Privacy policy

Last updated: 21 October 2026

sboard is an Android keyboard with artificial intelligence (AI) that suggests replies for your chats. This policy explains what data it processes, why, who it shares it with and how long it keeps it. It is written from what the app and our servers actually do.

1. Controller

Nexalix Technologies S.L.U., tax ID (CIF) B26841171, Avenida Maisonnave 41, 3ºB, 03003 Alicante, Spain. Email: [email protected]. Data protection officer: [email protected].

As controller, Nexalix decides the purposes and means of the processing in accordance with Regulation (EU) 2016/679 (GDPR) and Spain’s Organic Law 3/2018 of 5 December (LOPDGDD).

2. The essentials

With your permission, sboard reads the conversation you have open in WhatsApp or Instagram and sends it, along with what you type as a hint, to our servers and to AI providers (Anthropic and OpenAI, in the US) to suggest replies.
Our servers don’t store the content of your conversations. The AI providers keep it for up to 30 days (longer if their systems flag it for abuse) and don’t use it to train their models.
On your phone, sboard keeps encrypted the messages you send (if “Learn from you” is on), your notes and your style profiles, and unencrypted the words it learns from what you type.
The app has no ads, analytics or third-party SDKs. We don’t sell your data.
Nothing is read or sent until you accept the app’s notices, and you can withdraw your consent at any time.

3. What data we process

3.1 Your account

When you sign in with Google we receive your email and your Google account ID. We also keep your plan, your sessions (only a fingerprint of the session code, never the code) and your usage: which AI operations you make, with which model, how many words and what they cost, without the content.

3.2 What the accessibility service reads

sboard uses Android’s accessibility service. If you turn it on and accept its notice:

While it’s on, it reads the visible messages in WhatsApp and Instagram chats: the text, the time, the day, the names of who writes in groups and quoted messages. It does so whatever keyboard you use.
In other apps, it reads what’s on the screen once when you tap ◀ or ✨ on the sboard keyboard.
With the // shortcut, it writes the suggestion you choose into WhatsApp’s text field. It never sends messages for you or presses any button.

What it reads stays in the phone’s memory (up to 200 messages from 20 chats) and is cleared when the app closes, the service is turned off or you withdraw your consent. It only leaves the phone in the requests of section 3.3.

3.3 What is sent to suggest replies

If you accept the data notice, sboard sends to our servers, and they send to an AI provider:

For suggestions: the chat’s name and the app; the visible messages (the last 60 by default, up to 200), from both sides, with the time and the name of who writes in groups; the quoted message; the tone and the hint you type; your notes; your style profiles, if they’re on; the keyboard language; and, if “Use my messages as examples” is on, up to 30 of your messages as examples of how you write, which may come from other chats (those have names, links, emails and long numbers removed).
For the words in the suggestion strip: the chat’s name and its messages.
For the automatic style profile (off by default): the chat’s name, the previous profile, up to 200 of your hand-typed messages and up to 30 “suggestions / what you sent” pairs, in the background and at most once a day per profile.

It is sent when you open the sboard keyboard in a WhatsApp or Instagram chat whose last message is from the other person, when a message arrives with the panel open, when you tap a tone, ↻, ◀ or ✨, with the // shortcut and, if you turn on “Prepare suggestions before opening the keyboard” (off by default), with the keyboard closed.

This data includes other people’s messages and names (section 5).

3.4 Reports

If you report a suggestion from the keyboard, we receive the suggestion, the reason and your internal ID; nothing else from the chat. Only the Nexalix staff who review reports see them.

3.5 Technical data

Our servers’ logs keep the method, the path, the result, the response time and your internal ID; never the content, your email, your session code or your IP. To limit sign-in attempts we use your IP for one minute. Cloudflare, which gives access to our servers, sees IPs and traffic because it terminates the encryption (section 6).

3.6 Only on your phone

In the app’s private storage, with no cloud backup:

The messages you send in WhatsApp and Instagram, with the time and the chat’s name, if “Learn from you” is on (it is by default). Encrypted with a key from Android’s keystore. Up to 1,000 per chat and 20,000 in total.
Your notes and style profiles, encrypted.
The words and word pairs you type with the sboard keyboard in any app, unencrypted, to predict and correct. Never in password, email or web address fields, in incognito mode or where the app asks not to learn.
The tone chosen for each chat (with the chat’s name), your settings, your recent emojis and word usage statistics without the words.
The last thing you copied, which the keyboard offers you for 5 minutes; it isn’t stored or sent.

