Boord-ITS ("we," "us," or "our") operates BITSM — Boord Information Technology Service Management, a multi-tenant B2B SaaS platform that provides AI-powered IT helpdesk and ticketing services to organizations (each a "Customer" or "Tenant").
This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use BITSM, and describes your rights with respect to that data. It applies to all users of BITSM, including tenant administrators, agents, and end users of Customer organizations.
If you are an employee or contractor of a Customer organization, your primary privacy relationship is with your employer (the Customer). We act as a data processor on the Customer's behalf for data submitted through the platform. See Section 8 for details.
Questions? Contact us at [email protected].
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing and operating the BITSM platform and its features | Performance of contract |
| Authenticating users and maintaining secure sessions | Performance of contract / Legitimate interest (security) |
| Processing support tickets and routing them to appropriate agents | Performance of contract |
| Powering the Atlas AI assistant (ticket analysis, triage, routing, audit) | Performance of contract / Legitimate interest (service improvement) |
| Monitoring API usage and enforcing per-tier cost caps | Performance of contract / Legitimate interest (billing accuracy) |
| Generating anonymized analytics and quality reports for Customers | Legitimate interest (product improvement) |
| Sending transactional notifications (ticket updates, invitations) | Performance of contract |
| Detecting and preventing security incidents, fraud, or abuse | Legitimate interest (security) |
| Complying with legal obligations | Legal obligation |
BITSM uses the following third-party AI services to power the Atlas AI engine. When you submit a support ticket or initiate an AI conversation, ticket content and conversation messages may be transmitted to these providers for processing:
| Provider | Purpose | Data Sent |
|---|---|---|
| Anthropic | Primary AI inference (ticket analysis, triage, conversation, audit) | Ticket content, KB context, conversation messages |
| OpenAI | AI failover (used when Anthropic is unavailable) | Same as Anthropic — only when failover triggers |
| Voyage AI | Text embeddings for semantic search (primary) | Document and ticket text for vector embedding |
| ElevenLabs | Voice synthesis, speech recognition, and conversational AI for phone service | Caller voice audio, conversation transcripts, agent system prompts |
| Twilio | Telephony, call routing, and SIP connectivity for phone service | Phone numbers, call metadata, SIP signaling data |
| Stripe | Payment processing and subscription management | Billing email, payment method tokens, subscription and invoice data |
BYOK (Bring Your Own Key) Enterprise Customers: Enterprise tenants who supply their own Anthropic, OpenAI, and/or Voyage AI API keys have their data processed directly under their own agreements with those providers. Boord-ITS does not transmit BYOK customers' data to these providers using Boord-ITS's API accounts.
We do not use your data to train third-party AI models. We rely on each provider's data processing commitments. Customers should review the privacy policies of each provider linked above.
We do not sell, rent, or trade personal data. We disclose data only in the following circumstances:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Anthropic | AI inference (primary) | United States |
| OpenAI | AI inference (failover) | United States |
| Voyage AI | Text embeddings | United States |
| Cloudflare | Tunnel / TLS termination / email routing | Global (distributed) |
| Resend | Transactional email delivery | United States |
| Dropbox | Encrypted database backup storage | United States |
| Sentry (optional) | Error tracking and diagnostics (only if SENTRY_DSN is configured) | United States |
| ElevenLabs | Voice synthesis, speech recognition, and conversational AI (phone service) | United States |
| Twilio | Telephony, call routing, and SIP connectivity (phone service) | United States |
| Stripe | Payment processing and subscription management | United States |
We will maintain an up-to-date sub-processor list and notify Customers of material changes via email at least 10 days in advance.
When BITSM is provided to a Customer organization:
Our Data Processing Agreement (DPA), available at /legal/dpa, sets out the terms of our data processing activities in accordance with GDPR Article 28.
Depending on your location and applicable law, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are an employee of a Customer organization, you should direct requests to your organization's administrator first, as they control your data within the platform.
CCPA / California Residents: California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of sale of personal information. We do not sell personal information. To exercise CCPA rights, contact [email protected].
We implement appropriate technical and organizational measures to protect personal data, including:
No security system is impenetrable. In the event of a data breach affecting personal data, we will notify affected Customers and relevant supervisory authorities as required by applicable law.
BITSM uses one first-party session cookie ("session") to maintain your authenticated session. This cookie is:
We do not use third-party tracking cookies, advertising cookies, or analytics cookies.
Boord-ITS is based in the United States. Our sub-processors (Anthropic, OpenAI, Voyage AI, Cloudflare, Resend, ElevenLabs, Twilio, Stripe) are also primarily US-based. If you are located in the European Economic Area (EEA) or United Kingdom, data may be transferred to the United States. We rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms for such transfers. Contact us at [email protected] for details.
BITSM is a B2B enterprise platform not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data, contact us at [email protected].
We may update this Privacy Policy from time to time. Material changes will be communicated to Customer administrators via email at least 14 days before taking effect. The "Effective Date" at the top of this document reflects the date of the most recent update. Continued use of BITSM after the effective date constitutes acceptance of the updated policy.
For privacy-related questions, rights requests, or to report a privacy concern: