We collect what we need to score, verify and contact you, and we say what that is.
Data is stored in access-controlled cloud infrastructure in the United States (database and evidence storage hosted on Supabase; email via our transactional and CRM providers). Evidence is visible only to the assigned reviewer, the certification officer and AboveBoard administrators bound by confidentiality. We share personal data only with processors under contract, with your firm's designated contacts, when required by law, or in a business transfer. Registry fields (firm, industry, location, level, score, dates, status) are public by design once a firm is verified.
Snapshot and contact data: until you ask us to delete it or three years after last contact. Assessment answers, evidence and findings: the verification period plus three years. Registry history: twelve months after expiry, suspension or revocation.
You may request access to, correction of, or deletion of your personal data, and withdraw marketing consent at any time, by writing to privacy@aboveboardai.com. Residents of states with privacy laws (including California, Colorado, Connecticut, Virginia and Texas) may exercise the rights those laws provide; we do not sell or share personal data for cross-context behavioral advertising.
Encryption in transit and at rest, role-based access, private storage buckets, logging, and least-privilege database access enforced at the database layer. No method is perfect; report concerns to security@aboveboardai.com.
The service is for businesses and is not directed to anyone under 18.
We post changes here with a new effective date and notify engaged firms of material changes by email.
AboveBoardAI, LLC · Atlanta, Georgia · privacy@aboveboardai.com