Privacy Policy - TLI S.A. / EasyBoard

1. Data Controller

Controller	TLI S.A.
Registered Address	55, allee de la poudrerie, L-1899 Roeser, Grand Duchy of Luxembourg
Trade Register	RCS Luxembourg B-XXXXXX
Data Protection Contact	privacy@easyboard.lu
General Contact	governance@easyboard.lu

TLI S.A. operates the EasyBoard platform (accessible at www.easyboard.lu) and is the data controller for the personal data processed through the platform's own operations. When processing personal data on behalf of subscribing organizations for the purpose of generating board meeting minutes, TLI S.A. acts as a data processor under a Data Processing Agreement.

2. Data We Collect

2.1 Account Data

When you create an account on EasyBoard, we collect:

Full name
Email address
Company name and affiliation
Role within the organization
Authentication credentials (securely hashed, never stored in plain text)

2.2 Audio Recordings

When you use EasyBoard to generate meeting minutes, you may upload audio recordings of board meetings. These recordings may contain:

Voices and spoken content of meeting participants
Names and personal information mentioned during discussions
Business decisions, opinions, and deliberations

Important: Audio recordings are automatically and permanently deleted immediately after transcription is completed. No audio data is retained on any EasyBoard system or sub-processor system after this point.

2.3 Generated Minutes

The platform generates and stores:

Text transcriptions of audio recordings
AI-generated draft minutes
User-edited and finalized minutes
Meeting metadata (date, participants, agenda items)

2.4 Usage Data

We automatically collect certain technical data when you use the platform:

Timestamps of actions performed
Features used and pages visited
Browser type and version
Device type

We do not use third-party analytics or advertising trackers. Usage data is collected solely for operational and security purposes.

2.5 Payment Data

For subscription billing, payment processing is handled entirely by Stripe. EasyBoard does not store, process, or have access to your full payment card details. We receive and store only:

Stripe customer identifier
Subscription plan and status
Billing history (amounts and dates)
Last four digits of the payment card (for display purposes only)

3. Purposes of Processing

Purpose	Data Used	Legal Basis
Provision of the EasyBoard service (transcription and minutes generation)	Audio recordings, transcriptions, meeting metadata	Performance of contract (Art. 6(1)(b))
Account management and authentication	Account data, authentication credentials	Performance of contract (Art. 6(1)(b))
Billing and payment processing	Payment data, subscription information	Performance of contract (Art. 6(1)(b))
Customer support	Account data, correspondence	Performance of contract (Art. 6(1)(b))
Service improvement and troubleshooting	Usage data, error logs (anonymized)	Legitimate interest (Art. 6(1)(f))
Security monitoring and fraud prevention	Usage data, authentication logs	Legitimate interest (Art. 6(1)(f))
Compliance with legal obligations	Account data, billing records	Legal obligation (Art. 6(1)(c))
Marketing communications (if opted in)	Email address, name	Consent (Art. 6(1)(a))

4. Data Retention

Data Category	Retention Period
Audio recordings	Deleted immediately after transcription (minutes)
Generated minutes and transcriptions	Retained for the duration of the subscription; deleted upon account termination per client policy or within 30 days of request
Account data	Duration of the contractual relationship plus 10 years (Luxembourg commercial law requirements)
Payment and billing records	10 years from the date of transaction (Luxembourg tax and commercial law)
Usage data	90 days
Security logs	12 months

5. Data Sharing and Sub-processors

We share personal data only with the sub-processors necessary for the provision of the EasyBoard service. We do not sell personal data or share it with third parties for marketing purposes.

A complete list of our sub-processors, including their purposes and safeguards, is maintained in a separate Sub-processors List document, available at easyboard.lu/documents/subprocessors.html.

All sub-processors are bound by Data Processing Agreements that impose data protection obligations no less protective than those applicable to TLI S.A.

6. International Data Transfers

EasyBoard's primary data storage and processing occurs within the European Union (Firebase europe-west1, Belgium). We prioritize EU-based service providers.

Limited data transfers outside the EU occur in the following cases:

Anthropic LLC (USA): Text transcriptions are transmitted to Anthropic's Claude API for minutes generation. This transfer is subject to a zero-retention policy: no data is stored, logged, or persisted by Anthropic. Data is processed in-memory only and discarded immediately after the API response is returned. A DPA with Standard Contractual Clauses is in place.
Resend Inc. (USA): Email addresses are transmitted for transactional email delivery only. No meeting content or minutes are shared. A DPA with Standard Contractual Clauses is in place.

No board meeting content, audio, or minutes are persistently stored outside the European Union.

7. Your Rights

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

Right of access (Article 15): You may request a copy of the personal data we hold about you.
Right to rectification (Article 16): You may request correction of inaccurate personal data.
Right to erasure (Article 17): You may request deletion of your personal data, subject to legal retention obligations.
Right to restriction (Article 18): You may request restriction of processing in certain circumstances.
Right to data portability (Article 20): You may request your data in a structured, commonly used, machine-readable format.
Right to object (Article 21): You may object to processing based on legitimate interests.
Right to withdraw consent (Article 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@easyboard.lu. We will respond to your request within 30 days.

8. Cookies

EasyBoard uses only essential cookies that are strictly necessary for the functioning of the platform:

Authentication cookies: Used to maintain your login session.
Security cookies: Used for CSRF protection and security purposes.

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies. No cookie consent banner is required as we use only strictly necessary cookies (Article 5(3) of the ePrivacy Directive).

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

AES-256 encryption for data at rest
TLS 1.3 encryption for data in transit
Role-based access control with per-company data isolation
Regular security reviews and monitoring

For a comprehensive description of our security measures, please refer to our Technical and Organizational Measures (TOMs) document.

10. Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

Authority	Commission Nationale pour la Protection des Donnees (CNPD)
Address	15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
Phone	(+352) 26 10 60 - 1
Website	www.cnpd.lu

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by email or through a notice on the platform prior to the change becoming effective.

The "Last Updated" date at the top of this document indicates when this policy was last revised.

12. Contact Us

For any questions or concerns about this Privacy Policy or our data processing practices:

Data Protection Contact: privacy@easyboard.lu

General Inquiries: governance@easyboard.lu

Postal Address: TLI S.A., 55 allee de la poudrerie, L-1899 Roeser, Luxembourg