Version 2026-09-28 · Effective 29 September 2026
This policy explains how Boardly Limited collects, uses and protects personal data, and the rights you have over it. It covers the candidates in our network, the companies and founders who hire through us, and everyone else whose data we handle.
The key points
We use your data to make introductions between companies and board-level candidates, and for nothing unrelated to that.
We never sell personal data. The AI that reads CVs and runs our matching, Anthropic’s Claude, does not train on data we send it.
Candidates: once a person at Boardly has released a shortlist you are on, the company sees your profile without your name or employers, and sees your name and full professional profile when it reveals the shortlist. They never see your photograph, and we never share your profile with your current employer without your permission.
We use AI to take briefs, read CVs and rank candidates. People at Boardly review every shortlist, and companies make every hiring decision. You can ask a person to review anything the AI did.
Calls with Veronica, our AI voice agent, are transcribed as you speak, and only with your agreement before each call. Since 29 September 2026 we do not record the audio.
You can ask us for a copy of your data, to correct it, or to delete it, by emailing hello@joinboardly.com.
You can object to direct marketing at any time, and we will stop.
1. Who we are and how to contact us
1.1 Boardly Limited (“Boardly”, “we”, “us”) is the controller of the personal data described in this policy. We are a company registered in England and Wales with company number 15136616. Our registered office is 1st Floor, Gallery Court, 28 Arcadia Avenue, London N3 2FG.
1.2 For anything to do with your personal data, including requests and complaints, email hello@joinboardly.com or write to us at our registered office. Messages about your data sent to any Boardly address, including hello@joinboardly.com, will reach the right person.
1.3 We have not appointed a Data Protection Officer, because the law does not require us to. Our co-founder Sandy Willis is responsible for data protection at Boardly.
2. Who this policy covers
2.1 This policy covers:
(a) Candidates: people who apply to join, or are members of, our network of Chairs, Non-Executive Directors, Board Advisors and Fractional Leaders, including people who were members of the earlier version of Boardly;
(b) Company users: founders and other people who use Boardly for a company, including colleagues they invite to review a shortlist;
(c) Endorsers: people a candidate names as someone who can vouch for them;
(d) People mentioned in a brief: for example, existing board members a founder tells us about;
(e) Business contacts: founders, investors, partners and others we contact, or who contact us, about Boardly; and
(f) Website visitors and event guests.
3. The data we collect and where it comes from
3.1 Candidates
What we collect
Where it comes from
Name, email address, LinkedIn profile address and sign-in identifier, location
You, and LinkedIn when you sign in with it
Your application and our decision on it
You, and our team
Career history, board experience, qualifications, skills, sectors, and the contents of your CV
You, your CV, and your public LinkedIn profile, which we obtain through our data provider EnrichLayer
Role preferences, availability, location preferences and fee expectations
You
Transcripts of any call with Veronica, and the notes, summaries and profile details our AI draws from them
You, through the call, and our AI tools
Your Board CV, match reasons and match scores
Created by us and our AI tools from the information above
Endorsements: what your endorsers confirm about you
Your endorsers
Your activity: roles you are shown, roles you are interested in or decline, introductions, how many companies viewed your profile, and appointments
The platform, companies, and you
Emails we exchange, email delivery records and your email preferences
You, and our email provider
Records of what you agreed to and when, including the date, time, your IP address and browser details
The platform
3.2 Company users
What we collect
Where it comes from
Name, work email address, sign-in identifier and, if you give it, your LinkedIn profile address
You, and Google or Microsoft when you sign in with them
Company details: name, website, sector, stage, team size and the amount it has raised
You; your company’s public LinkedIn page, which our data provider EnrichLayer finds from your website address; and public sources
Your brief: transcripts of any call with Veronica, notes of any call with our team, and the briefs we write from them
You, our team, and our AI tools
Booking details if you arrange a call with our team
You, through Calendly
Your activity: searches, shortlists, which candidate profiles you view and for how long, notes and reactions, candidates you decline and why, introductions, meetings, offers and appointments
The platform, and you
Contract records: the terms you accepted, when you revealed each shortlist, each introduction, the fee band and quoted fee, and a copy of each introduction email we sent for you, with the date, time, your IP address and browser details
The platform
Billing details, invoices and payments
You, and our payment providers
For colleagues you invite: name, email address, sign-in identifier, and what they view, like or note
You, and your colleague
3.3 Endorsers
If a candidate names you as an endorser, we receive your name, email address, role, company and the words the candidate attributes to you. We email you to ask you to confirm, edit or decline them (the candidate can ask us to send a reminder, no more than once a week), and we keep your response. Companies never see your email address.
