Privacy policy

BoardSites helps Massachusetts public retirement boards run their public website and day-to-day office work. This page explains what information we handle, who else sees it, and how to ask us about it. We’ve kept it short and in plain language on purpose.

What we collect

• Account information for board administrators and staff who sign in: name, email, and the authentication record kept by our identity provider (Clerk).
• Content you publish: the pages, posts, documents, meeting agendas, and board-member listings your office creates inside BoardSites. This material is meant to be public; we treat it as such.
• Operational signals: anonymized error reports (Sentry) and uptime checks (BetterStack). These let us notice when something has broken before you have to tell us.
• Billing information when you subscribe: handled by Stripe. We never see or store credit-card numbers ourselves — Stripe holds those.

What we don’t collect

We don’t collect personal information about your members, retirees, or beneficiaries. That data belongs to your board and stays in your existing systems (PERAC, custodian, member portal, etc.). BoardSites is a public-facing website and an office productivity tool — not a record-of-membership system.

Who we share it with

We rely on a small set of subprocessors to run the service. Each sees only the data needed for its role:

• DigitalOcean — hosts our servers and stores your documents.
• Clerk — manages sign-in and account credentials.
• Resend — sends transactional email on our behalf (password reset notes, board-contact form forwards).
• Sentry — captures error reports.
• BetterStack — runs uptime monitors and our public status page.
• Stripe — processes subscription payments.

We don’t sell or rent any information to anyone. We don’t run third-party ad networks on your board’s website.

Where it lives

BoardSites runs on US-region infrastructure. The application server, the database, and the document storage bucket are all in the continental United States. Our subprocessors operate from US or EU/US-aligned regions as listed in their own public documentation.

How long we keep it

We keep your account and content for as long as your subscription is active. Database backups roll on a documented schedule: daily snapshots for three weeks, monthly snapshots for fourteen months, and yearly snapshots for seven years (which matches Massachusetts General Laws c. 66 record retention). When you cancel, you have thirty days to export your content; after that we delete it.

How to reach us

Email ken@boardsites.app with privacy questions, data-access requests, or anything else related to this policy. We read every message and reply within one business day.

We’ll update this page if the way we handle information changes. The “last updated” date at the top is the source of truth for the current version.