Boardy AI Privacy Summary

The one thing to know: your brief can travel further than your contact details

Contact details move only after both people opt in. The brief is different. Figures in your brief may be shared in introductions unless you mark them private, and public LinkedIn information can be used to build a matching profile. Mark anything sensitive as private before you send it. ^{[2] [3] [1]}

Calendar access is narrow on paper, and one account disagrees

The Privacy Policy says Boardy reads your calendar list, sees free and busy blocks only, with no titles, attendees or locations, and reads event details only on calendars you own. It writes to your calendar only for meetings Boardy books or is asked to manage. It says it never requests contacts, Gmail or Drive. ^[1]

One user reports a meeting on her calendar that she did not ask Boardy to book, and she told it to stop. That conflicts with the written limit, and it is a single account. Check your Google permissions and the events Boardy has written before you rely on the service. ^{[4] [1]}

AI processors see your conversations, and the training line is narrow

The Privacy Policy names OpenAI and Anthropic as AI processors that may handle your conversations, profile information, call transcripts, calendar event details and derived calendar insights. It mentions call transcripts but not call audio, so ask whether audio is recorded and kept. ^[1]

The only AI training line covers “proprietary business information without consent.” Personal data is not addressed, so ask privacy@boardy.ai in writing whether your personal data trains its models before you share a detailed brief. ^[1]

Ad platforms get data, and Google data stays out of ads

Meta and other ad platforms may receive data for targeted ads, lookalike audiences and retargeting. PostHog handles analytics and session replay on the website. The policy says Google user data is not used for advertising. ^[1]

Profile and matching data is kept while your account is active and for two years after deletion. Communication records are kept three years, and session replays up to 90 days. Calendar data stays until you ask for deletion. Enterprise periods are not stated. ^[1]

Impersonation: verify before you act

In December 2025, a human impersonator emailed one user for about a week, posing as Boardy from a different domain, and asked for a form or a call. An email address can be spoofed, so verify any request through Boardy’s official site or a channel you already know. Do not fill in a form or take a call that a message asks for. ^[5]

How to delete your data

1. Email privacy@boardy.ai with your deletion request.
2. Expect a response to rights requests within one month. The policy says deletion is handled “promptly,” with no set deadline.
3. Disconnect Google Calendar from Boardy.
4. Delete the events Boardy created yourself, because disconnecting does not remove them.
5. Ask for written confirmation of what was deleted and whether personal data was used for training. ^{[1] [4]}

Verdict: a fair test, with sensitive details kept out

Boardy is reasonable for a short test with a brief you would show a stranger at a conference. Leave out health, family and personal finances beyond business, and mark anything you would not want passed on as private. Hold the calendar until you have read the permissions.