3.4 People mentioned in a brief
Founders sometimes tell us about people connected with their company, such as current board members, when describing a role. We keep this only as part of the brief, use it only to run that search, and do not contact the people concerned.
3.5 Business contacts
We collect the name, job title, company, business email address, LinkedIn profile address and publicly reported information about your company (such as funding rounds) of founders, investors and partners we think may be interested in Boardly. We get this from business databases (such as Beauhurst), Companies House, LinkedIn, company websites and press coverage, from people who introduce us, and from you when you talk to us or come to our events. We keep notes of our conversations in our CRM.
3.6 Website visitors, people who contact us and event guests
When you visit joinboardly.com we collect basic technical information, such as your IP address and browser type, and count visits (see section 13). If you fill in a form or email us, we keep what you send. If you register for one of our events, we keep your name, email address, company and attendance.
3.7 Special category data
We do not ask for information about your health, ethnicity, religion, sexual orientation, political views or other special category data, and we do not use it in matching. Please leave it out of your CV, profile and calls. If you include it anyway, we will not use it to decide whom to put forward, we will remove it from your profile and Board CV when we notice it or you ask, and we will delete it from a call transcript if you ask. Our matching is also instructed to disregard any requirement in a brief that targets a protected characteristic.
3.8 If you do not give us information
Candidates need to give us their name, email address and career history to be matched. Companies need to give us their company details, including the amount raised, which sets our fee. Without this we cannot provide our service. A call with Veronica is optional for candidates, and companies can choose a call with our team instead.
4. How we use your data and why we are allowed to
4.1 The law allows us to use personal data only where we have a lawful basis. The table below sets out what we do and the basis we rely on.
What we do
Whose data
Lawful basis
Review applications and run your candidate account, build your Board CV, match you to roles, and make introductions
Candidates
Contract: providing the service under our Candidate Terms
Get your LinkedIn profile data to pre-fill your Board CV
Candidates
Legitimate interests: saving you from typing out your career history
Transcribe Veronica calls, and use the transcripts to write your profile or your brief
Candidates, company users
Consent, which you give on the screen before each call
Run company accounts, take briefs, produce and review shortlists, make introductions and record appointments
Company users
Legitimate interests: providing our service to your company under our Terms for Companies
Keep records of terms accepted, shortlists revealed and introductions made, and invoice and collect fees
Company users
Legitimate interests: establishing and enforcing our contract with your company; legal obligation for tax and accounting records
For 12 months after we introduce a candidate to a company, check public records (such as Companies House) and public profiles (such as LinkedIn) to see whether that company has appointed them
Candidates
Legitimate interests: making sure companies pay the fee they agreed to when they appoint someone we introduced
Show candidates’ profiles and names to companies they are matched with, and send introduction emails
Candidates, company users
Contract (candidates); legitimate interests (company users)
Let founders invite colleagues to review a shortlist
Company users
Legitimate interests: helping your company make its decision
Contact endorsers to verify endorsements
Endorsers
Legitimate interests: showing companies only endorsements that are genuine
Keep information founders give us about people connected with their company
People mentioned in a brief
Legitimate interests: understanding the role we are recruiting for
Tell candidates how many companies viewed their profile, and use viewing and response data to improve matching
Candidates, company users
Legitimate interests: improving our matching and giving candidates useful feedback
Test and improve our matching and AI tools, for example by checking shortlists and outcomes against each other
Candidates, company users
Legitimate interests: making our matching more accurate and fairer
Take notes of calls with our team using an AI note-taker, when we tell you at the start of the call
Candidates, company users, business contacts
Legitimate interests: keeping an accurate record of what you told us. You can ask us not to use it on a call
Invite members of the earlier version of Boardly to rejoin
Former members
Legitimate interests: letting people who joined us before know about the new service. Every email has an unsubscribe link
Send service emails, such as application updates, shortlist and introduction emails
Candidates, company users
Contract (candidates); legitimate interests (company users)
Send news and updates about Boardly
Candidates, company users
Consent, where you ticked the box to receive them
Contact business contacts about Boardly, and keep CRM records
Business contacts
Legitimate interests: direct marketing to businesses, which the law recognises as a legitimate interest
Run events
Event guests
Legitimate interests: running our events
Keep the platform secure, prevent misuse and fix problems
Everyone
Legitimate interests: running a secure service
Keep the records the law requires of an employment agency
Candidates, company users
Legal obligation
Deal with complaints, legal claims and requests from regulators
Everyone
Legal obligation and legitimate interests
4.2 Where we rely on legitimate interests, we have considered your interests and rights and concluded that they do not override ours. You can ask us for details, and you can object (section 10).
