1. Introduction
Starboard AI, Inc. (“Starboard AI,” “we,” “us,” or “our”) is a Delaware corporation that provides an AI-powered commercial real estate intelligence platform. Our services include a web application, API, and Microsoft Office add-ins for Outlook, Excel, PowerPoint, and Word (collectively, the “Services”).
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our Services or visit our marketing website at www.starboard-ai.com, and describes your rights under applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”).
By creating an account, using any of our Services, or visiting our marketing website, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller
For the purposes of applicable data protection law, Starboard AI, Inc. is the data controller responsible for your personal data.
Contact: privacy@starboard-ai.com · www.starboard-ai.com
We have not appointed a Data Protection Officer (DPO) as we do not meet the mandatory thresholds under GDPR Article 37. For any privacy-related inquiries, please contact us using the details above.
3. Data We Collect
3.1 Account & Identity Data
- Full name, email address, and organization name
- Authentication credentials (managed via SSO, third-party identity providers, or email-based authentication)
- Role and permissions within your organization’s account
3.2 Platform Usage Data
- Feature interactions, navigation patterns, and session duration
- Search queries and filter selections within the platform
- Error reports, crash logs, and performance diagnostics
- Device type, browser, operating system, and IP address
3.3 Content You Provide
When you use our Services — including the web application and Microsoft Office add-ins — we process the content you choose to submit through our features. We only access or process content that you explicitly provide to us through the Services. We do not independently access, scan, or collect data from your files, emails, or documents beyond what you submit.
3.4 Marketing Site & Visitor Identification
When you visit our marketing website at www.starboard-ai.com, cookies and similar technologies may be used by our online data partners or vendors to associate your visit with other personal information that they or others have about you, including by association with your business email address. We (or service providers on our behalf) may then send communications and marketing to those email addresses.
Specifically, we use a third-party visitor identification service (Retention.com / RB2B) on our marketing website to identify business visitors and infer professional contact details so that our team can follow up about Starboard AI. This identity resolution is performed by our vendor based on data that vendor maintains. We use the resulting information solely for business-to-business outreach and account provisioning.
You have the right to opt out of this collection. To opt out generally, visit https://app.retention.com/optout. If you are a resident of the EEA or United Kingdom, you may opt out under GDPR at https://www.rb2b.com/rb2b-gdpr-opt-out.
Separately, we use PostHog for product and website analytics to understand which pages and features are used and to improve the site. This is distinct from the identity resolution described above: PostHog records page views, referring pages, approximate location derived from IP address, and device and browser type. Analytics requests are routed through our own domain, so blocking third-party analytics domains alone may not prevent collection; you can opt out by enabling “Do Not Track” in your browser or by contacting us at privacy@starboard-ai.com.
3.5 Communications Data
- Support requests and correspondence with our team
- Feedback and survey responses
- Information you submit through forms on our marketing website (e.g., requests for access, demo requests)
3.6 Data We Do Not Collect
- We do not collect sensitive personal data (e.g., racial or ethnic origin, political opinions, biometric data, health data) unless incidentally present in content you submit for processing
- We do not knowingly collect personal data from individuals under the age of 16
4. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing and operating the Services | Performance of contract |
| Processing data through AI features at your request | Performance of contract |
| Authenticating users and managing accounts | Performance of contract |
| Improving platform functionality, reliability, and performance | Legitimate interests |
| Security monitoring, fraud prevention, and abuse detection | Legitimate interests / Legal obligation |
| Sending product updates, service notifications, and support communications | Legitimate interests |
| Sending marketing communications | Consent / Legitimate interests (B2B) |
| Identifying business visitors to our marketing website | Legitimate interests |
| Complying with legal and regulatory obligations | Legal obligation |
| Enforcing our terms of service | Legitimate interests |
We do not use your content — including documents, emails, deal data, or any other user-submitted materials — to train AI or machine learning models without your explicit, prior consent.
5. AI and Third-Party Model Providers
Our Services use third-party AI model providers to deliver AI-powered features such as document analysis, data extraction, and content generation. When you use these features:
- Your content is transmitted to our AI model provider(s) solely to process your request and return results
- We contractually require our AI model providers not to use your data for training their models
- Content sent for AI processing is not retained by our providers beyond the duration necessary to fulfill the request, in accordance with our data processing agreements
- All transmissions to AI model providers are encrypted in transit
We evaluate our AI model providers for their data protection practices and require them to maintain appropriate technical and organizational safeguards.
