Privacy Policy
Version 2026-10
This policy explains what personal information Backline handles, why, and what rights you have. Backline is run by Carbon Crayon Ltd (company no. 06784011, London N7 8GP), trading as Backline.
1. Our two roles
- Controller for account data. For your Backline account — your name, email, sign-in activity, and billing details for teams you own — we decide how it's used, so we're the data controller.
- Processor for team data. Inside a team, the team (its owner and admins) decides what information to collect about its members and the people who sign up to its mailing list or contact it through its public page. We store and process that information on the team's behalf, following its instructions, as a data processor. If you have a question about how a team uses your information, ask the team first — we'll help them answer.
2. What we collect
- Account details: name, email, optional phone number and profile photo.
- Team content: events, RSVPs, polls, costs and subs records, pages, files, contacts, and public-page content added by team members.
- Payment information: Pro subscriptions and member card payments are handled by Stripe. We receive limited details (such as card brand, last four digits and payment status), never full card numbers.
- Messages: emails we send you, and messages visitors send to a team through its public contact form.
- Technical data: server logs (including IP addresses) and error reports, used to keep the service secure and working.
- Terms acceptance: when you accepted our terms and which version.
3. Why we use it, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Running your account and your teams, signing you in, sending service emails (login codes, invites, reminders, billing and security notices) | Contract |
| Billing, invoices, VAT and accounting records | Legal obligation, contract |
| Keeping the service secure, preventing abuse, fixing bugs | Legitimate interests |
| Occasional emails about new Backline features | Legitimate interests (soft opt-in) — you can opt out at signup or unsubscribe at any time |
4. Product-update emails
We may occasionally email account holders about new Backline features. You can opt out when you sign up, product-update emails will always include an unsubscribe link, and opting out won't affect the service emails you need to use Backline (like login codes, billing notices or changes to our terms).
5. Who we share it with
We don't sell personal information. We use these sub-processors to run Backline:
| Provider | What for |
|---|---|
| Stripe | Pro billing, and card payments between members and teams |
| Resend | Sending email |
| DigitalOcean | Hosting and database (London) |
| Sentry | Error monitoring |
We may add Cloudflare to host custom domains for team pages; we'll update this page if we do.
Third-party content in pages
Some pages load content from other services, which then see the visitor's IP address and browser details:
- Bunny Fonts — our typefaces load from Bunny's font CDN on every page, including teams' public pages.
- YouTube (Google) — only when a team embeds a video on its public page. We use YouTube's privacy-enhanced (youtube-nocookie.com) player.
- Google favicon service — shows small site icons next to links on a team's Links tab (signed-in members only).
Information you put on a team's public page is, by design, visible to anyone. We may also disclose information if the law requires it.
6. International transfers
Some of our providers are based in, or may access data from, outside the UK (for example the United States). Where that happens we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the UK–US data bridge.
7. How long we keep it
- Deleted team content goes to the team's Trash and is permanently deleted after 90 days.
- When an owner deletes a team, its data is deleted straight away. Database backups taken on each deploy are kept for up to 90 days, so it can linger in those until they're pruned.
- Account data is kept while you have an account. Ask us to delete your account and we will, unless we need to keep something for legal reasons (such as billing records, which we keep for six years).
8. Your rights
Under UK data protection law you can ask to access, correct, delete or export your personal information, and you can object to or ask us to restrict certain uses. Email support@backlineimprov.com and we'll respond within a month. If the request is about information a team holds, we'll pass it to the team. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ico.org.uk).
9. Cookies
We only use essential cookies, so there's no cookie banner:
| Cookie | Purpose | Lasts |
|---|---|---|
| Session cookie | Keeps you signed in between pages | Up to 60 days |
XSRF-TOKEN | Protects forms against cross-site request forgery | Same as the session |
remember_web_* | Keeps you signed in on this device ("remember me") | About 400 days |
We don't use advertising or analytics cookies.
10. Changes
If we make significant changes to this policy we'll let account holders know before they take effect.
11. Contact
Questions about privacy? Email support@backlineimprov.com.