MasterBoard — Privacy Policy
DRAFT, not legal advice, must be reviewed by a qualified lawyer before use. First draft written 2026-10-19 from the product as it is built today. Every item marked [OWNER: …] is a commercial or legal decision that is not made yet.
Version: draft 0.3 · Last updated: 2026-10-25 (section 6: fonts and script libraries are now served by MasterBoard itself, no third-party request; 0.2 on 2026-10-22 added AI360 Copilot and Participant Data Insights; still a draft — owner/legal review needed)
Factual corrections 2026-10-26 (round 8: B2492 kiosk rejoin cookie in section 6, B2493 Org Watch retention row, B2528 Mermaid removed from the library list). The Version line is left unchanged on purpose (a new version makes every user accept again, B2475) — [OWNER/LAWYER: decide whether these corrections need a new version.]
1. Who this policy covers, and our role
This policy explains what personal data MasterBoard handles and why. It applies to:
- Users — people who sign in to MasterBoard (Customer staff and our own staff);
- People in the Customer's Genesys Cloud data — mainly contact-centre agents and supervisors (names, user IDs, queue membership, status and performance figures) and the phone numbers of callers, in hashed form plus a masked display form only;
- People in conversations the Customer chooses to summarise with AI360 Copilot — callers and agents whose interaction text is processed when that optional feature is switched on (section 2).
For data that comes from a Customer's Genesys Cloud organisation, the Customer is the controller and we are its processor; the Data Processing Agreement (DPA) governs that processing. For our own account administration and security logs of Users, [OWNER/LAWYER: confirm whether the Provider is controller, or processor on behalf of the Customer].
Provider: [OWNER: legal entity, address] · Privacy contact: [OWNER: email] · Data protection officer: [OWNER: name/contact, or a statement that none is required].
2. What we collect
About Users
| Data | Why | How long |
|---|---|---|
| Email, display name, role, workspace membership | To create and manage your account and its access | As long as the account exists; deleted when the account is deleted |
| Password | To sign you in | Stored only as a salted hash, never in readable form |
| Microsoft Entra tenant ID and object ID (only if you sign in with Microsoft) | To recognise your Microsoft account at later sign-ins | As long as the account exists; deleted when the account is deleted |
| MFA secret and backup codes (if MFA is on for you) | Two-step sign-in | Secret stored encrypted, backup codes stored hashed; removed when MFA is reset |
| Session data: network (IP) address and browser family at sign-in | To keep you signed in and detect a stolen session | A session ends at the latest 12 hours after sign-in; its server-side file is deleted within 48 hours (twice the 24-hour session lifetime) |
| Security audit trail: sign-ins (successful and failed), role and access changes, password and MFA changes, with your IP address | Security and accountability | 365 days by default (minimum 30) |
| Request log: page or action requested, result, timing, organisation and user ID | Operating and troubleshooting the service | 90 days by default |
| Usage events: pages and features used, with organisation, user ID and request ID | Knowing which features are used, to improve the product | 90 days by default |
From the Customer's Genesys Cloud organisation
| Data | Why | How long |
|---|---|---|
| Configuration (queues, flows, skills, users and their names, groups, schedules, etc.) | Audits, dashboards, configuration management | Cached and refreshed on request; removed when the Customer is offboarded |
| Analytics figures (volumes, handle times, service levels, agent status and activity) | Reports, dashboards, wallboards | Cached; removed when the Customer is offboarded |
| Caller number (ANI) and dialled number (DNIS), for repeat-contact analysis | Measuring repeat contacts | Stored as a salted one-way hash with a per-organisation secret salt, plus a masked display form that keeps only the first 3 and last 2 digits (for example +336••••••45) — never the full number; 365 days by default |
| Org Watch (optional add-on): Genesys operational events — event type, error code, the affected object's ID and name (which can be a user's name), its previous and current value, conversation ID — and daily counts of API errors and flow failures | Showing the health of the Genesys organisation over time | 366 days (at most 50,000 events per organisation); removed when the Customer is offboarded |
| Genesys configuration-change history (who changed what) | Change history beyond Genesys's own 14-day window | 366 days |
| Audit reports produced by MasterBoard | The Customer's deliverables | Until the Customer is offboarded; then archived and deleted after 30 days |
| Participant Data Insights: patterns of the participant data the Customer's flows write on conversations (personal attributes counted only as set / empty; other values with IDs, dates, numbers, e-mail addresses, phone numbers and web addresses replaced), up to 3 example conversation IDs per pattern, outcome counts | Showing which flow data leads to which outcome | The last 5 finished runs per organisation and division; removed when the Customer is offboarded |
AI360 Copilot (optional, off unless the Customer turns it on)
AI360 is an opt-in add-on, enabled per Customer workspace. When a User with the Operator or Admin role asks for it, Copilot reads the text of one ended interaction from Genesys Cloud (chat or message text, e-mail text, or the voice transcript made by Genesys Speech & Text Analytics), or text the User pastes, and asks a language model for a summary and a suggested wrap-up code.
