Privacy and Personal Data Processing Policy

The personal data operator is Akatov Alexey Nikolaevich, an individual; contact email: akatov.dev@gmail.com (the “Operator”, “we”).

For any questions about personal data, email akatov.dev@gmail.com.

• Service — the DenBoard web service for working together on tasks and documents, available at denboard.ru.
• User — a person who has signed up for or uses the Service.
• Space — a team's workspace in the Service with its projects, boards, tasks and pages.
• Personal data and processing of personal data — as defined in Law 152-FZ.

• Data you provide when signing up: your name and email address. Your password is stored only as an irreversible hash — we never know the password itself.
• Profile and membership data: which spaces, departments and projects you belong to, your roles and access rights.
• Content you add to the Service: tasks, comments, documentation pages, uploaded files and images.
• Activity in a space: who created, changed or deleted a task, board or page, or changed access, and when.
• Technical data: IP address, browser and device information, request date and time. It is recorded in server logs, used by the captcha check at sign-up and in the list of devices where your account is signed in (the approximate city is derived there from the IP address using a local database, without sharing the address with third parties).

Content you add may include other people's personal data (for example, vendor contacts in your docs). By adding it, you confirm you have a lawful basis to do so.

• Signing up, confirming your email address and signing in.
• Providing the Service's features: boards, tasks, docs, sharing, search, notifications.
• Service emails: confirmation codes and messages about how the Service works.
• Security: protection against automated sign-ups and unauthorized access, incident investigation.
• Answering user requests and complying with the law.

We do not sell personal data and do not send marketing emails.

We process personal data based on the consent you give when signing up (Art. 6(1)(1) of Law 152-FZ) and where processing is required by law.

Processing is automated: collection, recording, organization, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymization, blocking, deletion and destruction.

Databases containing personal data of Russian citizens are located in the Russian Federation. We do not transfer data across borders ourselves; the exception is transfer to an AI assistant you connect, described below.

Other members of a space can see your name, email address and your activity on shared boards and pages, within the access they have been given. This is how collaboration in the Service works.

We engage contractors for parts of the processing. They process data only on our instructions and must keep it confidential:

• Yandex.Cloud LLC — sending confirmation-code emails (Yandex Cloud Postbox) and the sign-up captcha check (Yandex SmartCaptcha);
• Selectel JSC — storing uploaded files and images;
• the provider of the servers that host the Service.

You can connect an AI assistant (such as Claude or ChatGPT) to your account. With your permission, the assistant then receives on your behalf what you can see in the Service: tasks, pages, comments, and members' names and email addresses. The transfer starts only after you allow access and stops when you disconnect the assistant in settings. The assistant and its owner are not our contractors: they process the data under their own terms, and their servers may be located outside the Russian Federation. The Service itself does not send data to AI providers.

Data is disclosed to other third parties only where expressly required by law.

The Service uses one cookie, to keep you signed in after you close the tab. You cannot sign in without it.

Browser storage (localStorage) keeps interface settings: theme, selected space, task view. This data never leaves your device.

We do not use web analytics or advertising trackers.

• Account data and your content — for as long as the account exists or until you withdraw consent.
• Sign-ups whose email address was never confirmed are deleted automatically after 7 days.
• After an account is deleted or consent is withdrawn, the data is destroyed within 30 days unless the law requires keeping it longer. It disappears from backups as they are routinely replaced.

• Connections to the Service are encrypted (HTTPS).
• Passwords are stored only as hashes; confirmation codes are single-use and expire.
• Access to tasks and pages is role-based: everyone sees only what they have been given access to.
• Access to servers and backups is limited to a small number of people.

You have the right to:

• find out which of your data we process and how;
• require us to correct, block or destroy data that is incomplete, outdated, inaccurate or processed unlawfully;
• withdraw your consent to personal data processing;
• appeal our actions to Roskomnadzor (the Russian data protection authority) or in court.

You can delete your account yourself under Settings → Security. To exercise your other rights, email akatov.dev@gmail.com from the address your account is registered with. We will reply within 10 business days.

We may update this policy. A new version takes effect when published on this page; the version date is shown at the top. We will notify users of material changes by email.