6. Data Sharing and Third Parties
We do not sell, rent, or trade your personal data. We may share data with the following categories of recipients:
- Cloud infrastructure and hosting providers — to store and serve the platform, under data processing agreements
- AI model providers — to process AI-powered features as described in Section 5
- Microsoft Corporation — to the extent required to operate within the Microsoft Office and marketplace ecosystem
- Identity resolution and marketing technology providers — including Retention.com / RB2B, used on our marketing website to identify business visitors as described in Section 3.4
- Analytics and monitoring services — including PostHog, used for product and website analytics as described in Section 3.4, and others using pseudonymized or aggregated data to understand usage patterns and improve reliability
- Professional advisors — legal, accounting, or audit professionals, subject to confidentiality obligations
- Legal and regulatory authorities — where required by applicable law, regulation, or legal process
- Successor entities — in the event of a merger, acquisition, or asset sale, with prior notice to affected users
All third-party service providers who process personal data on our behalf are bound by data processing agreements requiring them to process data only as instructed, implement appropriate security measures, and comply with applicable data protection law.
7. International Data Transfers
Starboard AI is headquartered in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or other jurisdiction with data transfer restrictions, your personal data may be transferred to and processed in the United States or other countries where our service providers operate.
For transfers of personal data from the EEA or UK to countries not deemed to provide an adequate level of data protection, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK’s International Data Transfer Addendum where applicable)
- Any additional supplementary measures necessary to ensure an adequate level of protection
8. Data Retention
We retain personal data only as long as necessary to fulfill the purposes described in this policy:
| Data Category | Retention Period |
|---|---|
| Account data | Duration of active account, plus 12 months after termination |
| User-generated content | Duration of active account (you may delete at any time) |
| Content submitted for AI processing | Deleted within 30 days of processing, unless saved by the user |
| Usage logs and analytics | Up to 24 months |
| Security and audit logs | Up to 36 months |
| Marketing website visitor identification data | Up to 24 months, or until opt-out |
| Website and product analytics data (PostHog) | Up to 12 months |
| Support correspondence | Up to 24 months after resolution |
| Legal and compliance records | As required by applicable law |
You may request deletion of your personal data at any time (see Section 10).
9. Data Security
We implement technical and organizational measures designed to protect your personal data, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access controls and least-privilege principles
- Regular security assessments
- Secure software development practices
- Incident response and breach notification procedures
- Access logging and monitoring
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users and the relevant supervisory authority within 72 hours, as required by GDPR.
10. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate or incomplete data |
| Erasure | Request deletion of your personal data |
| Restriction | Request that we limit processing of your data |
| Portability | Receive your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests |
| Withdraw Consent | Withdraw consent at any time where processing is consent-based |
| Lodge a Complaint | File a complaint with your local data protection authority |
To exercise any of these rights, contact us at privacy@starboard-ai.com. We will respond within 30 days, or within the timeframe required by applicable law.
11. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the CCPA/CPRA:
- Right to Know: You may request details about the categories and specific pieces of personal information we have collected, the purposes for collection, and the categories of third parties with whom we share it
- Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions
- Right to Correct: You may request correction of inaccurate personal information
- Right to Opt Out of Sale/Sharing: We do not sell your personal information for monetary consideration. To the extent that our use of the visitor identification service described in Section 3.4 is considered “sharing” under the CPRA, you may opt out at https://app.retention.com/optout.
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To submit a CCPA/CPRA request, contact us at privacy@starboard-ai.com. We will verify your identity before processing your request.
12. Cookies and Tracking Technologies
12.1 Web Application
Our web application uses the following types of cookies and similar technologies:
- Strictly Necessary: Session cookies and authentication tokens required for the platform to function. These cannot be disabled.
- Analytics: We may use analytics services to understand how users interact with our platform. Where required by law, we obtain your consent before setting analytics cookies.
We do not use cookies for cross-site tracking or behavioral advertising in the web application.
12.2 Marketing Website
Our marketing website at www.starboard-ai.com uses cookies and similar technologies from our identity resolution provider (Retention.com / RB2B) and from our analytics provider (PostHog), which sets a first-party cookie to distinguish repeat visits. These technologies allow our online data partners to associate your visit with other personal information that they or others have about you, including by association with your business email address, so that we may follow up with information about Starboard AI.
To opt out, see Section 3.4 above.
12.3 Microsoft Office Add-Ins
Our add-ins use locally stored session tokens and limited telemetry to maintain authentication state and monitor performance. No cross-site tracking or advertising cookies are used within our add-ins.
13. Children’s Privacy
Our Services are intended for professional business use and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately at privacy@starboard-ai.com, and we will take steps to delete it.
14. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice within the Services at least 30 days before the changes take effect. Your continued use of the Services after the effective date of a revised policy constitutes acceptance of the changes.
15. Contact Us
For privacy-related questions, requests, or concerns:
Starboard AI, Inc.
Email: privacy@starboard-ai.com
Website: www.starboard-ai.com
For users in the EEA or UK, you have the right to lodge a complaint with your local supervisory authority. A list of EEA data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
Last updated: April 28, 2026