- Before the text is sent, e-mail addresses, phone numbers, IBANs and payment-card numbers are replaced by tags. Names and other free text are not removed.
- Which model receives it: by default a model running on the MasterBoard host itself (Ollama), so the text does not leave our host. A Master Admin can instead set, per workspace, the Customer's own or another provider's endpoint (an OpenAI-compatible service such as Azure OpenAI or Mistral, or Anthropic). That provider then receives the redacted text and is a sub-processor (DPA Annex 3). A workspace with no setting of its own uses the setting of our own (Master) workspace. There is no automatic fallback to another provider.
- What is stored: the model's answer (reason, resolution, follow-up, summary, suggested wrap-up code), the agent's real wrap-up code, queue name, conversation ID, the User who ran it and their feedback; and, per model call, the model, token counts, duration, cost and the number of items redacted. The interaction text and the prompt are not stored.
- How long: the stored results (table
ai360_suggestions) and model-call records (ai360_traces) are deleted after 90 days by default (checked once a day), and earlier when the organisation is offboarded; results made without a connected organisation are also deleted when their workspace is deleted. - An API key for an external provider is stored encrypted.
What we do not collect. MasterBoard does not store call recordings, or the text of call, chat, e-mail or message conversations (AI360 Copilot reads that text for one interaction at a time when a User asks for it, and stores only the AI summary described above). It does not use advertising or analytics trackers.
3. Legal basis
[OWNER/LAWYER: confirm.] Draft position: for Customer data, the Customer's instructions under the DPA (Art. 28 GDPR); for User accounts and security logs, performance of the contract with the Customer and our legitimate interest in running a secure service (Art. 6(1)(b) and (f) GDPR).
4. Who can see the data
- Users of the same Customer workspace, according to their role and the organisations their Admin allows them to see. Other Customers cannot see it.
- Our own staff, to provide service, support and consulting to the Customer.
- Our sub-processors, listed in the DPA.
- The language model chosen for AI360 Copilot, only when the Customer has turned AI360 on: the local model on our host by default, or the external provider set for the workspace, which is then listed as a sub-processor in the DPA (section 2). Without AI360 the application sends no data to an AI service.
- AI tools used by our staff: [OWNER: state the policy — whether Customer personal data may ever be shown to an AI tool our staff use to build or operate the service, and which ones; see DPA Annex 3.]
- Authorities, only when the law requires it.
A Demo Mode replaces real names with aliases when screens are shared. We do not sell personal data.
5. Where the data is stored
MasterBoard always runs on infrastructure we operate; it is never installed inside a Customer's environment. Today the application and its database run on a single host operated by us in [OWNER: country / data centre / hosting provider]. All Customer data MasterBoard stores is kept on that host. Storing a Customer's data in a database the Customer hosts is planned and not available today [DRAFT — OWNER/LAWYER: review before publishing; do not offer it until it is built]. Genesys Cloud data stays in the Genesys region the Customer chose; MasterBoard reads it from there.
Transfers outside the EEA: [OWNER/LAWYER: list any, with the safeguard used (adequacy decision or standard contractual clauses)].
6. Cookies and similar technology
- One session cookie, needed to keep you signed in. It holds only a signed session identifier, is not readable by page scripts, and is sent only over HTTPS in production.
- On a TV / wallboard screen opened through a kiosk link only: a second, functional cookie,
mb_kiosk_rejoin, so the screen signs back in by itself after its session is lost. It holds the kiosk link's access code, is not readable by page scripts, is sent only to the rejoin address and lasts as long as the link (up to 400 days for a link that never expires). It stops working when the link is revoked or expires. No person signs in on such a screen. - Your browser's local storage keeps display preferences (for example the colour theme). It never leaves your browser.
- Fonts and script libraries (charts, flow diagrams, screenshot export) are served by MasterBoard itself. Pages make no request to Google Fonts, a content-delivery network or any other third party, so no such service sees your IP address. Files you download from MasterBoard (for example a flow diagram or a flow documentation report) carry these libraries inside the file and make no third-party request either.
No consent banner is used because both cookies are strictly necessary and no non-essential cookies are set. [LAWYER: confirm.]
7. Security
Encryption of stored Genesys credentials and MFA secrets, hashing of passwords and phone numbers, role-based access on the server, multi-factor authentication, session limits, CSRF and content security policy, an application firewall, and an audit trail. A detailed description is available to Customers on request.
8. Your rights
You can ask for access to, correction or deletion of your personal data, restriction of or objection to its processing, and data portability. Where the Customer is the controller, we pass your request to the Customer and help it answer. You can also complain to your data-protection authority. [OWNER: name the lead supervisory authority, and the response time we commit to.]
9. Breaches
If we become aware of a personal-data breach affecting Customer data, we tell the Customer without undue delay so it can meet its own 72-hour duty under Art. 33 GDPR. Details are in the DPA.
10. Changes
We will publish any change here with a new date. [OWNER: how Users and Customers are told about material changes.]