Privacy Policy

1. Introduction

Welcome to Preside, the AI-powered board management platform operated by Global Board Institute (“we,” “us,” “our,” or “Global Board Institute”). Preside provides board meeting management, document management, electronic voting, e-signatures, AI-powered meeting summaries, AI governance insights, an AI board advisor, integrations with Microsoft 365, Google Workspace, and Zoom, a regulations and governance library, and related board governance tools to organizations worldwide.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information and board governance data when you access or use the Preside platform, including our website, web application, APIs, and any related services (collectively, the “Service”). By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, you must not access or use the Service.

We are committed to protecting the privacy and security of your information. Board governance data is among the most sensitive information an organization holds, and we treat it with the highest level of care and responsibility.

2. Information We Collect

We collect information that you provide directly to us, information generated through your use of the Service, and information obtained from third-party integrations you authorize.

2.1 Account Information

When you register for an account, we collect your name, email address, job title, organization name, phone number (optional), and authentication credentials. For organization administrators, we also collect billing information including payment method details, billing address, and invoice history. If you sign in using single sign-on (SSO) or social authentication providers, we receive your name and email address from those identity providers.

2.2 Board and Meeting Data

In the course of using the Service, your organization submits board governance data including meeting agendas, meeting minutes, attendance records, board resolutions, voting records and outcomes, action items, committee assignments, board member profiles, board evaluation questionnaires and responses, and board announcements. This data is provided and controlled by your organization and is processed by us on your organization’s behalf.

2.3 Documents and Files

You may upload, create, or share documents through the Service, including board books, policies, compliance documents, financial reports, contracts, and any other files relevant to your board operations. We also collect metadata associated with these documents, such as file names, file sizes, upload dates, version history, annotations, comments, and e-signature records.

2.4 Communications Data

If you use our secure board messaging feature, we collect the content of messages exchanged between board members, message timestamps, read receipts, and delivery status. We also collect any communications you send to us directly, such as support requests, feedback, and inquiries.

2.5 Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, actions taken (such as creating meetings, casting votes, or uploading documents), search queries, time spent on pages, click patterns, and navigation paths. This information helps us understand how the Service is used and identify areas for improvement.

2.6 Device and Technical Information

We collect technical information about the devices and browsers you use to access the Service, including IP addresses, browser type and version, operating system, device type, screen resolution, language preferences, time zone, and referring URLs. We also collect information from server logs, including access times, error logs, and request details.

2.7 Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your browsing activity, maintain your session, remember your preferences, and analyze Service usage. Essential cookies are required for the Service to function and cannot be disabled. Analytics and performance cookies help us understand usage patterns and improve the Service. You can manage your cookie preferences through our cookie settings or your browser settings. For more information, please refer to our Cookie Policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery and Operations

We use your information to provide, maintain, and operate the Service, including managing your account, processing board meetings, facilitating electronic voting and resolutions, managing documents and e-signatures, enabling secure communications between board members, maintaining audit trails, and delivering the core governance features you and your organization rely on.

3.2 AI-Powered Features

We process your board and meeting data to power our AI features, including generating meeting summaries, providing governance insights and health scores, delivering AI board advisor responses, producing board book compilations, and offering compliance gap analysis. The specific data processing involved in these features is described in further detail in Section 4 below.

3.3 Analytics and Service Improvement

We use aggregated and anonymized usage data to analyze trends, monitor Service performance, identify and fix technical issues, develop new features, and improve the overall user experience. We may also use anonymized, aggregated data to produce industry benchmarks and governance insights reports, but such reports never contain information that could identify any individual or organization.

3.4 Communications

We use your contact information to send you transactional communications related to the Service, such as account verification emails, meeting notifications, voting reminders, action item alerts, security alerts, and billing receipts. We may also send you product updates, governance best practices, and promotional communications, but only where you have opted in to receive them. You can unsubscribe from promotional communications at any time by clicking the unsubscribe link in any email or by adjusting your notification preferences in your account settings.

3.5 Compliance and Legal Obligations

We use your information to comply with applicable laws, regulations, and legal processes, to enforce our Terms of Service, to protect the rights, property, and safety of Global Board Institute, our users, and the public, and to detect, prevent, and address fraud, security issues, and technical problems.

4. AI-Powered Features and Data Processing

Preside incorporates artificial intelligence and machine learning capabilities to enhance board governance. We are committed to transparency about how these features process your data.

4.1 AI Meeting Summaries

When your organization uses the AI Meeting Summaries feature, meeting content including agendas, minutes, notes, and transcripts is processed by our AI systems to generate structured summaries highlighting key decisions, action items, discussion points, and follow-up requirements. This processing occurs in real time or near-real time and the input data is used solely to produce the summary for your organization. Meeting content is not retained by our AI systems beyond what is necessary to generate the summary output.

