Data processing agreement

Last updated: October 29, 2026

This agreement under Art. 28 GDPR applies when you upload a survey export to Leverboard and agree to it on the upload page. You (the customer) are the controller of the personal data in the export. Alexander Kagoshima, trading as Leverboard (address below), is the processor. It is part of the terms.

Subject, nature and purpose

Storage of survey exports and analysis of their comments to make reports on the themes in the comments and how they go with the score. The processing consists of storing the file, a person checking its columns, sending comment text to a classification model, and producing and emailing the report.

Duration

As long as we hold data from your exports. Files are deleted on your instruction, and 90 days after upload at the latest.

Types of data and data subjects

Whatever your export contains: typically scores, free-text comments, dates and survey metadata, sometimes names, email addresses or other identifiers of the people who answered your survey (your customers, users, patients or staff). Please remove columns we do not need before uploading. Do not upload special categories of data (Art. 9 GDPR) unless they are part of a comment and you have a legal basis for it.

Our obligations

• We process the data only on your documented instructions. These are the upload itself, these terms and anything you tell us in writing.
• Everyone who processes the data is bound to confidentiality.
• We protect the data with encryption in transit and at rest and with access limited to the person who makes the reports (Art. 32 GDPR).
• We help you answer requests from data subjects and meet your obligations under Art. 32 to 36 GDPR.
• We tell you without undue delay, and within 48 hours where possible, if we become aware of a personal data breach affecting your data.
• We delete the data at the end of the processing or on your instruction, and 90 days after upload at the latest, unless the law requires us to keep it.
• We give you the information needed to show compliance and allow audits on reasonable notice.

Subprocessors

• Cloudflare, Inc., United States (hosting, file storage, database). Transfers rely on the EU-US Data Privacy Framework and standard contractual clauses.
• TypeSafe AI, Inc., United States (classification of comment text with its Jev model). TypeSafe keeps the text only as long as needed to provide the service and does not use it to train or fine-tune models. Transfers rely on the standard contractual clauses in its data processing agreement.

You authorise these subprocessors. We inform you by email before adding or replacing one, and you may object; if we cannot address the objection, you may end the agreement and we delete your data.