the account is closed or its subscription ends. | Our database (Neon), Frankfurt, Germany (EU) |
| Saved versions of a board | Lets a paid member replay a board's history and put it back to an earlier point. A copy of the board's objects at each kept point, so it may hold the same personal data as the board. | Contract; for board content Doodle board acts as processor on the customer's instructions under the data processing agreement | 30 days at most, and the newest 50 versions of a board. Deleted with the board (database cascade) and by the retention job. | Our database (Neon), Frankfurt, Germany (EU) |
| Name of a file uploaded to a board | Shows the file's name on the board and in the download, and lets the board's files be purged with it. The file itself is stored private in Vercel Blob and served only through the board's access check. | Contract; for board content Doodle board acts as processor on the customer's instructions under the data processing agreement | Life of the board. Deleted 30 days after the board is deleted, or after the account is closed or its subscription ends. | Our database (Neon), Frankfurt, Germany (EU); the file bytes in Vercel Blob (EU region, set on the store) |
| Email address of someone invited | Sends an invitation to join a team and checks that the person who accepts is the person invited. | Contract | The link runs out after 7 days. The address is deleted 30 days after the invitation runs out, is cancelled or is accepted, whichever is first. | Our database (Neon), Frankfurt, Germany (EU) |
| Record of wrong board password attempts | Counts wrong board passwords from one visitor to lock out guessing. It is a keyed hash of the visitor's address. | Legitimate interests (security) | 1 day | Our database (Neon), Frankfurt, Germany (EU) |
| Record of a guest who opened a shared board | Counts people who open a shared board without a paid seat, once each, when the guest rule uses a seat or the account is on the Free plan. It is a keyed hash of a user ID or of the random ID in the browser's guest cookie (kept a year, so the same browser is the same guest); no name or email. A Free account's rows go when the owner makes a new link or starts paying. | Contract | Life of the account, then 30 days after it is closed or its subscription ends | Our database (Neon), Frankfurt, Germany (EU) |
| Who released a change to the website | Records which T19 person (a GitHub or Vercel username) deployed or rolled back a version, so a change can be explained and reversed. | Legitimate interests (accountability for changes to the service) | Kept while the service runs, as the audit trail for rollbacks. It holds T19 staff only, never a customer. | Our database (Neon), Frankfurt, Germany (EU) |
| Billing details held by our payment provider | The billing provider holds the paying customer's name, billing email, company name, address and VAT number, and their card (typed into the provider's own boxes; we never see it), to take payment and issue invoices with VAT. | Contract for the subscription; legal obligation for invoices and billing records | Invoices and billing records 6 years (HMRC). Nothing in this table is deleted when an account is closed, because the law requires the invoices; the subscription is cancelled at once. | Stripe, Ireland (EU) |
| Email address held by our email provider | Resend sends our emails (sign-up confirmation, invitation, password reset, role changes, account closed). It receives the recipient's address, the subject and the text. No board content is ever put in an email. | Contract | Resend keeps its delivery log for the shortest period its settings allow. We keep no copy of an email. | Resend, Ireland (EU) |
| Who has a board open, while it is open | The real-time collaboration service holds, only while a person has a board open, their user ID, the name shown to others on the board, the board ID and the changes being passed between people. It stores no saved board and no email address; Neon holds the only copy of a board. For 6 minutes after a person is disconnected or removed it also keeps their user ID and the time, so an old room token cannot bring them back. | Contract; Doodle board acts as processor on the customer's instructions under the data processing agreement | While the connection is open, and a person's user ID for 6 minutes after they are disconnected or removed. A room deletes everything it stored once nobody is connected and those 6 minutes have passed, and the list of which boards a person is on is forgotten when they leave, or within two hours if a connection is lost without closing. The connection is closed when a person is removed or the account is closed. Our Cloudflare request logs (Workers Logs) are off. | Cloudflare, EU jurisdiction |
| Note on a report about a board | Lets a reviewer understand what a reporter found worrying about a board, so they can decide whether to remove it. It is free text and may hold personal data. | Legitimate interests (keeping the service free of abuse and illegal content) | 12 months after the decision on the report; a report with no decision yet is kept 12 months from the day it was sent | Our database (Neon), Frankfurt, Germany (EU) |
| Email address of someone who reported a board | Lets a reviewer ask the reporter a question about their report. It is optional and used for nothing else. | Consent (the reporter chooses to give it) | 12 months after the decision on the report; a report with no decision yet is kept 12 months from the day it was sent | Our database (Neon), Frankfurt, Germany (EU) |
| Who decided on a report | Records which T19 reviewer decided to remove or restore a board, so a decision can be explained and checked. | Legitimate interests (accountability for takedown decisions) | 12 months after the decision, deleted with its report | Our database (Neon), Frankfurt, Germany (EU) |
| Security log entries about reports and decisions | Shows who opened a report or recorded a decision, and when. The entry holds the reviewer ID, the report ID, the action and the time, never the note or the email address. | Legitimate interests (security and accountability) | Same period as the report it is about (12 months after the decision), then deleted with the report | Our database (Neon), Frankfurt, Germany (EU) |
| Who gave a getting-started answer | Stores the answer to "How easy was it to get started?" against the person who gave it, so each person is asked once and the monthly report counts one answer for each person. | Legitimate interests (finding where sign-up can be simpler) | Life of the account, then 30 days after it is closed or its subscription ends, deleted with the account | Our database (Neon), Frankfurt, Germany (EU) |
