Who is responsible
The controller for the personal data described below is the operator of BackendFree, named in the Legal Notice, except where this notice says otherwise. The postal address is in the same notice. "We" and "us" in this notice mean BackendFree.
For anything in this notice, including exercising a right, write to support@backendfree.com. That address is read by a person and a request sent to it starts the clock the law gives us to answer.
We have not designated a representative in the European Union, because this service is not directed there. The Legal Notice sets out that position in full. Write to us directly: there is no second address you are expected to find.
Who this notice is for
This notice is ours, about the data we decide what happens to: the people who hold an account with us, and the people who read BackendFree's own website. Everything below is written to you on that basis.
If instead you booked or paid with a business using this platform, on its own website or on a page we host for it, or visited a website that measures its traffic with this, that business is the controller and we are only its processor: we hold the data on its instructions and decide nothing about it ourselves. The short section below says where to go.
If you have an account with us
We keep as little as the service can run on. There is no profile, no telephone number, no company details beyond what you type into your own settings, and no password, because signing in is by a code sent to your email address.
- Your account
- Your email address, which is the identity. Your first and last name, both optional. When you joined and when you last signed in.
- Signing in
- While a sign-in is under way, the email address it is for and the code we sent, held on our servers until the code is used or stops working.
- Two-step sign-in
- If you turn it on, the key your authenticator app shares with us and your recovery codes, both encrypted, and when each was last used. They are deleted when you turn it off or delete your account. If you have not turned it on, when you last chose not to be reminded.
- Your sessions
- When you sign in, we may record the IP address and browser user agent of that session, for the security of your account. They are deleted once the session ends.
- Your subscription
- Which plan you are on, its status, when the period ends, how much of your monthly allowances you have used, and any top-ups you bought. We never see or hold your card number. Stripe holds the card and we hold only its reference to you.
- What you build
- Your websites and their settings, your page content, and a record of which account created or published each version. The images you upload, such as a logo. They are public to anybody holding their address.
- Payment connections
- If you connect a payment account, a log of who did what to that connection and from which IP address, so that anybody touching your money is visible to you.
If you are just reading this website
Reading this website, apart from the sign-up and sign-in forms, requires no account and sets nothing on your device. We embed no third party scripts, no advertising network, no social widgets and no fonts fetched from somebody else's server. The fonts are served from this domain.
We count visits to the pages anybody can read on this website, and to the sign-up and sign-in pages, with our own web analytics, the same one this platform sells, running on our own server. It stores nothing on your device, reads nothing from it, and never runs while you are signed in. We are the controller for it, and what it keeps in place of your address, and for how long, is set out under Web analytics below. Where your browser sends Global Privacy Control or Do Not Track, nothing is recorded at all. The pages we host for a business's customers are never measured.
Our servers keep short lived operational logs of requests, described under Logs and diagnostics below.
Cookies, and what is placed on your device
We set exactly two cookies, only once you start to sign in, and both are strictly necessary for a service you asked for, so neither needs your consent:
- Session cookie
- Keeps you signed in. Expires after 14 days, or when you sign out.
- CSRF cookie
- Stops another website submitting a form to us as you. A security measure, not a measurement.
Both are first party and neither is used to track you. There are no analytics, advertising or preference cookies anywhere on this site. Apart from the sign-in and sign-up forms and a business's booking page there is no local storage, session storage or fingerprinting either. Those run Cloudflare Turnstile, which reads characteristics of your browser to tell a person from a script, as described under Who else touches it.
Where to go if you booked, paid or wrote on somebody's website
A business used this platform to run its bookings, its payments or its contact form, and you gave your details to that business, on its own website or on a page we host for it, where you book with it or change or cancel a booking. They decide what happens to that data; we only hold it for them. So the answers you want are theirs to give: ask them what they hold, and ask them to correct or delete it.
A page we host for a business carries its name and speaks for it. We set nothing on your device there and we do not measure your visit. Before a booking is made, a booking page asks Cloudflare to check that a person rather than a script is booking, as described under Who else touches it.
If you cannot reach them or they will not answer, write to support@backendfree.com and we will pass the request on and help where we lawfully can. What we cannot do is change or delete their records on our own initiative, because they are not ours to decide about.
