BordrThis document has not been reviewed by a lawyer
It was drafted to describe accurately how Bordr actually works, and Nigerian counsel should read it before anyone relies on it contractually. Where it describes a technical control, that description is accurate as at the date above.
Privacy notice
Last updated 17 October 2026 · Nigeria Data Protection Act 2023 (NDPA)
1. Who this is about
Bordr is operated by Korevra (“we”). This notice covers personal data we handle in connection with Bordr.
There are two different relationships, and the difference decides who you ask about what:
- For board data — directors, meetings, resolutions, minutes, shareholders, board papers — the customer company is the data controller and we are a data processor acting on its instructions. If you are a director using Bordr, your company decides what is held and for how long. See the data processing addendum.
- For account data — the sign-in address of the person who opens an account, billing contacts, support correspondence — we are the controller.
2. What we hold, and why
| Category | Examples | Lawful basis |
|---|---|---|
| Identity and sign-in | Name, email address, role on the board, second-factor enrolment | Contract — the service cannot be provided without it |
| Board records | Directorships, attendance, votes, declarations of interest, minutes, uploaded papers | Processed for the customer on its instructions; the customer’s own basis applies |
| Security records | Sign-in events, the network address an action came from, refusals, the audit chain | Legitimate interest — protecting a statutory record |
| Billing | Billing contact, plan, invoices, payment references | Contract, and the legal obligation to keep tax records |
| Support | Messages you send us, and what an operator read under a consented, time-boxed grant | Contract and legitimate interest |
We do not sell personal data. We do not use board data to train AI models. The AI features answer questions from a board’s own records at the moment they are asked, and nothing from one customer is used to serve another.
3. Where it is processed, and the transfer out of Nigeria
Bordr runs on Google Cloud. The database and application compute are in europe-west1 (Belgium). Your data is therefore stored and processed in the European Union, not in Nigeria.
This is a cross-border transfer under Part VIII of the NDPA. We rely on the adequacy of the destination’s data-protection regime together with our contractual arrangements with Google as a sub-processor. If you need data to remain in Nigeria, tell us before you subscribe — today we cannot offer that, and you should not assume otherwise.
4. Who else sees it
- Google Cloud / Firebase — hosting, database, authentication, and the AI model that drafts minutes and answers questions.
- Korevra operators — only under a consented, time-boxed and field-limited grant, and every such access is written to your board’s own audit chain.
- Email delivery — for sign-in links, invitations and account notices.
We do not use advertising or analytics trackers on this website.
5. How long we keep it
Board records are kept for as long as the customer’s account exists, because they are a statutory record and deleting them is the customer’s decision rather than ours. The audit chain is append-only by design: entries within it are not deleted individually, because removing one would break the chain and destroy the property that makes it worth having.
Meeting transcripts produced by the Notetaker are purged automatically once the minutes they support have been prepared. Invoices and tax records are kept for six years. When an account is closed we delete or return board data on the customer’s instruction, subject to the audit and tax records we are required to retain.
6. Your rights
Under the NDPA you may request access to your personal data, correction, deletion, restriction of processing and portability, and you may object to processing based on legitimate interest. You may withdraw consent where consent is what we rely on.
If the data is board data, ask your company — it is the controller, and we will support it in answering you. If it is account data, email support@korevra.com. We aim to respond within 30 days.
Deleting your Bordr account
To delete your Bordr sign-in account, email support@korevra.com from the address you sign in with, with the subject “Delete my Bordr account”. We confirm the request with you, then delete the sign-in account and its second-factor enrolment, so it can no longer be used, within 30 days.
What stays: the records of any board you sat on belong to that company, so your name remains where a statutory register or the minutes record it, and the audit chain keeps its existing entries because it is append-only. Invoices are kept for six years for tax. If you are the account owner of a company’s board, closing that board is a separate request from the company, described in section 5.
Separately from all of this, directors keep a statutory right of access to their own board’s record. Bordr is built so that no commercial state of an account — an unpaid invoice, a lapsed trial, a suspension — can stand between a director and reading or downloading what is already on the board.
7. Complaints
If you are not satisfied with our response you may complain to the Nigeria Data Protection Commission.
8. Changes
If we change this notice materially we will tell account owners by email. The date at the top always reflects the current version.