Privacy Policy.

Who operates Chessboard

Chessboard is operated by Bad Command AI dba Badkom. You can contact us at support@badkom.com with privacy questions or requests.

For workspace content, your organization may decide why and how personal information is used, and we process it to provide the service on its behalf. We also handle account, service administration and support information for our own operational responsibilities. The applicable roles and contractual arrangements depend on the use.

Information we handle

• Account information such as your verified email and workspace membership.
• Team and project work you choose to save, including briefs, tasks, comments, decisions, plans and sprint history.
• Plain-text notes you submit for document assistance and the resulting drafts or selected source excerpts.
• Private unfinished edits saved so you can resume work.
• Support conversations, privacy requests and limited records of service use, access and security events.
• Repository and linked issue, pull-request and check information when you enable GitHub.

Why we use it

We use information to provide the features you request, keep your workspace available, manage access, help with support, protect the service and meet applicable legal obligations. We do not sell customer project content or use it for advertising.

We do not use customer project content to train our own general-purpose models. Optional document assistance processes the notes you choose to submit for that feature. Ordinary manual boards, tasks and sprint management do not require document analysis.

Where data protection law requires a lawful basis, the relevant basis may be performing our service agreement, legitimate interests in operating and securing the service, complying with law, or consent for an optional activity where consent is required.

Who can see workspace information

Workspace and team permissions govern shared work. Private-team information is restricted to people with the necessary access. Private saved edits are associated with the signed-in account; a saved edit does not grant access to the underlying work.

Support conversations are available to their requester and authorized support staff. Internal support notes remain internal. Please avoid including secrets or unnecessary personal information in project notes, tasks or support messages.

Service providers and connections

Cloudflare provides hosting, security, storage and processing used to operate Chessboard. Customer information is sent to providers only as needed for the service features involved.

Typesafe can provide optional processing for supported assistance features. Its active use, covered data, processing locations and contractual arrangements need confirmation in the provider list before this draft becomes a final policy.

GitHub processes information under its own terms when you connect it. Chessboard's supported integration requests read access to metadata, issues, pull requests, checks and commit statuses. It does not request repository Contents or write permissions. Repository-related descriptions may still contain code or other sensitive text.

Providers may process information outside your country. Where applicable, appropriate contractual and transfer safeguards need to cover that processing. We do not promise that all information stays in a particular country.

Stripe processes billing contact details, payment information, invoices and subscription records when you use paid billing. Chessboard does not store full payment card numbers or send your project notes to Stripe. Billing records can have separate retention required for accounting and legal obligations.

How long information stays

Different records serve different purposes. Removing a source note does not automatically remove the reviewed work your team chose to keep.

Original project intake notes and associated temporary search/analysis data

Source access expires 30 days after upload. Review or processing does not restart that deadline. Cleanup is queued sooner when intake is finished or a source is removed.

Private unfinished edits

Expire for recovery 30 days after the last successful save. Discarding an edit or publishing the work attempts earlier removal.

Reviewed briefs, selected excerpts, tasks and sprint history

Remain available for customer use under the workspace's access rules. They are not covered by the original-note expiration. Removal and privacy requests require review of the relevant records.

Account, support, security and request records

Retained as needed to operate the service, handle the relevant matter and meet justified legal or security obligations. Specific schedules require final policy approval.

Expiration stops source access independently of physical cleanup. Cleanup is tracked and retried when needed. Backups, recovery copies and provider-controlled records can follow separate retention processes; we do not claim that every copy is physically erased at the moment a source expires.

A source's deletion does not erase selected facts or excerpts already included in approved work. Shared records may also contain information contributed by other people. Those records need their own review when a privacy request is fulfilled.

Some unfinished edits may have a device-local recovery copy. Clearing the corresponding server record cannot remotely clear an offline browser. You can discard local edits or clear the browser's site storage.

Your choices and privacy requests

You can ask us about access, correction, export, deletion or restriction of your personal information, and other rights that apply in your location. Contact support@badkom.com or use the app's privacy request process.

We may need to verify identity and authority, especially when the request involves shared workspace records. A support conversation does not itself authorize deletion. Privacy requests are reviewed by authorized staff, who approve and carry out the appropriate action.

We respond within the periods required by applicable law. Where an extension or an exception applies, we explain it. If you are not satisfied, you may also contact the relevant data protection authority.

Cookies, local storage and this website

This standalone website does not include advertising trackers or visitor analytics in its current build. Its search and screenshot controls work in your browser without submitting queries.

The signed-in app uses cookies and browser storage needed for authentication, preferences and recovery of unfinished work. The hosting service may receive ordinary request information, such as IP address and browser details, to deliver and secure the site.

Keeping information secure

We use access checks, customer separation and restricted staff tools to protect information. No online service can promise absolute security.

If access is withdrawn or a subscription ends, the permissions and retention rules still apply. Ending document assistance does not silently delete previously reviewed project work.

Changes to this policy

We update this policy when our service or data handling changes. Material changes should be communicated before new uses of customer information begin. Contact us if any part is unclear.