Legal
Privacy policy
What we collect from boards, owners and visitors, why, where it lives, how long we keep it, and how to make us do something about it.
Who is accountable for what
For an owner's personal information held in a corporation's records, the corporation is the organisation accountable for it and Board Butler processes it on the corporation's instructions. The board decides what is collected and who may see it; we provide the system and follow those instructions.
For people who visit this website, ask for a demo, or hold a Board Butler account, we are accountable ourselves.
What we collect
From a board member or a staff user: name, email, phone, the role they hold, sign-in and device records, and everything they enter into the product on the corporation's behalf.
From an owner or occupant: name, unit, contact details, balances and payment records, requests they make, and documents addressed to them. This comes from the corporation, not from us.
From a vendor: business contact details, insurance certificates, bids, invoices, and banking details for payment.
From a website visitor: pages viewed, the campaign that brought you, and anything you type into a form. Analytics that is not necessary to make the site work runs only after you agree.
Why we collect it
To run the features the corporation subscribed to: keeping the books, sending statutory notices, taking payments, tracking obligations, and producing the records a statute requires.
To keep the service secure and to detect fraud against the corporation's money.
To answer you when you contact us, and to send marketing email to people who asked for it.
Consent and legal basis
Processing on behalf of a corporation runs on the contract between us and that corporation and on the corporation's own authority over its records.
Marketing email goes only to people who gave express consent, and every message carries an unsubscribe that works. Withdrawing consent stops marketing email and does not affect the service.
Cookies and analytics that are not strictly necessary run only after you accept them in the banner, and declining is one click of the same weight as accepting.
Where the data lives
A Canadian corporation's records are held in a Canadian database region and in a Montreal object storage bucket. A United States region is created with our first United States tenant and no data is placed there before it exists.
Two categories are stated as exceptions rather than hidden: identity records held by our authentication provider are global, and meeting transcription and document drafting are processed by model providers outside your country. Our promise is that your corporation's records and financial data are stored in your country. It is not that no byte ever leaves it, and we will not pretend otherwise.
How long we keep it
Service data is kept for the life of the subscription. After it ends, the corporation's export is produced and the data is deleted on the schedule in our terms.
Records covered by a statutory or governing document retention rule are kept for that period, because deleting them earlier would put the corporation in breach. Where a legal hold is in place, disposition stops until the hold is lifted.
Audit chain entries are retained per the corporation's retention rules and are not deletable individually, because a chain with a hole in it proves nothing.
Marketing data is kept until consent is withdrawn or the contact asks us to delete it.
Your rights, and how to use them
You can ask for access to your personal information, correction of it, deletion, a portable copy, or that we stop a particular processing. We answer these for our own account holders and website contacts directly, and we route an owner's request to the corporation accountable for it while helping the corporation answer.
Write to privacy@boardbutler.com, or use the request form in the product. We will tell you what we are doing and, where we refuse something, why.
If you are not satisfied you can complain to the Office of the Privacy Commissioner of Canada, or to the state authority that applies where you live.
Cookies and analytics
Necessary cookies keep you signed in and keep the site working. Analytics runs through our own self-hosted product analytics and, for advertising measurement, a general analytics tag; both run only after you accept them.
Marketing contact records are held in our customer relationship system. Declining analytics does not stop you from using anything on this site.
Children, and changes to this policy
Board Butler is not directed at children and we do not knowingly collect their personal information.
When this policy changes we update it here and, where the change is material to a customer, we tell the customer by email. This page has been drafted and has not yet been reviewed by external counsel, and we say so rather than showing a review date that does not exist.
Where your data actually lives
The subprocessor list names every vendor and its region, including the two categories that are processed outside your country.