Legal

Privacy Policy

Effective 3 November 2026 · Applies to the EB website and application

EB is in a private pilot. This policy describes how the service works today and will be reviewed by qualified legal counsel before general availability. Material changes will be notified to account holders.

1. Who we are

EB (“Executive Board”, “EB”, “we”, “us”) provides a business operating system with an AI executive board for founder-led businesses. For personal data you give us to run your account, we act as the data fiduciary. For personal data inside the business records your company enters (for example, customer or employee details), your company decides why that data is processed, and we process it on your company's behalf.

We aim to comply with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, and the rules made under them.

2. What we collect

Account information

Your name (if provided) and email address.
Your password, stored only as a one-way bcrypt hash. We cannot see or recover it.
The companies you belong to and your role in each (for example, owner or viewer).

Business records you enter

Company profile: name, industry, description, website, reported monthly revenue and expenses, and goals.
Accounting data: chart of accounts, journal entries, expenses, reversals and their reasons.
Customers and invoices: customer names and contact details, line items, amounts and tax rates.
Goals and tasks you create.
Questions you put to the executive board.
Your company's city and, only if you choose to share it, an approximate location (rounded to about 1 km). It is used to find nearby sellers and buyers; other businesses only ever see a rough distance, never your location. When you share it, your browser looks up the city name from OpenStreetMap.

Technical information

Session cookies needed to keep you signed in (see section 7).
Standard request logs (such as IP address, time and requested page) kept by our hosting provider for security and reliability.

We do not use advertising trackers or third-party analytics, and we do not sell personal data.

3. How we use it

To provide the service: sign-in, showing your company's records, and producing board recommendations.
To keep each company's data separate and only visible to its members.
To secure the service, prevent misuse and investigate problems.
To communicate with you about your account and material changes to the service.
To meet legal obligations.

4. The AI executive board

When you ask the board a question, EB prepares a package containing your question, your company profile and, when the CFO is involved, a read-only summary of your posted accounting records, invoices and recorded payroll. When AI processing is enabled for your workspace, this package is sent to our AI provider (OpenAI) to generate the executives' assessments and The Crown's recommendation.

Only data from the company you selected is included. Data from other companies is never mixed in.
We do not use your business records to train AI models. Our provider's API terms state that API data is not used for training by default.
In the current pilot, board recommendations are kept in your browser tab and are not saved to our database.
AI output can be wrong. It is decision support, not professional advice.

We use a small number of service providers, each bound by their own data-protection terms:

Vercel: application hosting.
Neon: managed PostgreSQL database.
OpenAI: AI processing for board consultations, when enabled.
Google Fonts: web fonts used on our pages. Your browser requests them directly from Google, which receives your IP address.

We may disclose information if required by law or to protect the rights, safety and security of our users and the service.

6. Where data is stored

The application and database are hosted in Singapore. AI processing may take place in other countries where our provider operates. We transfer data outside India only as permitted under applicable law.

7. Cookies and browser storage

Sign-in cookies (strictly necessary): keep you signed in and protect forms against cross-site request forgery.
Selected company: the ID of the company you last selected is stored in your browser so pages open on the same company. It contains no business records.

We do not use advertising or analytics cookies.

8. How long we keep data

We keep account information and business records for as long as your company's account is active. When an account is closed, we delete or anonymise its data within a reasonable period, unless we must keep certain records to comply with law (for example, financial record-keeping requirements). Accounting entries are never silently edited; corrections are recorded as reversals so the audit trail stays complete.

9. Security

Encrypted connections (HTTPS/TLS) between your browser, the application and the database.
Passwords stored only as bcrypt hashes.
Server-side checks on every request so users only reach companies they belong to.
Owner-only permissions for changes to company records.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.

10. Your rights

Subject to applicable law, you can ask to:

access a summary of the personal data we hold about you;
correct or update inaccurate data;
erase your personal data, where we are not required to keep it;
withdraw consent where processing is based on consent;
nominate someone to exercise these rights on your behalf; and
raise a grievance with us, and then with the Data Protection Board of India if it is not resolved.

You can change your password at any time on the My account page. For other requests, contact the EB team through your account representative. A dedicated privacy contact and grievance officer will be published here before general availability.

11. Children

EB is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children.

12. Changes and contact

We may update this policy as the service develops. We will change the effective date above and notify account holders of material changes. Questions about this policy can be raised with the EB team through your account representative.