Privacy Policy

Last updated: 5 November 2026

Who we are

Evidence Board ("we", "us") is operated by MTG Technical Consulting Ltd, a company registered in England and Wales (company number 17342687), registered office Office 1665, 60 Tottenham Court Road, London W1T 2EW. Contact us about privacy at support@mtgtechnical.com.

Three kinds of data, two roles

Evidence Board handles personal data in two different capacities:

Your account data. Your email address, login details, billing records and how you use the service. We decide how this is used, so we are the controller.
Case content. The evidence you upload and write: photos, documents, recordings, notes, links, and the reviews and readings an app you connect (such as Claude) saves to a case. Case content often contains personal data about other people (witnesses, subjects, members of the public). You decide what goes into a case and why, so you are the controller of case content and we process it on your behalf as your processor, under the data processing terms in our Terms of Service. You are responsible for having a lawful basis (and, for special category or criminal offence data, a condition under the Data Protection Act 2018) for the case content you upload. When you share a case with other people (by invitation, with your organisation, or through your team), you decide who sees it and what they can do. You stay the controller of its content, and the people you share it with see and change it on your behalf.
Public boards. When we publish a public board, including one a user submitted, we decide what is published and why, so we are the controller of the published board and of what we gather to make it. "Public boards and the people on them", below, explains this.

The rest of this policy covers the data we control. It also explains how case content flows through our providers, because that matters to you as a controller.

What we collect and why

Data	Why	Lawful basis
Email address, password (stored hashed), account creation date	To create and secure your account	Contract
If you turn on two-step sign-in: your authenticator's secret key (held by Supabase Auth, our sign-in provider), and in each browser you choose to trust, a cookie saying so	To ask for a code when you sign in, except in browsers you trust	Contract
Which versions of our Terms, this policy and our data processing agreement you agreed to, where (sign-up, a notice, a Team checkout) and when	To show what you agreed to	Contract
Case content	To store it, show it on your board, share it when you enable sharing, and let an app you've connected read and change it when you ask that app to	Contract (we process it on your instructions as your processor)
Your plan and payment references (Pro status, billing period, Stripe customer and subscription IDs), and the credit history of credits bought before they were retired	To provide Pro, take payment and keep accounts	Contract; legal obligation (tax records)
The email address of someone you invite to a case or a team, the access you chose, and when the invite was sent, used or withdrawn	To send them your invitation and let them join	Legitimate interests (delivering an invitation you asked us to send)
Who has access to each case, and how (view or edit, whether they see confidential items)	To show each person what they're allowed to, and nothing more	Contract
A case's activity log: who added, changed or removed what, and when	To show the people on a case who did what	Contract
Your team: its name, members and their roles, seats, and billing references	To run your Team plan	Contract; legal obligation (tax records)
Your email address, when you signed up, whether you've started a case of your own and when you last used the service	To send you a welcome email when you join and, a week later, one email on getting started or on your next case if you haven't been back. That second one has a link to turn such emails off	Legitimate interests (helping you start using the account you made)
Connected apps (which apps you've allowed to use your account, and when)	To let those apps act for you, and let you disconnect them	Contract
AI usage records from before October 2026, when the app made its own AI requests (which case, when, tokens used, cost)	Kept until they age out (below)	Legitimate interests (accounting for what was charged)
Audio transcription records on Pro and Team: which case and file, how many seconds of sound, and when	To count your plan's monthly transcription minutes	Contract
Boards you submit to a public category, your note, which parts you chose to make public, and our decision	To review and publish public boards, and tell you what we decided	Contract
Reports made through See something wrong? on a public board: what you tell us, your name and email if you give them, and a one-way code made from your IP address (to limit how many reports one address can send)	To check and correct public boards, and reply to you	Legitimate interests (keeping public boards accurate)
Technical logs (errors, IP address in request logs)	To keep the service secure and working	Legitimate interests
The days on which you used the service (a date per day, nothing about what you did)	To measure whether people come back, which decides whether we keep developing the product	Legitimate interests
Visits to our public pages, if you accept: the page, the site you came from, your country, browser, operating system and type of device (see Cookies and analytics)	To see how many people visit and how they find us	Consent, which you can withdraw at any time
If you sign up after following one of our links that names where we posted it (for example `?ref=yt-shorts` from one of our videos), that name, kept with your account; for visitors who accept analytics it is also part of the page address we count	To see how many sign-ups each video or post brings	Legitimate interests (knowing which of our posts bring people)

We don't sell personal data, and we don't use your case content to train AI models.

AI and connected apps

Evidence Board makes no AI requests of its own, with one exception: transcribing audio on Pro and Team. It takes the text of documents you add (a PDF's text layer, Word, email, spreadsheets) without AI, and takes still pictures from a video on our own server, without AI.