4.3 Where we rely on consent, you can withdraw it at any time by emailing hello@joinboardly.com. For marketing emails, use the unsubscribe link. Withdrawing consent does not affect anything we did before.
4.4 We will use your data for a new purpose only if it is compatible with the purpose we collected it for, or if we tell you first.
5. AI, matching and automated decisions
5.1 We use AI in four main ways: Veronica, our AI voice agent, holds calls to take a company’s brief or learn about a candidate; AI reads CVs and call transcripts to draft profiles, Board CVs and briefs; after automatic filters, AI ranks candidates against each brief; and AI helps us sort replies to our emails, after we have removed contact details from them.
5.2 Our matching works in two steps. First, automatic filters set aside candidates who cannot fit the brief, for example because their profile is incomplete, they are not open to that type of role, or they are not in or willing to work in the right location. Then AI scores how well each remaining candidate fits the brief, and we take the strongest. People at Boardly review each shortlist before deciding whether to release it, and the company decides whom to meet and whom to appoint.
5.3 We do not make hiring decisions about anyone solely by automated means. But our automatic filters can set a candidate aside for a role before any person looks at it, and the ranking decides who a company sees, so we give candidates the safeguards the law requires for automated decisions. If you are a candidate, you can:
(a) ask us which roles you have been considered for, whether you were put forward, and why;
(b) tell us anything you think we should take into account;
(c) ask a person at Boardly to review your case; and
(d) challenge the outcome.
Email hello@joinboardly.com to do any of these.
5.4 Our AI Consent Statement gives more detail about how we use AI and Veronica.
6. Who we share your data with
6.1 Companies (candidate data). When we release a shortlist you are on, the company sees your profile without your name or the names of the organisations you have worked for. It does see the first letter of your name, where you are based, the roles and sectors you are open to, and whether you have told us you are interested in the role or that it is not for you. When the company reveals the shortlist, it also sees your name, current role, LinkedIn profile link and Board CV, the reasons we matched you, and any endorsements you have had confirmed. When the company asks us to introduce you, we send an email to you and the company together, so the company will see your email address. Companies never see your photograph, your fee expectations or your match score, and never receive your call transcript. The company may share what it sees with its directors, employees, investors’ board representatives and professional advisers who are helping it decide. Our Terms for Companies make the company responsible for your data from that point: it must keep it confidential, use it only to consider you for that role, not contact your current employer, colleagues or referees without your agreement, and delete it when its search closes, or 12 months after the introduction if that is sooner, unless it appoints you or the law requires it to keep it.
6.2 Candidates (company user data). Candidates matched to a role see the version of the brief the company approved. When we make an introduction, the candidate sees the founder’s name and email address.
6.3 Colleagues. If you invite colleagues to review a shortlist, they see candidates’ profiles without names, and each other’s notes and reactions.
6.4 Service providers. We use the providers in section 7 to run Boardly. Most act only on our instructions and must keep your data secure and confidential. A few, such as LinkedIn, Google and Microsoft when you sign in with them, Stripe, EnrichLayer and Beauhurst, also decide how they use data themselves, under their own privacy policies.
6.5 Professional advisers and others. We may share data with our lawyers, accountants and insurers, with regulators, courts and the police where the law requires it, and with anyone who buys or invests in our business, who will be bound by this policy.
