GDPR compliance
Clear legal basis, listed subprocessors, published retention periods. Hosting in Switzerland, a country the EU recognises as providing adequate protection.
Our role#
For data you entrust to us (extracted from your Odoo), UpBoard acts as processor under GDPR Article 4. You remain controller for your customers', suppliers', and employees' data.
For data we collect directly about you (UpBoard account, billing, support), we are controller.
Legal basis#
Processing of your data by UpBoard relies on performance of the service contract (GDPR Article 6.1(b)).
Data processed#
To provide the service we access the following categories via your Odoo:
- Contract and financial data: quotes, invoices, payments, receivables
- Operational data: products, stock movements, point of sale orders
- Contact data: names, emails, phones of your customers, suppliers, and staff (limited to what recommendations require)
- Support data: tickets and their history, if you use the Helpdesk module
We do not copy your Odoo database: we only keep analysis results (alerts, scores) and your agents' contextual memory.
When a user gives an agent's answer a thumbs down, the question, the answer and their comment are accessible to the UpBoard team to improve the assistant; in the export, emails, phone numbers and IBANs are masked.
Subprocessors#
To provide the service UpBoard uses the subprocessors below. The reference list is in our privacy policy.
| Subprocessor | Role | Location |
|---|---|---|
| Infomaniak | Platform hosting | Switzerland (EU adequacy) |
| Anthropic | AI models (Claude) | United States, standard contractual clauses, no training on your data |
| OpenAI | Semantic indexing of agent memory (embeddings) | United States, standard contractual clauses, no training on your data |
| Stripe | Subscription billing and retention of billing data | United States, standard contractual clauses |
| Brevo | Transactional emails and free diagnostic follow-ups | France (EU) |
| Sentry | Application error monitoring | United States, standard contractual clauses |
| Google (Google Drive) | Off-site copy of backups, encrypted before upload | United States, standard contractual clauses, no access to the encryption key |
| Google Ireland (Google Tag Manager, Google Analytics) | Website audience measurement, only after your consent | Ireland, possible transfers to the United States, standard contractual clauses |
| Cloudflare (Turnstile) | Bot protection for the contact and partner forms | United States, standard contractual clauses |
Your rights#
You (or data subjects for whom you are controller) can exercise the following rights by writing to info@upboard.ai:
- Access to processed data
- Rectification of inaccurate data
- Erasure (except where law requires retention)
- Restriction of processing
- Portability: your data sent in a structured format, on request
- Objection to processing
For your customers or suppliers exercising their rights, contact us and we coordinate with you on the request.
Data retention#
| Data type | Duration |
|---|---|
| Free diagnostic that stayed anonymous (no contact details left) | Deleted 30 days after the diagnostic |
| Free diagnostic with contact details, no account created | Deleted 12 months after the diagnostic, or 30 days after unsubscribing from the follow-ups if that comes first |
| Diagnostic from which an account was created | Attached to the account and deleted with it |
| Active account | Kept while the subscription or trial is running, within the limits below |
| Conversations with the agents | Deleted after 12 months without activity, unless one of their documents is saved in "My Documents" |
| Agent memory | Conversation summaries deleted after 12 months; items automatically extracted from your conversations deleted after 24 months without an update; what you entered yourself (including your answers to the agents' questions) stays while the account exists, and you can delete it at any time |
| Content of the AI exchanges and of the reads in your ERP (messages sent, answers, data read, error messages) | Erased after 90 days; only technical metadata remains (date, duration, model or tool, tokens, cost) |
| Conversations with the help assistant | Deleted after 12 months without activity |
| Generated reports | Deleted 12 months after they were generated |
| Excel exports | Never stored: generated on demand |
| Charts in emails | Deleted 60 days after sending |
| Account whose subscription ended, or whose trial expired without subscribing | All account data (users, ERP connections, conversations, analysis results, agent memory) deleted 90 days after the end of the subscription or trial, unless you subscribe again in the meantime |
| Sign-up never completed (no trial started, no subscription) | Deleted 90 days after it was created |
| Billing data | Kept by Stripe for the period required by law, not by UpBoard |
Deleted data then disappears from the encrypted backups as they rotate.
Data Processing Agreement (DPA)#
Our data processing agreement, compliant with GDPR Article 28, is published and binding with no prior request. It covers:
- Scope and nature of processing
- List of onward subprocessors
- Technical and organisational security measures
- Incident notification procedure
- Audit conditions
- Data return and destruction modalities
Contact#
For any GDPR question: info@upboard.ai
UpBoard.ai is published by Organize IT SRL, a Belgian company (company number / VAT BE 0650.555.046), Rue du Mont-Lassy 54, 1380 Lasne, Belgium.
Read next
See UpBoard working on your Odoo data
A few minutes, read-only, no card. Then a trial on your real data: 14 days, or until the trial credit is used up.
Rather talk it through? Book a demo