Privacy
Effective 1 October 2026
Storeboard is software a shop uses to run its day: the task list on the screen by the till, the rota, the clock, the timesheets, the team's messages and the orders. This page says what it holds, why, for how long, and how to have it removed. It is written to be read, not skimmed.
Who this is between
A store owner signs up and pays for a workspace. The owner adds employees, who may be given their own login. The owner is the controller of the store's records; Storeboard processes them on the owner's behalf. If you are an employee with a question about how your store uses your details, ask your store first; if you cannot, write to us at the address below.
What is held, and why
| Who | What | Why |
|---|---|---|
| Owner | Name, email address, the store's name, address (subdomain) and time zone, password (as a salted hash — never the password itself) | To run the workspace and sign you in |
| Owner | Payment details | Held by Stripe, not by us. We keep Stripe's customer and subscription identifiers and the invoices they send back |
| Employee | Name, role, colour on the rota, and — only if given — email address, phone number, a picture | So the rota, the timesheet and a published week can name and reach you |
| Employee | A clock-in PIN (four to six digits) | To identify you at the shared screen. It is not a password and is held as typed |
| Employee | Shifts, clock-in and clock-out times, breaks, time off asked for and answered, when you say you can work | The rota and the payroll record — the reason the software exists |
| Employee | Tasks ticked, notes posted to the team board, messages sent to another person | The board and messages. A direct message is readable only by the two people in it — not by a manager, not by the owner, and it is not written to the activity log |
| Store | Photographs and notes of people the store has barred from the premises | Kept by the store, for the store's staff, behind the store's login. We do not read or use them |
| Store | Customers' names and phone numbers on online and bulk orders | Entered by the store to fulfil its own orders; shown only to that store's signed-in staff |
| Everyone | An activity log: who changed what, when | So a timesheet can be trusted and a mistake can be found |
| Everyone | A session cookie (sb.sid), and a cookie remembering which store you last opened | To keep you signed in. Nothing in them identifies you to anyone else; there are no advertising cookies and no third-party trackers |
The phone assistant
If a store turns on the phone assistant, the words an owner or manager speaks to it are sent as text to Anthropic, whose model decides which of a fixed list of actions to take (add a task, note a delivery, and so on). The text of the command and the model's reply are kept for thirty minutes so a follow-up makes sense, then discarded. We keep a count of commands and tokens per store, not their content.
Who else sees it
- Railway hosts the servers and the disk the databases are on (United States).
- Stripe takes payment. We never see a card number.
- Resend sends the emails we send: a welcome, a password reset, a published week to the person it is about, a new-order alert.
- Anthropic, only for the phone assistant, only the text of a command.
Nobody else. We do not sell, rent or share anything with advertisers, and we do not use your store's records to train anything.
How long
- A store's records are kept while the workspace exists.
- A workspace that signed up and never paid is removed after 30 days.
- Copies of every database are taken daily and kept for 14 days, so a mistake can be undone; a removal therefore disappears from the copies within 14 days.
- Session cookies last 12 hours of inactivity.
Removing it
- An employee can delete their own login from their own page (Settings → Delete my login). That removes the login, email, phone, picture and the messages they sent, and signs them out everywhere. Their name stays on the shifts and hours they worked, because those are the store's payroll record and the store is required to keep them.
- An owner can close a workspace from the account page (type the store's name and your password). That removes the whole store — its team, rota, hours, messages and files — cancels the subscription, and cannot be undone.
- Either can also write to us and we will do it for you.
Security
Everything travels over HTTPS. Passwords are stored as salted scrypt hashes. Each store's records are in a database of their own, and a login is only ever valid for the store it was made on. Uploaded files are checked to be pictures before they are kept. We keep a written security model and a test suite that proves each rule from both sides.
Children
Storeboard is for businesses and the people they employ. It is not for anyone under 16, and we do not knowingly hold details of anyone under 16.
Changes
If this page changes in a way that matters, owners are told by email before it takes effect.
Contact
Privacy questions: privacy@storeboard.io. Storeboard, [postal address].