6.6 We never sell personal data.
7. Our service providers
Provider
What they do for us
Where the data is processed
Supabase
Database and sign-in
United Kingdom (London)
Vercel
Hosting the Boardly app
United States and other regions
Anthropic
AI models (Claude) for reading CVs and transcripts, writing briefs and profiles, and matching, and storing the documents prepared for matching
United States
Vapi
Running Veronica calls: connecting the call, transcribing it and producing Veronica’s voice. On some calls Vapi uses Daily to carry the live audio
United States
OpenAI
The language model that produces Veronica’s side of the conversation, through Vapi
United States
Deepgram
Speech-to-text transcription for Veronica calls, through Vapi
United States
ElevenLabs
Producing Veronica’s voice on some calls, through Vapi
United States
EnrichLayer
Public LinkedIn profile data for candidates, and public company information from LinkedIn company pages
United States
Resend
Sending emails from the platform
United States
Stripe
Card payments
Ireland and United States
Calendly
Booking calls with our team
United States
Sign-in with Google, and fonts on our app
United States and other regions
Microsoft
Sign-in with Microsoft; our email, calendar and documents (Microsoft 365)
United Kingdom, Europe and United States
Sign-in with LinkedIn
United States and Ireland
Framer
Hosting our website and its forms, and counting visits
European Union and United States
Folk
Our CRM for business contacts
European Union
lemlist and HeyReach
Sending business outreach by email and LinkedIn
European Union and United States
Beauhurst
Business database we use to find companies and their founders
United Kingdom
Granola
Note-taking on calls with our team, when we tell you at the start of the call
United States
We will update this list when we add or change a provider that handles personal data.
8. Sending data outside the UK
8.1 Some of our providers process data outside the UK, mainly in the United States. When they do, we make sure your data is protected in one of the ways the law allows: the provider is covered by UK adequacy regulations (for US providers, by being certified under the UK Extension to the EU-US Data Privacy Framework), or we have a data transfer agreement with the provider in the form approved by the UK regulator (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
8.2 You can ask us for more information about the safeguard used for any provider by emailing hello@joinboardly.com.
9. How long we keep your data
9.1 We keep personal data only for as long as we need it. After that we delete it or make it anonymous.
Data
How long we keep it
Candidate profile, Board CV, call transcripts and matching data
While your account is open. If your account has had no activity for 24 months, we will email you, and delete your profile if you do not reply within 30 days. If you close your account, we delete them within 30 days, except the employment agency records in the next row.
Employment agency records: the terms you accepted, your role preferences, the roles we told you about and your responses, the information we gave you about each role, any opt-out under clause 10 of our Candidate Terms, and the introductions we made
12 months after we last provided a service to you, or longer if they also form part of the contract and fee records below
Veronica call audio
Calls since 29 September 2026 are not recorded. For earlier calls, Vapi holds the recording, not our own systems, and we plan to have these recordings deleted. You can ask us to have yours deleted sooner.
Vapi’s records of each call (a copy of the transcript and the call log)
Held by Vapi until deleted. We are arranging with Vapi for each record to be deleted within 60 days of the call, and we will update this policy when that is in place. You can ask us to have yours deleted.
Applications we did not accept
12 months from our decision
Company user account and search data, including briefs and transcripts
While your account is open, and for 24 months after a search closes, unless it forms part of the contract records below
Contract and fee records: terms accepted, shortlists revealed, introductions made (including the names and email addresses of the people introduced and a copy of each introduction email), appointments, invoices and payments
7 years after the later of the end of the 12-month fee period (the Relevant Period in our Terms for Companies) and the date any fee is paid, so that we can meet our tax obligations and deal with any claim
Endorsements
If confirmed, with the candidate’s profile. If declined or not confirmed within 30 days, deleted within the following 30 days.
Business contact and CRM records
For as long as we are in touch. We delete records with no contact for 24 months, except that we keep your email address on a suppression list if you have asked us not to contact you, so that we can honour that request.
Consent records
For as long as your account is open. The record of the terms a company accepted is kept with the contract and fee records.
Records of requests and complaints about your data
2 years after we close the request or complaint
Website form submissions and event registrations
24 months
Service provider logs, such as email delivery and hosting logs
Up to 30 days, or the provider’s standard period
9.2 We may keep data longer if we need it for a legal claim, or if the law requires us to.
10. Your rights
10.1 You have the right to:
(a) get a copy of the personal data we hold about you;
(b) have inaccurate or incomplete data corrected;
(c) have your data deleted, where we have no good reason to keep it;
(d) ask us to restrict how we use your data while a concern is resolved;
(e) receive data you gave us in a commonly used, machine-readable format, or have it sent to someone else;
(f) object to how we use your data where we rely on legitimate interests;
(g) withdraw consent where we rely on it; and
(h) the safeguards for automated decisions in section 5.3.
Your right to object. You can object at any time to our using your data for direct marketing, including any profiling for that purpose, and we will stop. You can also object to any use of your data that we base on legitimate interests. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data for a legal claim. To object, email hello@joinboardly.com or use the unsubscribe link in any marketing email.
10.2 To use any of these rights, email hello@joinboardly.com. We may need to confirm your identity first. We will reply within one month. If your request is complex, or you make several, we may take up to two more months and will tell you why. The time limit is paused while we wait for anything we reasonably need from you, such as proof of identity or details to find your data. We will make reasonable and proportionate searches. There is normally no charge.
11. Complaints
11.1 If you are unhappy with how we have handled your personal data, please tell us first by emailing hello@joinboardly.com or writing to our registered office. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.
11.2 You also have the right to complain to the UK data protection regulator, the Information Commissioner’s Office (which becomes the Information Commission on 30 September 2026): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; online at ico.org.uk/make-a-complaint.
12. Marketing and business outreach
12.1 We send news and updates by email to candidates and company users who have agreed to receive them. Every marketing email has an unsubscribe link.
12.2 We contact founders, investors and partners at their business email addresses and on LinkedIn to tell them about Boardly. Every message says who we are, links to this policy and tells you how to stop hearing from us. If you ask us to stop, we will, and we will keep your email address on a suppression list so we do not contact you again.
12.3 Service emails, such as application updates and introductions, are part of our service and are not marketing.
13. Cookies and similar technologies
13.1 Cookies are small files stored on your device. Our app uses only cookies that are needed for it to work, and a few items in your browser’s storage that remember your choices. We do not use advertising cookies, and we do not use cookies to track you across other sites.
Name
What it does
How long it lasts
sb-[project]-auth-token
Keeps you signed in
Up to 400 days, or until you sign out
sb-[project]-auth-token-code-verifier
Keeps the sign-in process secure while you sign in with Google, Microsoft or LinkedIn
Until sign-in completes
boardly_consent_pending
Carries the choices you made on the sign-up screen through sign-in
10 minutes
boardly_pending_intake
Remembers the role you chose before signing in
24 hours
boardly_apply_prefill
Carries your name and email into your application after you sign in with LinkedIn
60 seconds
boardly_reactivation_cid, boardly_reactivation_intent, boardly_appinvite_token
Link your sign-in to an invitation we sent you
10 minutes
Browser storage items beginning “boardly_”, “greeting” or “confetti-fired”
Remember things such as whether you have seen a welcome screen or an animation, and which search you were viewing
Until you clear your browser storage
13.2 Our app loads fonts from Google, which receives your IP address to deliver them. If you book a call with our team, Calendly’s booking window, which opens inside our app, may set its own cookies. Veronica calls connect your browser directly to Vapi, or to Daily, which Vapi uses to carry the audio on some calls, and each receives your IP address. If you pay through Stripe, Stripe may set its own cookies on its own pages.
13.3 Our website at joinboardly.com is hosted by Framer. We use Framer’s built-in analytics to count visits. It does not use cookies to identify or track you. If we ever add cookies that need your consent, we will ask for it first.
13.4 You can block or delete cookies in your browser settings, but if you block the ones our app needs, you will not be able to sign in.
14. Keeping your data secure
14.1 We protect your data with measures that include encryption in transit and at rest, database access rules that limit who can see which records, sign-in through trusted providers rather than passwords we store, multi-factor authentication for our team’s access to our systems, and limiting access to the small number of people who need it.
14.2 If a personal data breach puts your rights at risk, we will tell the regulator within 72 hours of becoming aware of it, and tell you without undue delay if the risk to you is high.
15. Children
Boardly is not for anyone under 18, and we do not knowingly collect data about children. If you think we have, email hello@joinboardly.com and we will delete it.
16. Changes to this policy
We may update this policy. We will publish the new version on this page with a new version date. If a change materially affects how we use your data, we will email you before it takes effect.
Boardly Limited, company number 15136616. Registered office: 1st Floor, Gallery Court, 28 Arcadia Avenue, London N3 2FG. Contact: hello@joinboardly.com.