Mainspring Board Actions (“Mainspring”, “MBA”, “the app”) is provided by Directive LLC (“Directive”, “we”, “us”). Mainspring helps nonprofit board members track the actions they take for their organization. Each organization (“board”) has its own private workspace. This policy explains what we collect, why, who processes it for us, and the choices you have.
The short version
- Your LinkedIn connections file never leaves your phone. The app parses it locally on your device, counts connections by company, and keeps only the company names you choose and their counts. Contact names, emails and profile links are discarded on the device. We retain zero personal contact data from the file: it is never uploaded or stored.
- We collect what you and your board enter to run the board’s work, and the minimum needed to sign you in and notify you.
- We collect no protected health information (PHI) and do not scrape third-party APIs.
- We do not sell personal information, show ads, or use third-party advertising or analytics tools.
- You can delete your account in the app at any time (My MBA Profile → About & legal → Delete my account). See Data & Account Deletion.
1. Information we collect
Account and profile. Your name and email address (from your board’s invitation, or from Sign in with Apple, which may give us a private relay email); optional phone number, job title, employer, LinkedIn profile URL, short bio and headshot; your role and title on each board.
Board work you create. Action items, goals and commitments, prospect organizations and their scores, notes, comments and @mentions, hand-off requests, meeting RSVPs, meeting notes and transcripts you add, and documents your board’s admins upload. Some of this is visible to everyone on your board; private notes stay private to you, as the app shows.
LinkedIn connections file (optional): parsed on your device
If you choose “Unlock Network Insights”, you can pick the Connections.csv file you downloaded from LinkedIn, or paste its contents. The file is:
- read and parsed only on your device;
- reduced to a list of company names with the number of your connections at each;
- discarded: the app drops the raw rows (names, emails, profile URLs, positions) as soon as they are counted, and deletes its temporary copy of the file.
Only the companies you then select are saved to your board’s workspace, each with its connection count and a note that you added it. No contact-level data from the file is ever sent to our servers, and none is retained. You can also skip the file and type your top three companies by hand.
Device and service data. A push notification token for each device you allow, the calendar subscription link you create, and basic server logs (time, IP address, request type) kept by our hosting providers for security and troubleshooting.
Usage counts. To measure whether Mainspring works during a pilot, we compute counts per board: how many network companies were added from a LinkedIn file versus by hand, and how many action items were completed in the first 90 days. These are counts only; they contain no names or content, and we do not use any third-party analytics SDK.
2. How we use it
To provide the service (sign-in, your board’s dashboard, reminders, board packets, meeting minutes), to send the notifications and emails you or your board turn on, to keep the service secure, to support you when you ask, and to measure and improve the product using the counts above. We do not use your board’s content to train AI models.
3. AI-drafted meeting minutes
If a board admin or minutes approver chooses “Draft with AI”, the meeting’s transcript and notes are sent from our servers to Anthropic’s Claude API, which returns a structured draft. The draft is not shown to the board until a person reviews, edits and publishes it. Our API key is held only on our servers; the app never holds it. Anthropic processes this content as our service provider under its commercial terms.
Recorded meetings
A board admin or minutes approver can record a meeting in the app. Before recording, the app reminds them to make sure every attendee consents; that consent is the board’s responsibility, and some states require everyone’s consent. The recording is uploaded to temporary storage, sent from our servers to OpenAI’s speech-to-text service for a transcript, and deleted as soon as the transcript comes back, whether or not it succeeded. Recordings that are never transcribed are deleted within 12 hours. We keep the transcript, with any marks or live notes the recorder added, as part of the meeting’s notes, visible to approvers and to whoever recorded it, and the length of each recording to count the board’s audio minutes. OpenAI processes the audio as our service provider under its API terms, which do not allow it to train on API data.
Minutes saved on your device
When you open published minutes, the app keeps an encrypted copy on your device so you can read them offline. Signing out or deleting your account removes these copies.
4. Who processes data for us
| Provider | What for | Data involved |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Everything stored in the app |
| Resend | Sending email (sign-in codes, board packets, hand-offs) | Name, email address, email content |
| Expo (with Apple Push Notification service and Firebase Cloud Messaging) | Delivering push notifications | Push token, notification text |
| Anthropic | Drafting meeting minutes, only when an approver asks | Meeting transcript and notes, board roster names and titles |
| OpenAI | Transcribing meeting recordings, only when an approver records | The meeting audio (deleted right after transcription) |
| Stripe | Payments for added audio hours | Board name, the purchasing admin’s email, payment details (entered with Stripe, never seen by us) |
| Apple | Sign in with Apple (if you use it) | As described in Apple’s privacy policy |
| Vercel | Hosting this website | Standard web server logs for this site |
We share information inside your board as the app shows (your board’s members and staff liaisons see shared board work), with the providers above to run the service, and when the law requires it. We do not sell or share personal information for cross-context behavioral advertising.
5. Retention
We keep your account while it is active. When you delete your account, we delete it as described in Data & Account Deletion. Board content stays with the board while the board’s workspace exists; when a board closes its workspace, its data is deleted within 30 days. Server logs are kept for up to 30 days. Backups roll off within 30 days.
6. Your choices and rights
You can view and edit your profile in the app, turn notifications off in your phone’s settings, skip or remove LinkedIn-sourced companies, and delete your account in the app. Depending on where you live (for example California or the EU/UK), you may have rights to access, correct, delete or port your data, or to object to some uses. Email privacy@mainspringboard.com and we will respond within the time the law requires. We will not discriminate against you for using these rights.
7. Security
Data is encrypted in transit and at rest by our hosting provider. Each board’s data is isolated by row-level security in the database, so one board can never read another’s. Directive staff who operate the platform see aggregate counts, not board content, except when you ask us for support or the law requires it.
8. Children
Mainspring is for adult board members and staff. It is not directed to children under 16, and we do not knowingly collect their information.
9. Changes
If we change this policy in a way that matters, we will update the effective date and tell you in the app or by email before the change takes effect.
10. Contact
Questions about privacy: privacy@mainspringboard.com. General support: Support & Contact.