Sub-processors.
In force from 16 September 2026
The short version
Two providers, and this is the complete list. Cloudflare runs the service and holds all of its data. Resend sends its email, from the United States.
An AI assistant connected over MCP is the account holder's own tool, not a sub-processor. Reasonable notice is given before one is added or replaced.
This summary is here to be read. The clauses below are what actually binds.Board Badger runs on two providers, each receiving only the data it needs to do its job. This is the complete list.
Cloudflare, Inc.
What it does: Workers for hosting and compute, D1 as the
database, R2 for files attached to tasks, KV for OAuth clients and tokens, Durable Objects for the MCP connection, and
Turnstile for bot protection on sign up and sign in, once switched on.
Data handled: All service data: the account, its boards, their tasks,
comments and files, and the membership records of the people invited to them.
Where: Served from Cloudflare's global network.
Resend, Inc.
What it does: Sends the invitation to a board, notices when a
task moves or a comment lands, and account notices such as a password reset.
Data handled: The recipient's email address and the content of the
email, which names the board and the task it is about.
Where: United States, under Resend's own safeguards.
What is not on this list
An AI assistant connected over MCP, Claude included, is the account holder's own tool under their own agreement with that provider, and is therefore not a sub-processor imposed by the Operator. There is no advertising or analytics provider anywhere in Board Badger, and no payment processor, because Board Badger takes no payments.
Changes
This page is updated whenever the list changes, with reasonable notice before a sub-processor is added or replaced. Questions should be sent to privacy@boardbadger.com.
Ask, and the wording gets fixed rather than explained.