Privacy Policy
1. Controller
Voice-Board.com by Ing. Bernhard Wurm MA BSc BEd
Stifterstr. 4A
4160 Aigen-Schlägl
Austria
Email:
2. Two roles: website and platform
For the public website and for your own account we are the controller within the meaning of the GDPR.
As soon as you use Voice-Board as a workspace, the organisation operating that workspace decides on the purposes and means of the content processed there. For that content we are a processor under Article 28 GDPR and the organisation is the controller. If you are a member of someone else's workspace, please direct access and erasure requests concerning that content to that organisation; we support them in handling it.
3. What we process
3.1 Account
Email address, username, display name, optionally a profile picture and phone number, when the account was created and last changed, language, and whether the email address and two-factor sign-in are confirmed.
Sign-in methods: password (stored as a hash, never in clear text), passkey (WebAuthn — we hold the public key and a signature counter; the private key never leaves your device), or sign-in via Google, Microsoft or GitHub. In the latter case we receive your email address, your name and possibly your profile picture from them.
3.2 Content you create
Proposals, comments, votes, tasks and project data, time entries, uploaded files and documents, board and workspace settings, invitations you send, and your notification preferences.
3.3 Activity log
Who changed what and when, so that members of a workspace can follow what happened. The log holds your user ID, the time and the type of change.
3.4 Billing
On paid plans: invoice recipient, billing address, country, VAT identification number where applicable, plan, term, invoice amounts and payment status. We never see card details — payment runs exclusively through Stripe (see section 6).
3.5 Technical data
Requests to our servers produce log data: IP address, time, requested address, status code and browser identification. It serves operations and the prevention of abuse. We also measure the data volume transferred per workspace in order to bill the agreed scope.
4. Legal bases and retention
| Processing | Legal basis | Retention |
|---|---|---|
| Account and provision of the platform | Art. 6(1)(b) GDPR (contract) | until the account is erased |
| Content in a workspace | Art. 6(1)(b) GDPR, on behalf of the organisation (Art. 28) | on the organisation's instructions |
| Invoices and accounting records | Art. 6(1)(c) GDPR in conjunction with § 132 BAO | 7 years — also after the account is erased |
| Server and security logs | Art. 6(1)(f) GDPR (operational security) | 14 days |
| Email and push notifications | Art. 6(1)(b) GDPR; switchable off in your profile at any time | until you opt out |
| Sign-in via Google, Microsoft, GitHub | Art. 6(1)(b) GDPR (sign-in method you chose) | until you disconnect the link |
5. Cookies and similar technologies
We use strictly necessary cookies only: the cookie that keeps you signed in, and a session identifier during sign-in through an external provider. There is no tracking, no analytics and no advertising.
That is why we do not ask for consent: strictly necessary cookies are exempt under § 165(3) TKG 2021. The public website embeds no external fonts, maps or videos — loading it transfers no data to third parties.
6. Recipients and processors
We pass data on only as far as operating the service requires. Data processing agreements under Article 28 GDPR are in place with every provider.
| Service | Purpose | Data | Location |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | payment processing on paid plans | name, email, billing address, amount; card details only at Stripe | Ireland, with transfer to Stripe, Inc. (USA) |
| Eigener Server des Verantwortlichen | running the application and database | all data listed in section 3 | European Union |
| Eigener Server des Verantwortlichen | storing files, documents and profile pictures | uploaded content | European Union |
| Eigener Mailserver des Verantwortlichen | sending notifications, invitations and invoices | email address, name, message content | European Union |
| Google Ireland Ltd. / Microsoft Ireland / GitHub | only if you sign in there | the sign-in exchange; we receive email, name, possibly picture | EU/USA |
| Browser vendors' push services | only if you enable push notifications | encrypted notification, device endpoint | worldwide |
6.1 AI features
If your workspace uses AI features, the content needed for them — the text of a proposal, for instance — is transmitted to the configured AI provider. No AI provider is currently configured, so no such transfer takes place.
6.2 Integrations
If your organisation connects the workspace to Slack or Microsoft Teams, notifications are transmitted there. The organisation sets up that connection and is responsible for it.
7. Your rights
You have the right at any time to
- access (Art. 15) and data portability (Art. 20) — in your profile under "Privacy" you can request a complete export of your data as a machine-readable file yourself;
- rectification (Art. 16) — you can change your account details in your profile;
- erasure (Art. 17) — also in your profile under "Privacy", see section 8;
- restriction (Art. 18) and objection (Art. 21);
- complain to a supervisory authority. In Austria: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
8. What erasure actually does
So that you know what to expect — erasure here means:
- Your account is anonymised: email, name, profile picture, phone number and password are removed, third-party sign-ins disconnected.
- Your comments remain as a "[deleted]" placeholder so that other people's discussions do not fall apart.
- Votes, subscriptions, notification preferences and push registrations are deleted, memberships ended.
- Invoices are kept — we are required by law to do so (Art. 17(3)(b) GDPR, § 132 BAO).
If you are the only administrator of a workspace, you have to hand it over or delete it first — otherwise it would be left with nobody able to manage it. The application tells you this before erasing.
9. Minors
Voice-Board is aimed at businesses and organisations. Entering into a contract independently is possible from the age of 18.
Use in schools: where Voice-Board is used by an educational institution, that institution is the controller for its pupils' data. It decides on the legal basis and obtains parental consent where required (Art. 8 GDPR; in Austria, consent may be given independently from the age of 14, § 4(4) DSG). We process such data solely as a processor; the details are in the data processing agreement for schools.
10. Security
All transmission is encrypted (TLS). Passwords are stored hashed, credentials for integrations are stored encrypted. The data of individual workspaces is kept separate; every query is scoped to its workspace.
11. Changes
We update this policy when the processing changes. The version published here is the one that applies.
Last updated: 09/2026