Privacy notice
What we collect, why, who else handles it, how long it stays and what you can ask us to do.
Who we are
BoardJudgement is a finance reporting service run by Imperium Business Intelligence Ltd. Write to us at andrew.hoyle@imperium-bi.co.uk.
We hold two roles. For the financial data a client puts into the service, that client is the controller and we process it on their instructions: a question about that data usually goes to them first. For accounts, billing and enquiries, we are the controller.
What we collect and why
| What | Where it comes from | Why | Basis |
|---|---|---|---|
| Your name, email address and organisation membership | You, when you sign up or are invited | To sign you in and keep your workspace yours | Contract |
| Name, work email, company and message on our contact form | You | To answer you | Legitimate interests in replying to an enquiry |
| Financial records: ledgers, invoices, customers, suppliers, narratives, uploaded files | The client, from its files or connected systems | To build its reports and board packs. These can name people, such as sole traders and staff | The client's contract with us; the client decides its own basis as controller |
| Board pack recipients: email address, name, whether each pack was sent and delivered | The client's admin | To deliver the pack | The client's contract with us |
| Guest link opens: when, a hash of your IP address that changes daily, and your browser's user agent | Your browser, when you open a shared pack | To show the sender that a pack was opened | The client's contract with us |
| Questions asked of the AI Copilot and a record of how each was answered | You | To answer the question and let the answer be checked | The client's contract with us |
| Error reports: the error message and the route it came from | Our servers, when error tracking is switched on | To find and fix faults | Legitimate interests in keeping the service working |
Website visits are counted by an anonymous event name, with no cookie, no identifier and no address stored. We use no advertising or analytics tools. See the cookie notice.
Email open tracking
Board pack emails carry no tracking image unless the client’s admin has switched open tracking on, and the email says so when they have. Every pack email has a one-click unsubscribe link. Opening a guest link is always recorded, as above.
The AI Copilot
When someone asks the Copilot a question, we send Anthropic the question, the field names of the reporting model, and up to 50 rows of the result with their labels. Those labels can include invoice numbers, counterparty ids, funds and analysis values, so they can identify a person. Anthropic processes this outside the UK under its data processing terms. It doesn’t use the data to train models and may keep it for a limited period for trust and safety. The Copilot supports decisions and makes none: a person reads the figure and decides. Where answers are generated, you can see the query behind them.
When an admin drafts a board narrative with AI, we send Anthropic the organisation’s name, the period and each headline board figure with its value: revenue, costs, result, net cash and invoices. The same terms apply.
Who else handles it
Our suppliers process data on our instructions. The current list, with what each does, is on the sub-processors page. Some are outside the UK; ask us for the safeguard that applies to any of them.
How long we keep it
| Record | Kept |
|---|---|
| Website enquiries | 1 year |
| Uploaded source files | 90 days |
| Guest link opens | 1 year |
| Copilot records of how a question was answered | 2 years |
| Rejected rows from an import, once resolved | 90 days |
| Rejected rows nobody has resolved | 1 year |
| Read in-app notifications | 6 months |
| Outbound webhook payloads | 30 days |
| Billing statements and usage records | Not deleted on a schedule: kept as accounting records |
| The security audit log | Not deleted: it holds ids rather than names |
| An organisation that signed up and never chose a plan | Deleted from 14 days after sign-up, and at least 7 days after we email its admins a notice |
| A client whose accountant's practice closed, until it chooses a plan | Deleted 90 days after the practice closed, or later if a notice went out late. Its admins are told at the start and 14 days before, and can export its data throughout. Choosing a plan stops this for good. |
When a client leaves
- We take a final backup of every ledger table, encrypted under its own key. It excludes uploaded files and rendered packs. If it can't be taken, nothing is destroyed.
- The client's database is dropped, with all its branches and point-in-time history.
- Uploaded files and rendered packs are erased from storage and checked gone.
- Keys are destroyed and personal data is purged from our control database. Financial statement totals stay.
- The final backup and its key are destroyed after 30 days.
- Backups of the control database hold earlier records for up to 7 days, then age out.
- The security audit log stays. It holds ids rather than names.
Your rights
You can ask for a copy of your data, and ask us to correct it, erase it, restrict it or stop using it where we rely on legitimate interests. Where you gave consent, you can withdraw it. If a client holds your data as controller, an admin there can search for you, export what is held and erase it from their settings. Accounting records may have to stay, in which case your name is removed and the amounts remain. You can complain to the Information Commissioner’s Office, and we would welcome the chance to put it right first.