4.2 AI Board Advisor

The AI Board Advisor feature processes your governance questions and, where relevant, contextual data from your organization’s governance configuration (such as jurisdiction, industry, and board structure) to provide expert guidance on regulations, board best practices, fiduciary duties, and jurisdictional compliance. The advisor draws on our curated regulations and governance library spanning 34+ regulations across 11 jurisdictions. Your queries and the advisor’s responses are stored in your organization’s account for reference purposes and are not shared with other organizations.

4.3 AI Governance Insights

The AI Governance Insights feature analyzes your organization’s board data, including meeting frequency, attendance patterns, voting participation, compliance checklist completion rates, document management activity, and board composition, to produce governance health scores, compliance gap analysis, and actionable recommendations. This analysis is performed exclusively on your organization’s data and results are only visible to authorized users within your organization.

4.4 Your Data Is Not Used to Train AI Models

We want to be unequivocal on this point: your organization’s board data, meeting content, documents, communications, and any other customer data are never used to train, fine-tune, or improve our AI models or any third-party AI models. Your data is processed solely to deliver the AI-powered features you have enabled and is not used for any other purpose. AI outputs are generated on a per-request basis, and customer data is logically isolated between organizations at all times.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information or board governance data to any third party. We share your information only in the limited circumstances described below.

5.1 Service Providers

We engage trusted third-party service providers to assist in delivering the Service, including cloud infrastructure and hosting providers, payment processors, email delivery services, analytics providers, customer support tools, and security monitoring services. These providers are contractually obligated to process your data only on our behalf and in accordance with our instructions, and they are bound by data processing agreements that require them to maintain appropriate security measures and comply with applicable data protection laws.

5.2 Third-Party Integrations

Preside offers integrations with Microsoft 365, Google Workspace, and Zoom to enable calendar synchronization, document collaboration, and video meeting connectivity. These integrations are activated only at your organization’s explicit request and with authorized user consent. When you enable an integration, data is shared with the respective third-party provider only to the extent necessary to deliver the integration functionality (for example, syncing meeting dates to your Microsoft 365 calendar or launching a Zoom meeting from within Preside). We do not share any data with these providers beyond what is required for the integration you have authorized, and you can revoke integration access at any time from your organization settings.

5.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, including to meet national security or law enforcement requirements. We may also disclose information where we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request. Where legally permitted, we will make reasonable efforts to notify you before disclosing your information in response to a legal request.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service of any change in ownership or uses of your personal information, as well as any choices you may have regarding your information.

5.5 No Sale of Personal Data

We do not sell your personal information as defined under the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), or any other applicable privacy legislation. We do not share your personal information for cross-context behavioral advertising purposes.

6. Data Security

We implement and maintain comprehensive technical and organizational security measures designed to protect the confidentiality, integrity, and availability of your information. Board governance data demands the highest standards of security, and we invest continuously in our security posture.

6.1 Encryption

All data at rest is encrypted using AES-256 encryption, the industry gold standard used by governments and financial institutions worldwide. All data in transit is protected using TLS 1.3, ensuring that information exchanged between your browser and our servers cannot be intercepted or tampered with. Database backups, file storage, and all other persistent data stores are fully encrypted.

6.2 Compliance and Certifications

Preside does not currently hold a SOC 2 Type II attestation or ISO 27001 certification of its own. Our infrastructure providers maintain their own certifications for the data centers we run on, but that is their attestation and not ours. Obtaining a Preside-level SOC 2 Type II attestation is on our compliance roadmap. We would rather state this plainly here than have it surface during procurement.

6.3 Access Controls

We enforce role-based access control (RBAC) throughout the platform, ensuring that users can only access the data and features appropriate to their assigned role within their organization. Administrative access to production systems is restricted to authorized personnel, requires multi-factor authentication, and is logged and audited. We support single sign-on (SSO) via SAML 2.0 and SCIM provisioning for enterprise customers to integrate with their existing identity management infrastructure.

6.4 Audit Logging

Every significant action within the platform is recorded in a server-side audit log, including logins, document access, votes cast, meeting actions, permission changes, and administrative operations. These audit logs are available to organization administrators for compliance and governance purposes and are retained in accordance with our data retention policies. Audit logs cannot be modified or deleted by any user, including administrators.

6.5 Infrastructure and Monitoring

Our infrastructure is hosted on enterprise-grade cloud platforms with redundant systems, automated failover, and disaster recovery capabilities. We perform dependency vulnerability scanning and security code review. Independent third-party penetration testing and round-the-clock security monitoring are on our roadmap. We maintain an incident response plan that includes notification procedures in the event of a security breach.

7. Data Retention

7.1 Active Accounts

We retain your information for as long as your account is active or as needed to provide the Service to you and your organization. Board governance data, including meeting records, documents, resolutions, and audit logs, is retained throughout the duration of your organization’s subscription to support ongoing governance operations and regulatory compliance requirements.