| Getting-started answer | Shows whether getting started was easy. It is one of five answers, or 'skipped', and never free text. Accounts we mark as our own or as tests are left out of the report. | Legitimate interests (finding where sign-up can be simpler) | Life of the account, then 30 days after it is closed or its subscription ends, deleted with the account | Our database (Neon), Frankfurt, Germany (EU) |
| Who triggered a usage event | Records which person created the first board or added the first item, so each event is counted once for a real person. The event holds no name, email address, board title or board content. | Legitimate interests (seeing whether people get started) | Life of the account, then 30 days after it is closed or its subscription ends, deleted with the account | Our database (Neon), Frankfurt, Germany (EU) |
| Sign-up attempt ID on a usage event | Joins the Start free trial click, the card step and the sign-up that came from one visit, so the report counts a visit once. It is a random ID held in a cookie on our own domain, not a third-party tracker. | Legitimate interests (seeing where people stop in sign-up) | Life of the account, then 30 days after it is closed or its subscription ends. A click that never led to an account is kept 30 days. | Our database (Neon), Frankfurt, Germany (EU) |
| Sign-up attempt ID on an account | Links the account to the visit it came from, so the first board and first item events join the same sign-up journey. | Legitimate interests (seeing where people stop in sign-up) | Life of the account, then 30 days after it is closed or its subscription ends | Our database (Neon), Frankfurt, Germany (EU) |
| Where a sign-up came from | Records the website the person came from when they selected Start free trial (the host only, such as example.com, never the full address), or 'direct', so the monthly report can show paying users by channel. Left out of the report for our own and test accounts. | Legitimate interests (seeing which channels bring paying users) | Life of the account, then 30 days after it is closed or its subscription ends | Our database (Neon), Frankfurt, Germany (EU) |
| Campaign tag on a sign-up | Records the campaign tag (utm_campaign) on the link the person followed, up to 100 letters, digits, dots, hyphens and underscores, so the monthly report can show paying users by campaign. It holds no name or email address. | Legitimate interests (seeing which campaigns bring paying users) | Life of the account, then 30 days after it is closed or its subscription ends | Our database (Neon), Frankfurt, Germany (EU) |
| Campaign medium on a sign-up | Records the medium tag (utm_medium) on the link the person followed, such as email or social, up to 100 letters, digits, dots, hyphens and underscores. It holds no name or email address. | Legitimate interests (seeing which channels bring paying users) | Life of the account, then 30 days after it is closed or its subscription ends | Our database (Neon), Frankfurt, Germany (EU) |
| Monthly KPI report | Holds no personal data. We keep each month's report as counts, percentages and channel names, with no name, email address, account ID or full address of the website they came from, so Matt can compare months and the report email can be sent again if it failed. | Legitimate interests (running and improving the service) | 36 months after the report is made | Our database (Neon), Frankfurt, Germany (EU) |
| Browser and device counts | This holds no personal data, only aggregated counts. Each day we count page views by browser, operating system and kind of device (desktop, phone or tablet), with the version of each browser and system. We use the counts to decide which browsers and devices to support. We read the browser's description of itself once to make the count, then discard it. We do not store an IP address, user ID, session ID or email with the counts. We leave out our own and test accounts and automated visitors. | Legitimate interests (knowing which browsers and devices to support) | 13 months after the day counted | Our database (Neon), Frankfurt, Germany (EU) |
Sub-processors
These are the services that handle personal data for us. All of them hold or process it in the EU.
| Name | What it does for Doodle board | Data it handles | Region |
|---|---|---|---|
| Vercel | Hosts the Doodle board website and runs its server code. | Everything a person sends to the website while it is used. This is account details, board content in transit, and technical logs such as request IDs and addresses. | Frankfurt, Germany (EU)Server code runs in the Frankfurt region only. |
| Neon | Holds the Doodle board database. It is the only saved copy of every board. | Account and team details, sign-in records, board titles and board content, sharing settings, abuse reports and the security log. | Frankfurt, Germany (EU) |
| Resend | Sends our emails: sign-up, invitations, password resets and account changes. | The recipient’s email address, the subject and the text of each email. No board content is ever put in an email. | Ireland (EU) |
| Stripe | Takes payment for subscriptions, runs free trials and promotion codes, and issues invoices with VAT. | The paying customer’s name, billing email, company name, billing address, VAT number and card details. Card details go straight to Stripe; we never see or store them. | Ireland (EU)Stripe Payments Europe, Limited, in Ireland, is the Stripe company that serves customers in the UK and the EU. |
| Real-time collaboration service | Passes live changes and who is present between the people who have the same board open. | Only while a board is open: the person’s user ID and display name, the board ID and the changes passed between people. It stores no board content or email address. | EU (Cloudflare’s EU jurisdiction)Provided by Cloudflare. Every board’s room is held and run in Cloudflare’s EU jurisdiction; connections reach Cloudflare, encrypted, at its location nearest you. The saved board is always the copy in Neon. A room keeps nothing once the last person has left, except the user IDs of people it removed, for 6 minutes so they cannot rejoin. A record of which boards a person had open is deleted when they leave, or within two hours if the connection drops. |
How we protect it
Data is encrypted in transit and at rest. Boards are private to an account until you share them. Passwords are stored only as salted hashes. Administrators and reviewers sign in with a second step. Sign-ins and changes made by administrators are logged, and the log is kept for 90 days.
Cookies
We use only the cookies the service needs: one to keep you signed in, and one for each board you open with a link. We do not use advertising or tracking cookies.
Changes to this notice
If we make an important change to this notice, we will change the version number and date at the top. We will also email the account admin at least 30 days before it takes effect.