Privacy Policy

This Privacy Policy explains how BOLD BLACK, LLC, a Florida limited liability company (Bold Black, we, us, or our), collects, uses, discloses, and retains personal information when it operates Corkboard at corkboard.wiki and app.corkboard.wiki (the Service).

1. Who we are and the scope of this policy

Bold Black operates Corkboard. You can contact us at hello@corkboard.wiki.

This policy applies to the public Corkboard website, the authenticated application, the HTTP API, the Model Context Protocol (MCP) server, and related support and billing interactions.

Our privacy role depends on the data:

• For account, subscription, billing-status, public-website, and direct support data, Bold Black determines why and how the data is processed. Under the General Data Protection Regulation (GDPR), Bold Black acts as the data controller for this data.
• For pages, media, page revisions, and other content within a Customer Organization (Workspace Content), the Customer normally determines why and how the data is processed. Under the GDPR, the Customer acts as controller and Bold Black acts as its processor. We process Workspace Content on the Customer’s instructions to provide the Service.

If you use Corkboard through an employer or another organization, that Customer’s privacy notices and instructions also apply. Questions or requests about personal information in Workspace Content should normally go first to the Customer that controls the Organization.

2. Information we collect

2.1 Account and authentication data

Auth0, an Okta service, provides identity and authentication functions. We receive and store your name, email address, and Auth0 authentication identifier. Bold Black does not store account passwords.

2.2 Organization and subscription data

We collect Organization names, membership and role information, plan selection, subscription status, renewal information, and related administrative settings. Stripe handles payment-card data. We store the subscription state needed to provide and manage the plan. A Stripe customer record is not created until the Organization makes its first payment.

2.3 Workspace Content

We process the pages, Markdown, media, page revisions, metadata, and other material that users, integrations, and authorized agents create or submit. A Workspace is the content boundary that owns its pages, media, and page revisions.

2.4 Usage-metering data

We collect API-call counts per Organization, event types, and timestamps. We use this information to measure use and enforce plan limits. A daily process prunes usage-metering events after 13 months.

2.5 Support and communications data

We collect information that you include in support requests or other communications with us. This can include your contact details, the message, and information needed to investigate the request.

2.6 Public-website analytics

Google Tag Manager may load on public marketing pages, such as landing and pricing pages, when it is configured. It is not loaded in the authenticated application. Google Tag Manager and tags configured through it may collect browser or interaction information as described in the notice or consent interface on the public page.

3. How we use information

We use personal information to:

• create and administer accounts, Organizations, and Workspaces;
• authenticate users and authorize users, integrations, and agents;
• host, store, revise, transmit, search, and retrieve Workspace Content;
• provide the web dashboard, HTTP API, and MCP server;
• measure API use and enforce plan quotas and hard limits;
• manage subscriptions, payments, renewals, upgrades, downgrades, and cancellations;
• provide support and communicate about the Service;
• detect, prevent, and investigate fraud, abuse, security incidents, and technical problems;
• maintain, analyze, and improve the reliability, security, and functions of the Service;
• comply with law and enforce our Terms of Service; and
• operate public-website analytics when configured and permitted.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as “sharing” is defined by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). We do not place advertising in the authenticated application.

4. Legal bases under the GDPR

Where the GDPR applies, we rely on these legal bases:

When Bold Black acts as a processor for Workspace Content, the Customer determines the applicable legal basis. We process that content under the Customer’s instructions and our agreement with the Customer.

5. Semantic search and AI-related processing

Semantic search is available on the Pro and Team plans. When a page is saved on one of those plans, the Service sends chunks of Markdown from the page to the OpenRouter embedding API. OpenRouter uses the qwen3-embedding-8b model to create vector embeddings. We store the vectors with the page and use them to support semantic search. Indexing is best-effort and can be delayed, incomplete, or unavailable.

The Free plan never sends page content to OpenRouter for embedding. Full-text keyword search, which uses PostgreSQL, is available on all plans and does not require this embedding process.

The current plans and the semantic-search limits are:

The paid annual prices include a 20% discount compared with paying the monthly price for 12 months. New Organizations receive a 14-day Pro trial with 50 semantic searches per month. No credit card is required for the trial. The trial also includes 100 pages, 10,000 API calls per month, 5 GB of media storage, 1 Workspace, and a 256 KB maximum page body. At trial expiry, the Organization moves to the Free plan unless it subscribes. Existing content is not deleted solely because the trial ends, but writes that exceed a Free-plan limit are blocked.

6. How we disclose information

We disclose information only as needed for these purposes:

• Service providers and subprocessors. We use the providers in Section 7 to operate the Service.
• Customer administrators. Organization Owners and other authorized administrators can access account, membership, usage, and Workspace information under their permissions.
• Customer-authorized users, integrations, and agents. We process and disclose information as directed by Customer through Workspace permissions, the HTTP API, OAuth grants, and the MCP server.
• Legal and safety needs. We may disclose information when reasonably necessary to comply with law or valid legal process, protect rights or safety, investigate abuse, or secure the Service.
• Business transactions. We may disclose information in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections.
• With consent. We may disclose information for another purpose when the person or Customer that controls it gives valid consent or instruction.

We may use and disclose information that has been aggregated or de-identified so that it does not identify a Customer or individual.

7. Service providers and subprocessors

The following providers support the Service. A provider processes only the information needed for its function, subject to its terms and our arrangements with it.

8. Cookies and similar technologies

The Service uses cookies or similar browser storage needed for authentication, session continuity, security, and user settings. These technologies are necessary to operate the authenticated application.

Google Tag Manager may load on public marketing pages when configured. Where law requires consent for non-essential analytics, the applicable public page will request it. Google Tag Manager is not loaded in the authenticated application. We do not use the authenticated application for cross-site advertising tracking.

You can control cookies through your browser and any consent controls that we provide. Blocking necessary cookies can prevent authentication or other Service functions.

9. Data retention

We keep personal information only for as long as needed for the purposes in this policy, including to provide the Service, meet legal duties, resolve disputes, and enforce agreements. The following specific rules apply:

• Usage-metering events, consisting of API-call counts per Organization, event type, and timestamp, are pruned after 13 months by a daily process.
• For each page, the Service keeps the newest 25 page revisions, subject to an aggregate cap of 5,000 page revisions per Organization.
• Superseded media revisions remain until they are reconciled or pruned.
• Account data is retained until account deletion, and longer where needed for legal, security, fraud-prevention, or recordkeeping duties.

After a verified deletion request, we remove account data and Workspace Content from active systems within 30 days, except where longer retention is needed for legal, security, fraud-prevention, or recordkeeping duties. Backup copies are purged as backup cycles expire; we do not promise a fixed backup deletion date.

A Customer can apply shorter retention to information that it controls by deleting content through available Service functions, subject to revision, backup, legal, and technical retention. We do not promise a deletion time except as stated here or in a separate written agreement.

10. Data location and international transfers

Fly.io hosts the application and Fly Managed Postgres database in the United States. Other providers in Section 7 can process information in the United States or other countries where they operate.

If personal information is transferred from the European Economic Area, United Kingdom, or Switzerland to a country that is not recognized as providing adequate protection, the controller responsible for the transfer must use a lawful transfer mechanism and any required supplementary measures. Depending on the processing relationship, this can include standard contractual clauses or another mechanism permitted by law.

On reasonable request, Bold Black offers a Data Processing Addendum that incorporates standard contractual clauses or another approved transfer mechanism. Contact hello@corkboard.wiki.

11. Security

We use technical and organizational measures designed to protect personal information. These include TLS encryption for data in transit, encrypted secrets, access controls, Workspace-scoped permissions, and OAuth-based authentication. Auth0 handles identity authentication, and Bold Black does not store passwords.

No security measure is perfect. We cannot guarantee absolute security. Customer is responsible for configuring permissions, protecting sessions and tokens, controlling its users and agents, and keeping independent backups.

12. Your privacy rights

Rights depend on where you live, the type of information, and Bold Black’s role. We may verify your identity and authority before acting on a request. Legal exceptions can apply.

12.1 European privacy rights

Where the GDPR or a similar law applies, you may have the right to:

• access your personal information;
• correct inaccurate or incomplete information;
• request deletion;
• restrict processing;
• receive portable data;
• object to processing based on legitimate interests;
• withdraw consent at any time for future processing where we rely on consent; and
• complain to your local data-protection authority.

If Bold Black processes Workspace Content for a Customer, submit your request to that Customer first. We will assist the Customer as required by applicable law and our agreement with it.

12.2 California privacy rights

If the CCPA/CPRA applies, a California resident may have the right to:

• know the categories and specific pieces of personal information collected, used, and disclosed;
• request deletion of personal information;
• request correction of inaccurate personal information;
• receive personal information in a portable format; and
• receive equal service and pricing without discrimination for exercising a privacy right.

Bold Black does not sell personal information and does not share personal information for cross-context behavioral advertising. We therefore do not offer a sale-or-sharing opt-out for the authenticated Service. An authorized agent may submit a request where California law permits, subject to verification of the agent’s authority and the resident’s identity.

For Workspace Content, Bold Black generally processes data as the Customer’s service provider or contractor, as those terms are defined by the CCPA/CPRA. The Customer is responsible for responding to consumer requests, and Bold Black will assist as required.

12.3 How to make a request

Email hello@corkboard.wiki with the subject “Privacy Request.” Describe your request and the account or Organization involved. Do not send a password, full payment-card number, or other unnecessary sensitive information. You may appeal a refusal where applicable law gives you that right by replying to our decision.

13. Children’s privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from a child under 13. Where local law requires parental consent for a person under 16 to use an online service, that person must not use the Service without valid consent from a parent or guardian. Contact us if you believe a child provided personal information without required consent.

14. Changes to this policy

We may update this policy as the Service or law changes. If a change materially affects privacy rights or how we use personal information, we will give reasonable advance notice by email, in the Service, or on our website where practicable. The effective date at the top identifies the current version. Continued use of the Service after the effective date is subject to the updated policy, but we will request consent if law requires it.

15. Contact

For privacy questions or requests, contact:

BOLD BLACK, LLC
hello@corkboard.wiki

Terms of Service →