Why we built Privacyboard: one source of truth for your privacy records
Privacyboard exists because a small business writes its privacy policy, vendor list, cookie banner and processing records at different times, from different sources, so they slowly contradict each other. It keeps one record of your company, vendors and practices and generates every document and public page from it. It is hosted in the EU, never claims certification and is not legal advice.
Most small businesses do not ignore privacy. They deal with it in bursts: a privacy policy when the website launches, a cookie banner when someone complains, a vendor list when a customer asks for one. Each piece is written on a different day, from a different template, by a different person. Six months later they no longer match. This is the problem Privacyboard was built to remove.
#Why do privacy documents drift apart?
Every privacy document describes the same facts: who you are, which tools handle personal data, where that data goes, how long you keep it and how people can exercise their rights. When each document is written separately, each one holds its own copy of those facts.
Then reality moves. You add a payment provider, switch your email tool, start using a new analytics script. One document gets updated, the others do not. The result is familiar:
- the privacy policy lists five vendors, the vendor list shows eight,
- the cookie banner mentions a tool you stopped using last year,
- the data processing agreement names a hosting region you no longer use,
- the request form promises an answer in a time that your policy does not state.
None of this is dishonest. It is simply what happens when the same fact lives in four places. The GDPR asks organisations to be able to demonstrate what they do (the accountability principle in Article 5(2)), and contradictory documents make that hard.
#What does "one source of truth" mean in practice?
In Privacyboard you describe your company once: your profile, your vendors, what you do with personal data, which cookies your website uses. Every document and public page reads from that record.
| You record | It feeds |
|---|---|
| Company profile | All documents and the privacy center header |
| Vendors (role, purpose, data, region) | Privacy policy, vendor list, data processing agreement, cookie declaration, privacy center |
| Processing activities | Privacy policy, data processing agreement, processing register export |
| Cookie banner settings | Cookie policy and the cookie section of the privacy policy |
| Privacy requests | Overview alerts and deadlines |
Add a vendor once and it appears everywhere it should. Remove it once and it disappears everywhere. The documents cannot contradict each other because they are not separate copies. You can see the full model in how Privacyboard works.
#Which principles do we build on?
Six rules guide what goes into the product, and what stays out.
- You answer once. A fact you have already given is never asked again. We also avoid questions whose answer no feature uses: if a field does not change a document, a deadline or a page, it should not exist.
- Suggestions are not facts. When Privacyboard prefills a vendor's usual role or a typical retention period, it is marked as a suggestion. It becomes a fact only when you confirm it. We do not infer a legal role on your behalf.
- An approved version never changes silently. You validate a document, and the validated text is kept. If you change a fact afterwards, the document is marked as changed since validation and waits for your review. A public page never shows text you did not approve.
- Private until you publish. Everything in a workspace is private. Drafts are never public, and your privacy center shows only what you switched on.
- A wrong value is worse than an empty one. Where we cannot know something, such as the region a vendor uses for your account, we ask rather than guess. The same idea is behind how the vendor catalog is verified.
- Say what we do not do. The product description includes its limits, and so does this article.
#Who is Privacyboard for?
It is built for teams that need to do privacy properly without a privacy department: founders, agencies, small software companies, online shops, consultants. It is a poor fit when the work is mostly about auditing large systems.
| Your situation | Fit |
|---|---|
| A company of 1 to 50 people with a website, a handful of tools and customers who ask privacy questions | Good fit |
| An agency or freelancer managing several client sites (one workspace per site) | Good fit |
| A team that needs a cookie banner, a privacy policy and a request process that agree with each other | Good fit |
| An organisation that needs automated data discovery across databases or formal audit workflows | Not the right tool |
| A business that needs a certified product or a legal opinion | Not the right tool |
#Where is your data stored?
Workspace data is stored in a database in the European Union, and Privacyboard is operated as a European service. The product itself is built to collect little: the cookie consent log, for example, records a random visitor ID, the date, the banner version and the choice, with no IP address, and it is deleted after 13 months. Notification emails about a privacy request never contain the request itself, so personal data is not copied into mailboxes. The details are in the security overview.
#Which laws does it cover?
Privacyboard started from the GDPR and the ePrivacy rules and covers the privacy laws of the countries you choose to serve: US state laws such as the CCPA/CPRA, Switzerland, Canada (including Québec), Brazil, Chile and Australia. You pick the countries, or the whole world, and each one adds its own notice to your policy and its own rights and deadline to your privacy center. For how these laws differ, see privacy laws around the world.
#What do we deliberately not do?
- We do not give legal advice. For an unusual, contested or high-risk situation, talk to a professional.
- We do not promise compliance. No tool can make a company compliant on its own, because compliance depends on what you actually do. Privacyboard gives you organised, dated records and clear documents.
- We do not certify anything. There is no certification attached to the documents, the vendor pages or the cookie banner.
- We do not write your documents with AI. Texts are assembled from fixed, reviewed wording and your answers.
- We do not implement IAB TCF, and the cookie banner is not a Google-certified CMP. It does support Google Consent Mode and Global Privacy Control.
Knowing the limits is part of the value: you know where your own judgement is still needed.
#FAQ
#Who is behind Privacyboard?
Privacyboard is operated by Antoine Milkoff, based in France. The operator's details are published on the terms of use page, and questions go to the contact address shown there.
#Is Privacyboard free?
Setting up is free: your company profile, vendors, documents, processing register, request tracking and incident register cost nothing for one person. Pro adds the public privacy center, the cookie banner and teams. See Privacyboard pricing explained.
#Does Privacyboard replace a lawyer or a data protection officer?
No. It helps you document and publish what you actually do. For a legal opinion, or a role that the law requires a qualified person to hold, you still need a professional.
#Where is my data stored?
In a database in the European Union. Privacyboard is operated as a European service, and everything in your workspace stays private until you choose to publish it.
#Can I use it for several websites or companies?
Yes. Each account can create as many workspaces as you need, one per company or website. Pro is billed per workspace, so workspaces you keep private stay free.
#Sources
Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.