When an audio file or a video is uploaded to a case whose owner is on Pro or Team, we send its sound to Deepgram to be transcribed, and keep the transcript on the board as that file's text. We use Deepgram's EU service and opt out of its programme for improving its models, so the sound is processed in the EU and Deepgram doesn't keep it after transcribing it. Only the sound is sent, only when it is uploaded, and only on those plans. Nothing else of your case content goes to any AI provider.

You can connect an AI assistant you use, Claude (by Anthropic), ChatGPT (by OpenAI), Gemini (by Google), Grok (by xAI) or Perplexity (by Perplexity AI), to your account through the Evidence Board connector. You sign in and approve it, and you can disconnect it at any time from the account page, which stops its access at once. Once connected, the app can read and change your cases when you ask it to. What it reads goes to that app's provider under your own agreement with them (your account with Anthropic, OpenAI, Google, xAI or Perplexity AI and its settings, including whether your conversations may be used to improve their models), because you direct it there.

Until October 2026 the app itself sent case content to Anthropic to read uploaded files and to run reviews and chat. Logs of those requests are kept as set out below.

AI output can be wrong. It is analysis to help you think, not a finding of fact.

Shared cases

People you share a case with see its contents, the names and email addresses of the others on it, and its activity log. A viewer doesn't see items you've marked confidential unless you let them. People at your organisation's domain see a case only when you share it with your organisation, and only while their confirmed address is at that domain. Everyone in a team sees the team's cases.

An invitation email names you and the case or team, never anything in the case. We suggest people to share with only from those you already work with (people you've shared with before, your team, colleagues at your domain), never from the evidence on a board.

Public boards and the people on them

Public boards set out a person's public record, most often a politician's. If you appear on one, this section explains what we do with information about you. We can't easily tell everyone on a board about it individually, so this notice, linked from every page of the site, is how we tell you (UK GDPR Article 14).

What we publish about you. Your name and public roles (your seat, party, offices and committees, with their dates); how you voted in Parliament; what you said or promised in public, quoted word for word with where you said it; entries about you in official public registers; and your official portrait, with its credit. We publish facts and your own words only, with no assessments, ratings or opinions of you. How we make boards is set out in How public boards are made.

Where it comes from. Public sources: Parliament's own records (its records of Members, divisions, Hansard and the registers of interests), other official public records, and what you have published or said in public yourself (manifestos, leaflets, speeches, your website). Every fact on a board links to its source. We don't collect information about you from private sources.

Why, and on what basis. So that people can see a public figure's record, with its sources, in one place. Our lawful basis is legitimate interests (Article 6(1)(f)): the public interest in the accountability of people who hold public office. We have weighed that against your interests and rights, and you can ask us for that assessment. Where a board shows your political opinions or party membership, which are special category data, we rely on your having made them public yourself by standing for and holding office (Article 9(2)(e)).

What we don't publish. Anything about your family, staff or private life, your home address or private contact details, or anyone else's personal data beyond what an official register names in connection with your public role (for example a registered donor).

Who can see it. Anyone: public boards are on the open web and may be indexed by search engines. Our hosting providers (listed below) store them for us.

How long. A board stays published while it is relevant, including after you leave office. When we take a board down, its pages and files are removed at once. We keep its published versions, as the record of what we published and corrected, for six years after that, then delete them.

Your rights. You can:

ask for a correction: use See something wrong? on the board, or email us;
object to our processing (Article 21). We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, and tell you either way;
ask for access to what we hold about you, or for it to be erased or restricted. We weigh erasure against the public interest in the record, and explain our decision;
complain to us, or to the Information Commission, as set out under "Your rights" below.

Who we share data with (subprocessors)

Provider	What for	Location	Transfer safeguard
Supabase	Database, file storage, authentication	London, UK	Stored in the UK; any support access from outside the UK is under Supabase's data processing agreement, with the UK International Data Transfer Addendum
Vercel	Application hosting	London, UK, for the app; public pages are served from Vercel's global network	Vercel's data processing agreement, with the UK International Data Transfer Addendum
Vercel (Web Analytics)	Counting visits to our public pages, only if you accept	Vercel's network, which may include the United States	Vercel's data processing agreement, with the UK International Data Transfer Addendum
Stripe	Payments for Pro and Team (and credits bought before they were retired), and the billing portal	UK, Ireland and the United States	Stripe's data processing agreement, with the UK International Data Transfer Addendum
Brevo (Sendinblue SAS)	Account emails (confirmation, password reset, welcome and getting started), notices about your account, invitations to cases and teams, and replies to reports about public boards	European Union	UK adequacy regulations for the EU
Deepgram, Inc.	Transcribing the sound of audio and video files uploaded to Pro and Team cases	European Union (Deepgram's EU service)	Processed in the EU, under UK adequacy regulations for the EU, and not kept after transcribing; Deepgram's data processing agreement
Cloudflare, Inc. (R2)	Nightly backups of the database and uploaded files, kept seven days	Western Europe (the location we set for the backups)	Encrypted before it leaves our systems, with a key only we hold, so Cloudflare can't read it; Cloudflare's data processing agreement
Sentry (Functional Software, Inc.)	Error reports (technical details of failures; configured not to collect IP addresses or request contents)	EU (Germany)	Stored in the EU; any support access from outside it is under Sentry's data processing agreement, with the UK International Data Transfer Addendum