7.2 Account Deletion

Upon termination of an organization’s subscription, or upon a verified deletion request from an authorized organization administrator, we will delete or anonymize all associated data within 90 days, except where retention is required by applicable law or regulation. Before deletion, we will provide the organization with the opportunity to export their data in standard formats. Individual board members may request deletion of their personal account data, subject to the organization’s data retention policies and applicable legal requirements.

7.3 Regulatory Retention Requirements

Certain categories of data may be subject to mandatory retention periods under applicable laws and regulations. For example, financial records, audit logs, and records of board decisions may need to be retained for periods prescribed by corporate governance regulations, securities laws, tax laws, or other regulatory frameworks in the jurisdictions where your organization operates. We will retain such data for the minimum period required by law and will securely delete it thereafter. We will inform your organization of any legal retention requirements that affect the timing of data deletion upon request.

7.4 Backup and Recovery Data

Encrypted backup copies of data may persist in our backup systems for up to an additional 30 days following deletion from production systems. Backups are encrypted, access-controlled, and automatically purged on a rolling basis.

8. International Data Transfers

Preside serves organizations across the United States, the United Kingdom, the European Union, the Gulf Cooperation Council (GCC) countries, Canada, and Australia. Your information may be transferred to, stored in, and processed in countries other than the country in which it was originally collected, including the United States.

8.1 Safeguards for International Transfers

When we transfer personal data outside of its country of origin, we ensure that appropriate safeguards are in place to protect your information in accordance with applicable data protection laws. These safeguards include the use of European Commission-approved Standard Contractual Clauses (SCCs) for transfers of personal data from the European Economic Area (EEA), the United Kingdom, and Switzerland to countries that have not received an adequacy decision. We also rely on the UK International Data Transfer Agreement (IDTA) and UK Addendum to the EU SCCs where applicable.

8.2 Additional Protections

In addition to contractual safeguards, we implement supplementary technical and organizational measures to protect transferred data, including encryption in transit and at rest, strict access controls, and data minimization practices. We conduct transfer impact assessments where required and continuously monitor the legal landscape in the countries where we process data to ensure ongoing compliance.

8.3 Data Residency

Preside data is currently stored in a single United States region. We do not yet offer customer-selectable data residency, and it is on our roadmap. If storing data in a specific region is a requirement for your organization, please contact us before subscribing so we can be clear about timing.

9. Your Rights

Depending on your location and applicable laws, you may have certain rights with respect to your personal information. We are committed to honoring these rights regardless of where you are located, to the extent practicable and consistent with applicable law.

9.1 Right of Access

You have the right to request confirmation of whether we process your personal information and to obtain a copy of the personal information we hold about you. We will provide this information in a commonly used, machine-readable format within the timeframes required by applicable law (typically 30 days).

9.2 Right to Rectification

You have the right to request correction of inaccurate personal information and to have incomplete personal information completed. You can update much of your personal information directly through your account settings, or you can contact us to request corrections.

9.3 Right to Erasure

You have the right to request deletion of your personal information in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, when you withdraw consent (where processing was based on consent), or when the data has been unlawfully processed. This right is subject to certain exceptions, including where retention is necessary for compliance with legal obligations or for the establishment, exercise, or defense of legal claims.

9.4 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance. Preside supports data export in standard formats including CSV, PDF, and JSON to facilitate portability.

9.5 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal information in certain circumstances, such as when you contest the accuracy of the data, when the processing is unlawful but you oppose erasure, or when we no longer need the data but you require it for the establishment, exercise, or defense of legal claims.

9.6 Right to Object

You have the right to object to the processing of your personal information where the processing is based on our legitimate interests or for direct marketing purposes. Where you object to processing for direct marketing, we will cease processing your personal information for that purpose immediately.

9.7 Rights Under the CCPA/CPRA

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know what personal information we collect, use, disclose, and sell; the right to delete your personal information; the right to opt out of the sale or sharing of personal information (though we do not sell personal information); the right to non-discrimination for exercising your privacy rights; and the right to limit the use of sensitive personal information. To exercise these rights, please contact us using the information in Section 12 below.

9.8 Exercising Your Rights

To exercise any of the rights described above, please submit a request to privacy@presideos.com. We will verify your identity before processing your request and will respond within the timeframes required by applicable law. If you are making a request on behalf of an organization, we may require authorization from an organization administrator. You also have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your personal information infringes applicable law.

10. Children’s Privacy

The Service is designed for business use by organizations and their board members and is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16 years of age. If we become aware that we have inadvertently collected personal information from a child under 16, we will take prompt steps to delete that information from our systems. If you believe that a child under 16 has provided us with personal information, please contact us immediately at privacy@presideos.com so that we can take appropriate action.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes to this Privacy Policy, we will notify you by posting the updated policy on this page with a revised “Last updated” date and, where required by applicable law or where the changes are significant, we will provide additional notice via email to the email address associated with your account or through an in-app notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated Privacy Policy, you must stop using the Service and may request deletion of your account.