Privacy Policy

Onboardl.io serves managed service providers and similar businesses ("Partners"). Partners use the Service to onboard their own customers ("Clients"), which involves Partners submitting information about their Clients and their Clients' personnel. Because of this, we handle personal information in two distinct roles:

Partner data — we act as the controller. For information about Partners and their team members (account details, billing, usage), we decide how and why it is processed, as described in this policy.

Client data — we act as a processor / service provider. For information Partners submit about their Clients (contact details, documents, messages, portal activity), we process it on the Partner's behalf and under the Partner's instructions. The Partner is responsible for that data and for any notices or consents their Clients may require. If you are a Client of one of our Partners and have questions or requests about your information, please contact the Partner (the company onboarding you) first. We will support our Partners in responding to such requests, and you may also contact us directly at support@onboardl.io.

Partner account information. Name, email address, password (stored as a secure hash), workspace and company details, branding assets you upload (logos, images, colors), and settings. If you sign in with Google or Microsoft, we receive basic profile information (name, email) from that provider.

Billing information. Payments are processed by Stripe. We receive and store subscription status, plan, and billing metadata; we do not store full payment card numbers on our systems.

Content submitted to the Service. Onboarding projects, templates, tasks, notes, messages, uploaded documents, and contact information for Client personnel that Partners add to the Service.

Portal activity.When a Client opens their onboarding portal, we record visit events — including timestamps and, where the portal link identifies a specific contact, which contact the visit is attributed to. This information is shown to the Partner (for example, "last visited 3 days ago") to help them run the onboarding. Portal visitors are not required to create accounts.

Usage and technical data. Log data such as IP address, browser type, pages viewed, and actions taken within the Service, used for security, debugging, and improving the Service.

Communications. Emails you send us (for example, to support@onboardl.io) and messages sent through the Service.

Cookies. We use cookies and similar technologies necessary to operate the Service — primarily authentication/session cookies and short-lived cookies that carry state through signup flows. We do not use third-party advertising cookies and we do not display ads.

We use information to: provide, maintain, and secure the Service; authenticate users and prevent abuse; process subscriptions and payments; send transactional emails (portal invitations, team invitations, reminders, digests, trial and billing notices); provide support; understand usage in order to improve the Service; and comply with legal obligations.

Transactional emails sent to Clients on a Partner's behalf display the Partner's name and route replies to the Partner. These emails are sent from our email infrastructure as part of providing the Service.

We do not sell personal information, and we do not use Partner Content or Client data for advertising.

We share information only with:

Service providers (subprocessors) that host and operate parts of the Service on our behalf: Supabase (database, authentication, file storage), Vercel (application hosting), Stripe (payment processing), Resend (transactional email delivery), Cloudflare (DNS and content delivery), and Google Workspace (business email for support correspondence). Each provider processes information only as needed to perform its function.

Within a Partner workspace, according to the Service's sharing model: information in a workspace is visible to that Partner's team per their roles, and information a Partner marks as client-facing (portal content, shared documents, external messages) is visible to anyone holding that Client's portal link.

For legal reasons, if required by law, subpoena, or to protect the rights, safety, or property of Onboardl.io, our users, or others.

In a business transfer, such as a merger, acquisition, or sale of assets, in which case this policy will continue to apply to previously collected information until updated.

We retain Partner account data for as long as the account is active. Content in a workspace is retained while the workspace exists, including through trial expiration and subscription lapses — we do not delete workspace data merely because a trial ended or a payment failed. When an account is closed or deletion is requested, we delete or de-identify associated data within a reasonable period, except where retention is required for legal, billing, or security purposes. Backups are purged on a rolling schedule.

We take reasonable technical and organizational measures to protect information, including encryption in transit, hashed passwords, workspace-level data isolation enforced at the database layer (row-level security), tokenized portal access with the ability to rotate links, and time-limited signed URLs for document downloads. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing. Partners can access and correct most account information directly in the Service, and can request account deletion or a data export by contacting support@onboardl.io. If you are a Client of a Partner, please direct requests to that Partner first (see Section 1); we will assist them in fulfilling valid requests.

We will respond to rights requests as required by applicable law. We do not discriminate against anyone for exercising privacy rights.

The Service is operated from the United States, and information is processed and stored in the United States (and other locations where our subprocessors operate). If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will provide notice through the Service or by email before the changes take effect. The "Last updated" date at the top reflects the latest revision.

onboardl.io LLC
support@onboardl.io

If you have a question, concern, or request regarding privacy, email us and we will respond as promptly as we can.