Version of 31 October 2026

Legal documents (English summary)

Who we are

BoardAct is currently published and provided by Yvan Dervillier, a natural person (contact and website host in the legal notice), on behalf of a French company being formed (article L210-6 of the French Commercial Code). Yvan Dervillier remains personally bound by every commitment until the company, once registered, formally takes it over; customers are told in writing when this happens. The company details will be published once it is registered. BoardAct sells hosting of the BoardAct application (one isolated instance per customer at <name>.boardact.com), support and consulting. The BoardAct software itself is open source (Apache 2.0 licence planned), provided “as is”, without support or sale.

Terms of use and terms of sale

• Terms of use (CGU): rules for boardact.com and the hosted spaces; self-hosted installations are governed by the open source licence only.
• Terms of sale and service (CGV), for professional customers only:
  • 30-day free trial, with no automatic cut-off at the end.
  • Prices on quote (number of spaces and users, support, onboarding, term), in euros excluding VAT, paid by bank transfer within 30 days; late-payment interest, a €40 flat recovery fee and, on proof, any higher recovery costs. Nothing is invoiced before the company is registered.
  • Service level: best efforts, stated honestly. Today the spaces run on a single Kubernetes node in one zone of the Paris region, with continuous backups; there is no automatic failover. Recovery objectives are published but not contractual.
  • Liability for direct, certain and foreseeable damage, capped at the higher of the fees paid over the previous 12 months or €1,000, except for fraud, gross negligence, bodily injury and other cases where the law forbids a cap.
  • Switching and data export under the EU Data Act (articles 23 to 31): notice of at most two months, transition of up to 30 days, at least 30 days to retrieve your data, free of charge, then deletion and purge of backups within 37 days. What can be exported, and in which formats, is listed in the register of exportable data.
  • French law. For disputes, Paris courts apply only where both parties are merchants; otherwise ordinary jurisdiction rules apply. The French documents govern.

Privacy

Privacy policy (French). BoardAct is the controller for its website, the trial form, the business relationship, e-mail exchanges and platform security. It is the processor for the content of customer spaces. The website sets no cookie and uses no tracker; the trial form, when open, loads Cloudflare Turnstile to block abuse. Transactional e-mails sent through Brevo are measured anonymously (opens and clicks counted in aggregate, not linked to the recipient) to check delivery; one-time links are shown as plain text and not rewritten. You can exercise your GDPR rights at [email protected] and lodge a complaint with the French data protection authority (CNIL).

Data processing agreement

DPA (French), article 28 GDPR, part of every contract without separate signature. Key points: personal data breach notified to the customer without undue delay and within 48 hours at the latest; 30 days’ notice before any new sub-processor, with a right to object and terminate; audits and inspections allowed, normally once a year with 30 days’ notice, sooner after an incident or at an authority’s request; deletion at the end of the contract. Sub-processors: Google Cloud Platform and Google Workspace via Google Cloud France, Paris (hosting in the Paris region, backups in the EU; possible transfers to Google affiliates outside the EEA covered by standard contractual clauses or the Data Privacy Framework), Cloudflare (DNS, proxy, TLS; global network, standard contractual clauses and EU-U.S. Data Privacy Framework), Brevo (transactional e-mail, EU); Google Workspace is used for the boardact.com mailboxes. Technical and organisational measures are mapped, for information only, to ISO/IEC 27001:2022 Annex A controls. BoardAct is not certified to ISO/IEC 27001; this mapping is neither a declaration of conformity nor an audit report.

AI charter

AI charter (French). BoardAct’s register, scores and priorities do not use any AI model. We never train any model on your data and send none of it to an AI provider. In its hosted configuration for customers, BoardAct enables no AI model. An optional visual suggestion feature exists in the self-hosted software, off by default; its classification and each party’s obligations depend on how it is enabled and made available, and we review article 50 of the EU AI Act before any commercial activation. AI agents are used only in BoardAct’s internal spaces, never on customer spaces. Our practices are mapped, for information only, to ISO/IEC 42001 Annex A; BoardAct is not certified.

Security and vulnerability disclosure

Security page (French). One application instance and one SQLite database per customer in a dedicated Kubernetes namespace, network policies between customers, admission policies, images pinned by digest, continuous encrypted-in-transit backups to Google Cloud Storage in the EU (point-in-time restore over the last 24 hours, written today with the node’s shared service account; a per-space backup identity is in progress), TLS, admin access only through a private VPN, application and infrastructure changes reviewed by the founder, with automated checks (tests, secret scanning), before merge (space provisioning requests are merged automatically after CI). Report vulnerabilities to [email protected] (security.txt): acknowledgement within 3 business days, 90-day default disclosure window, safe harbour for good-faith research.

Contacts

• General and sales: [email protected]
• Support: [email protected]
• Security: [email protected]