DevvyBoard Privacy Policy

DevvyBoard is a product of Stockulate LTD, a company registered in England and Wales. Stockulate LTD ("we", "us", or "our") provides collaborative workspace software for teams, including mobile applications and the website at devvyboard.app. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the choices you have.

Stockulate LTD is the data controller for personal data processed through the Service, except where we process data solely on behalf of your organization as a processor—in that case, your organization controls how workspace content is used.

Contact: business@stockulate.com Privacy policy URL: https://devvyboard.app/privacy

This policy applies to:

• DevvyBoard mobile apps for iOS and Android • The DevvyBoard website at https://devvyboard.app, including home, login, join, invite, authentication callback, and legal pages • Deep links and app links that connect the website and mobile apps (for example, https://devvyboard.app/invite and devvyboard:// links)

It does not apply to third-party websites, app stores, or services that we do not operate, even if linked from DevvyBoard. Those services have their own privacy policies.

We collect information in the following categories:

Account and authentication data: When you sign in, we collect your email address and authentication identifiers from Supabase Auth. If you use Google sign-in, Google shares basic profile information (such as your email address, name, and profile picture URL) with us through the OAuth flow. We do not receive your Google password.

Profile data: You may provide a display name and avatar URL stored in your profile. Other project members may see this information within shared workspaces.

Workspace and collaboration content: To provide the Service, we store content you and your teammates create, including organization and project names; board, column, and card data; ideas; comments; chat messages (project rooms and direct messages); file attachments and chat images; assignee and creator references; and membership and role information.

Invite and access metadata: We store invite codes, invite creation and expiry times, and records of project membership. Our public invite validation endpoint returns only whether a code is valid, a project name, and expiry—never private board data or member lists.

Billing and subscription data: On mobile, in-app purchases are processed by Apple or Google. RevenueCat receives purchase and entitlement information linked to your Supabase user ID. Our backend may store subscription status, plan tier, RevenueCat customer identifiers, seat counts, and expiration timestamps to enforce plan limits.

Technical and usage data: We receive standard technical information necessary to operate the Service, such as IP addresses, device and browser type, timestamps, and error logs from our infrastructure providers. We do not use third-party advertising analytics or cross-app tracking in the DevvyBoard apps or website as of the date of this policy.

Cookies and local storage (website): When you sign in on the web, Supabase Auth sets essential session cookies so you remain authenticated and can complete invite joins. These cookies are required for web sign-in and are not used for advertising.

We use personal data to:

• Create and manage your account and authenticate you on mobile and web • Provide, operate, and maintain boards, ideas, comments, attachments, chat, and realtime sync • Enable team invites, membership, and role-based access controls • Enforce free and paid plan limits, including project counts, member limits, and storage quotas • Process and sync subscription status for DevvyBoard Pro • Respond to support requests and protect the security and integrity of the Service • Comply with legal obligations and enforce our Terms of Service

We do not sell your personal data. We do not use your workspace content to train public AI models.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data on the following legal bases:

• Contract: To provide the Service you request, including account access, collaboration features, and subscription features you purchase • Legitimate interests: To secure the Service, prevent abuse, improve reliability, and communicate about important service changes, balanced against your rights • Consent: Where required, such as for optional communications or non-essential cookies if we introduce them in the future • Legal obligation: Where we must retain or disclose data to comply with law

You may withdraw consent where processing is consent-based without affecting the lawfulness of prior processing.

We share personal data only as described below:

With your teammates: Other members of projects you join can see your profile information and content you submit within those projects, according to product permissions.

Service providers (processors): We use trusted providers to host and operate the Service. They process data on our instructions and under appropriate safeguards. See Section 7.

App stores and billing partners: Apple, Google, and RevenueCat process payment and subscription data under their own policies when you make in-app purchases.

Legal and safety: We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Stockulate LTD, our users, or the public.

Business transfers: If we are involved in a merger, acquisition, or asset sale, personal data may be transferred subject to continued protection consistent with this policy.

We do not share workspace content with advertisers.