When sharing is enabled for a case, anyone with the case's share link can view that board. You control this per case, and you can turn it off at any time.

International transfers

Some providers above process data outside the UK. Where they do, we rely on UK adequacy regulations or an approved transfer mechanism (the UK International Data Transfer Agreement or Addendum), listed per provider above.

How long we keep data

Account and case content: until you delete it or delete your account. Deleting a case deletes its evidence, files, links and saved reviews.
Account deletion cancels a Pro subscription and removes your account, all cases, files, saved reviews, connected apps and credit history from our systems immediately. Deleted data can persist in encrypted backups for up to seven days before those backups age out. Deleting your account deletes the cases you own for everyone you shared them with; deleting the account of someone you shared with removes only their access. A team's only admin hands the team over or cancels its plan first.
Invitations: an invite and the address it went to are deleted 30 days after it is used, withdrawn or runs out.
Access to a case: ends when you leave it or are taken off it, or the case is deleted.
Activity log: kept with the case, and deleted with it.
Teams: kept while the team exists; its billing records as for payments.
Payment records: Stripe keeps its own records of each payment. We keep the records we need for tax and accounting for six years, as UK law requires.
AI request logs (from before October 2026): the text the app sent to and received from the AI provider is deleted after 30 days. The rest of each record (model, tokens used, cost, timing) is deleted after 13 months.
Days you used the service: deleted after 13 months, or with your account.
Audio transcription records: kept with your account, and deleted with it. Transcripts are case content, kept as above; Deepgram keeps no copy of the sound.
Visits to our public pages (if you accepted): Vercel tells visits apart for 24 hours, then keeps only totals, which we can see for 12 months.
Public board submissions: kept with your account, and deleted with it. A board we published from one stays published as our copy unless you ask us to take it down (Terms, section 10.4).
Reports made through See something wrong?: deleted two years after we close them.
Public boards: see "Public boards and the people on them" above.

Your rights

You can:

Access and export your data. The account page downloads everything we hold about you as a file, including links to your uploaded files.
Delete your account and all its data from the account page.
Ask us to correct or restrict processing of your data, or object to processing based on legitimate interests.

Contact support@mtgtechnical.com for anything the app doesn't do for you. We respond within one month.

Complaints. If you're unhappy with how we use your personal data, tell us at support@mtgtechnical.com. We acknowledge a complaint within 30 days, look into it, keep you informed and tell you the outcome.

If someone whose data appears in your case content contacts us, we'll refer them to you as the controller, and help you respond as your processor.

You can also complain to the UK's data protection regulator, the Information Commission (formerly the Information Commissioner's Office), at ico.org.uk. We'd appreciate the chance to resolve it first.

Cookies and analytics

Always on, because the site needs them (the law doesn't ask us to seek your consent for these):

signing in: our authentication provider's session cookies, once you sign in;
your answer to our question about analytics (a cookie called eb_consent, kept for six months);
if you use two-step sign-in and choose to trust a browser, a cookie called eb_mfa_trust in that browser, kept for 30 days;
choices kept in your own browser's storage: light or dark theme, and how you last left each board;
at checkout, Stripe's cookies, which it uses to prevent fraud.

Analytics, only if you accept. On our public pages (the home page, Boards, the pages for each use and the page about assistants) we can count visits with Vercel Web Analytics. It runs only after you press Accept. It sets no cookies and stores nothing on your device: it tells one visit from another for 24 hours by a code made from the request, then forgets it, and we see only totals (pages, where visitors came from, countries, browsers and devices), never who you are. Nothing is counted inside the app, on a case shared with you or on a share link. To refuse, or to change your mind, use Cookies at the foot of any public page.

Inside the app, we measure whether people come back from their existing sign-in (the days you used the service, above), not with a cookie or tracker.

Children

Evidence Board isn't intended for anyone under 18.

Changes

We'll post changes here and, if they're significant, email you before they take effect.