Privacy Policy
Last Updated: October 12, 2026
This policy explains what personal data Soado Boards collects, why, who receives it, how long it is kept, and what you can do about it.
Who We Are
Soado Boards is operated by montoyer.be, rue Montoyer, Brussels, Belgium. montoyer.be is the data controller for the personal data described here.
Privacy questions and requests: [email protected]
Who This Policy Covers
- Board owners: people who create an account and a board.
- Contributors: people who post a message on a board, with or without an account.
- Visitors: people who open a board or browse the website.
What We Collect
Account data
When you create an account we store your email address, a hashed version of your password (we never store the password itself), the date the account was created and the date of your last login. If you fill them in, we also store your organization name, tagline, logo and time zone.
Board content
For each board we store its title, description, appearance settings and options. For each message we store the text, the name or signature entered, the photo if one was uploaded, the date, and the reactions it received.
A board owner sees every message on their board, including messages they have hidden. Messages and photos can contain personal data about the people who write them and about the person the board is for.
The identifier cookie
When you first visit the site we place a cookie containing a random identifier. It does not contain your name or email. We use it to:
- link the messages you posted before signing up to the account you create later, so you can edit them;
- count returning visitors in our statistics.
Visit statistics
We keep our own log of visits: the page opened, the date and time, the page you came from, your browser type, the identifier described above, and a keyed one-way hash of your IP address. On boards we also record actions such as a message being posted or a reaction added.
Board owners can see statistics and an activity log for their own board. These show what happened, not who did it: owners do not receive visitor identifiers, IP data or the email addresses of visitors.
Security records
To limit password guessing and abuse, we record the IP address behind failed logins, sign-ups and account checks. These records are short-lived and are normally deleted within days.
Why We Use It
| Purpose | Legal basis |
|---|---|
| Providing accounts, boards, messages and display modes | Performance of our agreement with you |
| Linking earlier messages to your account | Our legitimate interest in letting you manage what you wrote |
| Statistics, and fixing and improving the service | Our legitimate interest in understanding how the service is used |
| Preventing abuse, spam and unauthorized access | Our legitimate interest in keeping the service secure |
| Answering legal requests | Legal obligation |
We do not sell personal data, and we do not use it for advertising.
Who Can See Board Content
Boards are shared by link. Anyone who has a board's link can read its published messages and, while the board is open, add one. Do not post anything you would not want every person with the link to see.
Boards are not listed in a public directory and we ask search engines not to index them. The only boards we show publicly are the example boards on our demo page, which we set up ourselves.
A board owner can choose to make the statistics page of their board public. That page shows totals only.
Service Providers
We use a small number of providers to run the service. They receive only what they need for their task.
| Provider | Role | What it receives |
|---|---|---|
| OVH | Hosting of the website and database, in the European Union | Everything stored by the service |
| Simple Analytics | Website statistics | Pages visited, referring site, browser type |
| Ahrefs Web Analytics | Website statistics | Pages visited, referring site, browser type |
| Cloudflare | Delivery of some scripts, and routing of email sent to our addresses | Your IP address when a script is loaded; emails you send us |
According to these two statistics providers, their tools work without cookies. Because they record page addresses, they receive the addresses of the boards that are opened, though not the messages on them.
Our home page also displays badges loaded from shipit.buzz and startupfa.me, which see your IP address when the image loads.
Some providers may process data outside the European Economic Area. Where that happens, we rely on the safeguards the provider offers under EU law, such as standard contractual clauses.
We may also disclose data when the law requires it, or to defend our rights or the safety of our users.
Cookies and Browser Storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
| PHPSESSID | Cookie | Keeps you logged in, protects forms against forgery, remembers your reactions during a visit | Until you close your browser |
| soado_vid | Cookie | The identifier described above | Up to 10 years |
| Display preferences | Browser storage | Remembers slideshow style, speed and whether the QR code is hidden | Until you clear your browser data |
We do not use advertising cookies. You can delete these cookies in your browser at any time. If you delete the identifier cookie before signing up, earlier messages can no longer be linked to your account.
How Long We Keep Data
- Accounts: for as long as the account exists. We may delete accounts that have been inactive for more than two years.
- Boards: until the owner deletes the board or the account is deleted. Deleting a board immediately removes its messages, photos, reactions and statistics.
- Messages: until the board owner or the author deletes them, or the board is deleted.
- Visit statistics: board statistics are deleted with the board. Our general visit log is kept while the service operates; it holds no names, emails or full IP addresses.
- Security records: normally a few days.
- Backups: deleted data can remain in backups for a limited time before being overwritten.
Your Rights
Under the EU General Data Protection Regulation you can ask us to:
- give you a copy of your data;
- correct data that is wrong;
- delete your data;
- restrict or object to our use of it, including for statistics;
- give you your data in a portable format.
Some of this you can do yourself. With an account you can edit the messages linked to it and delete them. Board owners can edit and delete their boards and messages, and export a board to PDF.
For everything else, write to [email protected]:
- Deleting your account. There is no self-service button yet. Write to us from the account's email address and we will delete the account, its boards and their content within 30 days.
- A message you posted without an account. Ask the board owner to remove it, or write to us with the board link and the name you signed with.
- A message or photo about you posted by someone else. Write to us with the board link.
- Lost access to your account. We do not send automatic emails, including password resets. Write to us from the account's email address.
We answer within one month. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), or with the authority of the country where you live.
Security
Passwords are stored as salted hashes. Data travels over an encrypted connection (HTTPS). Uploaded photos are checked and re-encoded before being stored. Access to administrative tools is limited to us.
No system is perfectly secure. If a breach affects your data, we will inform you as the law requires.
Children
The service is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
Changes to This Policy
We will update the date at the top when this policy changes. When a change is significant, we will announce it on the website before it takes effect.
Contact
montoyer.be, rue Montoyer, Brussels, Belgium
Privacy requests: [email protected]
General questions: [email protected]