Privacy policy
How Onboardable collects, uses, and protects your personal data.
Who we are
Onboardable (onboardable.co) provides a web-based tool that generates structured onboarding programmes for revenue teams. For the purposes of the UK and EU General Data Protection Regulation, Onboardable is the data controller for the personal data described in this policy.
Questions or requests can be sent to hello@onboardable.co.
Where you enter another person's name into the questionnaire — for example a colleague who will cover a topic — you are the controller for that person's data and Onboardable acts as your processor. Business customers can request a data processing agreement at hello@onboardable.co.
What we collect
Account data: your name, email address, and organisation name. Programme data: your questionnaire responses and the onboarding programmes generated from them. Payment records: confirmation of payments made — card details themselves are processed by our payment provider and never touch our servers.
We do not use advertising or tracking cookies. We use only the storage necessary to keep you signed in and to operate the service.
How we use your data
We use your data to generate, store, and let you return to your onboarding programmes, to process payments when you upgrade, and to provide support when you contact us. Your questionnaire responses are processed by Anthropic PBC solely to generate your programme content. See "Where your data leaves the European Union" below. We do not sell your data and we do not share it with third parties for marketing.
The lawful bases we rely on are performance of a contract (providing the service you signed up for) and legitimate interests (keeping the service secure and improving it).
Where your data is stored
Your account, your questionnaire answers and your generated programmes are held in the European Union. Our database, sign-in and file storage run in Frankfurt, Germany. Data is encrypted in transit (TLS 1.2 or higher) and at rest.
Where your data leaves the European Union
One part of the service works differently, and you should know about it before you use it.
When you generate a programme, we send your questionnaire answers to Anthropic PBC, San Francisco, United States. Anthropic operates the Claude AI models that build your programme. Those answers are therefore processed outside the European Union.
What is sent: your company name, industry, company size, working setup, the role being onboarded, your stated goal for the new starter, the timings you chose, the topics you rated, and any names you entered under "Who will cover these topics?".
What is not sent: your account email address, your password, and any payment details.
The transfer relies on the European Commission's Standard Contractual Clauses, which form part of our data processing agreement with Anthropic. Data submitted through Anthropic's commercial API is not used to train its models.
If you would rather not send a colleague's name outside the EU, leave the "Who will cover these topics?" fields blank. They are optional, and your programme is generated without them.
Who processes your data for us
Supabase — database, sign-in and file storage. European Union, Frankfurt, Germany.
Anthropic PBC — generates your programme from your answers. United States.
Cloudflare — domain and email forwarding for hello@onboardable.co. Global network.
Lovable — hosts and serves the website and application, and collects error diagnostics. Served from a global content delivery network.
Each is bound by a data processing agreement, and we update this list whenever a provider changes.
How long we keep it
We retain account data for as long as your account is active. If you close your account, we delete personal data within 30 days, retaining only what is required for legal and accounting purposes.
Your rights
You have the right to access, correct, export, restrict, object to the processing of, or delete your personal data. Email hello@onboardable.co and we will action your request within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.