Privacy policy

Last updated: October 29, 2026

Leverboard analyses survey exports: it reads the comments, sorts them into themes and reports how strongly each theme goes with the score. This policy explains what data this website and the service behind it handle. It applies to users everywhere and takes the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) into account.

Who is responsible

This is the controller under the GDPR and the business under the CCPA for the data about you as a visitor or customer. For the responses in a survey export you upload, you (your company) are the controller and we process them on your behalf under the data processing agreement.

In short

• The file you upload is used only to make your report. We do not sell it, show it to anyone else or use it to train AI models.
• Files are deleted when you ask, and 90 days after upload at the latest.
• The website sets no cookies, stores nothing in your browser and loads no third-party scripts, fonts or images.
• You do not need an account. We do not sell personal information and do not show ads.

Reading your file in the browser

When you choose a CSV file on the upload page, your browser reads it to show how many responses and comments it has and which columns hold the score and the comment. That happens on your device. Nothing is sent until you press Send my export.

What we receive when you upload

• the file as you chose it, with every column in it;
• your email address, so we can send the report;
• the survey tool you picked, if any, and the counts of responses and comments your browser found;
• the campaign tags of the link you came from (utm parameters);
• a keyed hash of your IP address, to limit uploads to five an hour from one network. We do not store the IP address itself.

The file is stored at Cloudflare. A person at Leverboard opens it to check the columns and runs the analysis. For the analysis, the text of each comment is sent to Jev, a classification model of TypeSafe AI, Inc., which returns a probability per theme. TypeSafe processes this text in the United States on our behalf under its data processing agreement, keeps it only as long as needed to provide the service, and states that it does not use it to train or fine-tune models. Scores and other columns are not sent to TypeSafe. We send the report to your email address.

Please remove columns we do not need, such as names or email addresses of your customers, before uploading. If comments contain personal data, the data processing agreement covers it.

Payments

Plans are sold by Polar Software Inc. as merchant of record: Polar is the seller. Polar collects your payment details, name, email and billing address at checkout and handles payment, invoices, tax and refunds. For checkout and billing data Polar is an independent controller under its own privacy policy. We never see your card number. From Polar we receive your name, email address, the plan and order and subscription events. The checkout links carry campaign tags, which Polar stores with the order.

Usage statistics

This website sends these events to our own server: a page view (page path, the campaign tags of the link you came from, and the host name of the referring site), a click on a link to the upload page or to a checkout (the plan), opening a row of the sample report, and on the upload page: that a file was read (the counts of responses and comments and whether a score column was found), that an upload was sent, finished or failed, and the survey tool picked. They are sent without a cookie, storage or identifier, come from a fixed allowlist, contain no file content or email address, and are counted in aggregate. Raw events are deleted after 13 months.

This website

The website is hosted on Cloudflare Pages, which, like any host, processes your IP address and request details in technical server logs to deliver the site and protect it from attacks. If you email us, we use your message and address to reply.

Who receives data, and transfers abroad

• Cloudflare, Inc. (hosting, file storage, database), United States and worldwide: our service provider.
• TypeSafe AI, Inc., United States: our service provider for the classification of comment text.
• Polar Software Inc., United States: merchant of record and seller of plans, an independent controller for checkout and billing data (see “Payments”).

Where personal data of people in the EU, the UK or Switzerland is transferred to the United States, we rely on the providers' participation in the EU-US Data Privacy Framework or on standard contractual clauses. For TypeSafe AI, Inc. we rely on the standard contractual clauses in its data processing agreement.

Do you have to provide data?

No. You are not required by law or contract to provide any data. Without a file and an email address we cannot make a report.

Legal bases (GDPR)

• Making and sending your report, plans and payment: performance of a contract, Art. 6(1)(b) GDPR.
• Upload limits, security, server logs, usage statistics and answering your emails: our legitimate interest in running a secure, working product and knowing which pages are used, Art. 6(1)(f), and for emails about a contract also Art. 6(1)(b). Because the website stores nothing on and reads nothing from your device, no consent under section 25 TDDDG is required.
• Order records kept for tax and accounting: legal obligation, Art. 6(1)(c).

How long we keep data

Uploaded files are deleted when you ask, and 90 days after upload at the latest; the IP hash is deleted with them. The record of an upload (date, email address, file name, counts and whether the report was sent) is kept for 13 months, so we know whom we sent a report, then deleted. Raw usage events are deleted after 13 months. Emails are kept as long as needed to answer them. Data held by Polar follows Polar's own retention and legal retention periods.

Your rights under the GDPR

You can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format, and object to processing based on legitimate interests. To exercise a right, write to the address above. You also have the right to complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, Germany; you can also contact the authority where you live or work.

Your rights under the CCPA (California)

California residents can ask what personal information we collect, use and disclose, ask us to delete or correct it, and are protected from discrimination for using these rights. In the last 12 months we collected identifiers (email address, IP address stored only as a keyed hash), internet activity (pages viewed and the referring site on this website), commercial information (plan and orders) and the content of uploaded survey exports. We collected them from you and from Polar and disclosed them only to the service providers named above for business purposes. We do not sell or share personal information, so there is nothing to opt out of. To make a request, write to the address above; we respond within 45 days.

Children

Leverboard is a service for businesses and is not directed at children under 16.

Automated decisions

We do not take decisions based solely on automated processing that have legal or similarly significant effects on anyone. The model only assigns comments to themes for your report.

Changes

If we change this policy in a way that matters to you, we update the date above and tell customers by email.