4. Purposes and legal bases

Purpose	Legal basis (GDPR)
Create and keep your account, apply your plan and quota	Performance of the contract (Art. 6(1)(b))
Read the conversation and send it to the AI to suggest replies	Your consent (Art. 6(1)(a)), given in the app’s notices, and performance of the contract
Receive reports and moderate generated content	Legitimate interest in a safe service (Art. 6(1)(f))
Service security (logs, usage limits)	Legitimate interest (Art. 6(1)(f))
Comply with legal obligations	Legal obligation (Art. 6(1)(c))

Withdrawing consent doesn’t affect the lawfulness of the processing before it. Before relying on legitimate interest we weighed your rights and those of the other people in your chats (section 5); you can ask our data protection officer for that assessment.

5. The other people in your chats

Your conversations include messages and names of people who may not use sboard. We process them only to suggest replies in the conversation you take part in, on the basis of legitimate interest (Art. 6(1)(f) GDPR), with these safeguards: our servers don’t store them; we don’t profile those people (profiles describe how you write); only what’s visible is sent; and the AI providers don’t train on them. As we can’t inform them one by one, this policy explains it. If you are one of those people, you can exercise your rights by writing to [email protected].

We don’t sell your data, pass it to data brokers or use it for advertising. These companies process it on our behalf, under a data processing agreement (Art. 28 GDPR):

Anthropic (US) and OpenAI (US): generate the suggestions, the words and the profiles. They receive what’s in section 3.3, without your email or ID. Anthropic deletes what it receives within 30 days; if its systems flag it for breaking its usage policy, it may keep it for up to 2 years. OpenAI keeps abuse-monitoring logs for up to 30 days. Neither trains its models on this data.
Hetzner (Germany): hosts our servers and the database, encrypted.
Cloudflare: the network and access to our servers (it terminates TLS encryption), and the encrypted backups, stored in the European Union.
Google: sign-in. Our server checks your identity with Google’s public keys, without sending Google anything.

And to the authorities, when the law requires it.

7. International transfers

Anthropic and OpenAI are in the US. Transfers rely on the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), which are part of their data processing agreements.

Cloudflare, Inc. (US) may process traffic outside the European Union. It is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), and its data processing agreement also includes the standard contractual clauses.

You can ask our data protection officer for a copy of these safeguards.

8. How long we keep data

The content of your conversations: our servers don’t keep it; the AI providers, as section 6 says.
Your account: until you delete it.
Your detailed usage: the current month and the previous 12; after that, only totals without your identity.
Sessions: expire after 180 days without use.
Reports: 90 days.
Server logs: 15 days.
Encrypted backups: 14 days.
On your phone: until you delete it (section 9) or uninstall the app.

If a law requires us to keep something longer, or we need it to establish, exercise or defend legal claims, we keep it blocked and only for as long as necessary.

9. Your rights and how to control your data

You can exercise, free of charge, your rights of access, rectification, erasure, restriction of processing, portability and objection (in particular, to what we process on the basis of legitimate interest), and withdraw your consent at any time, by writing to [email protected] from your account’s email address. If we can’t confirm it’s you, we’ll ask for the minimum needed to do so. We reply within one month at most; if the request is complex or there are many, this can be extended by two more months, and we’ll tell you within the first month.

From the app:

Withdraw your consents: sboard > Privacy. You can also turn the service off in Android Settings > Accessibility > sboard.
Delete what’s stored (messages and profiles): sboard > Learn from you > Delete what’s stored.
Delete learned words: sboard > Keyboard and typing > Word prediction > Delete what’s learned.
Delete your account: sboard > Account > Delete account, or as explained in Delete your account. Deleting the account doesn’t delete what’s stored on the phone: your notes are deleted by leaving them empty, and the rest with the buttons above or by uninstalling the app.

If you think we haven’t handled your rights properly, you can complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, or to the authority of your country.

10. Minors

sboard is only for people aged 18 or over. If we learn that an account belongs to a minor, we delete it.

11. Automated decisions

The AI suggests replies but doesn’t make decisions about you: you choose, edit and send. We don’t build profiles with legal or similarly significant effects on you.

12. Security

Everything travels encrypted (HTTPS). The database is encrypted, and so are its backups. We only keep a fingerprint of the session code. On the phone, messages, notes, profiles and the session code are encrypted with a key from Android’s keystore. An automated test checks, on every change to our server, that the content of requests doesn’t end up in the database, the logs or the metrics.

13. Cookies

This website doesn’t use cookies or analytics tools, and the app doesn’t use cookies either.

14. Changes

We’ll publish changes to this policy on this page, with their date. If we change what sboard does with your data, we’ll tell you in the app before it applies and, where required, ask for your consent again.

15. Contact

For any question, complaint or request about your personal data, write to our data protection officer: [email protected]. For anything else: [email protected].