Key providers that process personal data on our behalf include:

• Supabase — authentication, PostgreSQL database, file storage (attachments bucket), realtime subscriptions, and edge functions (including subscription webhook handling). Data is processed according to Supabase's terms and privacy policy. • Vercel — hosting and delivery of the devvyboard.app website. • Google — OAuth sign-in when you choose "Continue with Google". • Apple App Store and Google Play Store — app distribution and in-app purchase processing. • RevenueCat — mobile subscription management, entitlement checks, paywall presentation, and Customer Center.

Each provider may process data in countries other than your own. We select providers that offer appropriate contractual and technical protections. Links to provider policies are available on their respective websites.

Stockulate LTD may process and store data in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

Where required, we rely on appropriate safeguards such as Standard Contractual Clauses, provider certifications, or other lawful transfer mechanisms. You may contact business@stockulate.com for more information about transfers relevant to your region.

We retain personal data for as long as necessary to provide the Service and fulfill the purposes described in this policy.

Account and profile data are retained while your account is active. Workspace content is retained until deleted by you or your project owner, or until the project or organization is deleted. Project deletion by an owner permanently removes associated boards, ideas, comments, attachments, chat, and invite data from our primary systems.

Subscription records may be retained for billing, tax, and fraud-prevention purposes after cancellation. Backup copies may persist for a limited period before being overwritten.

We may retain information longer where required by law, to resolve disputes, or to enforce our agreements.

We implement technical and organizational measures designed to protect personal data, including access controls, row-level security in our database, authenticated storage policies for attachments, and encrypted transport (HTTPS/TLS).

No method of transmission or storage is completely secure. You are responsible for safeguarding your email account and device used to access DevvyBoard. Report suspected security issues to business@stockulate.com.

Depending on where you live, you may have rights to:

• Access a copy of personal data we hold about you • Correct inaccurate data • Delete your data, subject to legal exceptions • Restrict or object to certain processing • Data portability, where applicable • Withdraw consent where processing is based on consent • Lodge a complaint with your local data protection authority

To exercise these rights, email business@stockulate.com. We may need to verify your identity. Project owners can delete projects from within the app; account-level deletion requests are handled by our support team.

If you are a teammate in someone else's project, some data may remain visible to that project until the owner deletes it or removes you.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, may provide additional rights, including the right to know categories of personal information collected, the right to delete personal information, and the right to correct inaccurate personal information.

We do not sell or share personal information for cross-context behavioral advertising as defined under California law. We do not use sensitive personal information for purposes other than providing the Service.

Categories collected in the preceding 12 months may include identifiers (email, user ID), commercial information (subscription status), internet or network activity (logs from infrastructure providers), and user-generated content you submit in workspaces.

Submit requests to business@stockulate.com. We will not discriminate against you for exercising privacy rights.

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us personal data, contact business@stockulate.com and we will take steps to delete it.

Users aged 13–17 should use the Service with parental or guardian consent where required by local law.

The DevvyBoard website uses essential cookies and similar technologies to maintain your authenticated session after sign-in (via Supabase SSR). These are strictly necessary for login, invite join flows, and security.

We do not set advertising cookies or use third-party analytics trackers on the website as of the date of this policy. If we introduce optional analytics or non-essential cookies in the future, we will update this policy and, where required, request consent before use.

You can control cookies through your browser settings. Blocking essential cookies may prevent web sign-in from working.

Board, comment, and chat updates may be delivered in realtime through Supabase Realtime channels scoped to projects and conversations you can access. Realtime delivery uses your authenticated session and the same access rules as standard API requests.

Our infrastructure providers may generate server logs (including IP addresses and request metadata) for security, debugging, and reliability. We retain logs only as long as needed for those purposes.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy at https://devvyboard.app/privacy and update the "Last updated" date. Where appropriate, we may notify you in the app or by email.

Your continued use of the Service after the effective date of an updated policy constitutes acknowledgment of the changes.

Privacy questions, data subject requests, or security reports:

Stockulate LTD (DevvyBoard) Email: business@stockulate.com Website: https://devvyboard.app Registered in: England and Wales

For app store or subscription privacy questions related to payments, also review Apple and Google privacy policies and your store account settings.