Exactly what is held for a business, and for how long, is set out in the Data Processing Agreement, which is the contract every business using this platform is on. It is public, so you can read it.
Web analytics, and what it refuses to collect
If you switch on web analytics, you can measure how your own website is used. You are the controller for that measurement and we are your processor: you chose to measure and you decide what is measured. This section is what you need in order to describe it accurately in your own privacy notice.
We run the same measurement on our own public pages, as the controller rather than as anybody's processor, and everything below is as true of it.
Nothing is stored on or read from a visitor's device: no cookie, no local or session storage, and no fingerprinting.
What is never stored, and what is stored in its place:
| Never stored | What is stored instead |
|---|---|
| The visitor's IP address | A key derived from it that cannot be reversed and changes every day. |
| Their browser's user agent | Its kind (desktop, mobile or tablet), and the browser and operating system by name, never a version. For a known crawler, its name. |
| The query string of the page | The path only, plus the utm tags by name if there are any. |
| The full page they came from | Its hostname, and nothing at all when it is the same site. |
| Region, postcode or coordinates | A country and a city, and only where the deployment gets them from a network provider it trusts. |
The key cannot be turned back into an address, changes every day and differs on each website, so nobody, including us, can recognise a visitor from one day to the next or follow them from one site to another.
Individual events are deleted after 60 days. What is kept for about 25 months after that is daily counts: how many views, how many visits, which pages, which countries. Counts, with nothing in them that was ever about a person.
Where a browser sends Global Privacy Control or Do Not Track, nothing is recorded at all.
None of this builds a profile, targets advertising, or recognises anybody across websites or sessions, and no data is sold or shared with an advertising network.
Because you are the controller, a visitor asking to be taken out of it asks you rather than us.
One honest caveat if you are in the EU. Storing nothing on a device is what takes this outside the cookie consent rules, and Swiss law is satisfied by that plus the opt-out signals above. European regulators have taken a broader view of measurement that derives an identifier from an IP address, even without storage. This design deliberately matches the criteria under which audience measurement is treated as exempt from consent: first party only, no tracking across sites, no user identifier, no combining with other sources, statistics only, and an opt-out that works. The final assessment for your own site is yours to make, and the facts above are given so you can make it.
Payments
No card number, expiry date or security code ever reaches this platform. Card details are entered on the payment provider's own pages and stay with them.
For your subscription with us, Stripe holds the card and a customer record, and we hold its reference plus the state of the subscription. For payments a business takes from its own customers, the money goes directly to that business's own account with the provider and never passes through us; we keep a record of the amount, the currency, the status and the payer's name and email address, so the business has its own books.
Payment records are accounting records. They are kept even when the website they belonged to is deleted, and even when the account is closed, because Swiss law requires business records to be retained for ten years.
We send sign-in codes, warnings when you are approaching a monthly allowance, messages about your account or a change to these documents, and, when you ask for it, each message your website's contact form receives. On behalf of businesses using the platform, we also send booking confirmations and cancellations to their customers.
All of it goes out through Resend, who process the address and the message in order to deliver it. There are no marketing emails, no newsletter and no tracking pixels in anything we send.
Logs and diagnostics
The application writes operational logs so that faults can be diagnosed. Those logs contain email addresses, for example when a sign-in code is sent or a booking confirmation goes out. They do not contain IP addresses, request bodies, passwords, keys or card data.
When something in the service fails, a technical report of the fault goes to Sentry, our error tracking service, with email addresses, keys and IP addresses removed before it leaves our servers. The content of the request is never sent. Reports are stored in the European Union and kept for at most 90 days.
For a sample of requests and background jobs, Sentry also receives timings of the work inside each one, with none of the data it handled.
To enforce rate limits, IP addresses are kept for at most an hour, and for that and nothing else.
How long everything is kept
Your account content is kept for as long as your account exists. Everything that is not your content has its own limit, and these are the actual limits the scheduled jobs run on:
| What | Kept for |
|---|---|
| A sign-in code | 10 minutes before it stops working |
| An account whose address was never confirmed | Deleted after 24 hours |
| Your signed-in session | 14 days |
| Session details (IP address, user agent) | Until shortly after the session ends, 14 days at most |
| Retry protection on an API write | 24 hours |
| The log of webhooks we sent your server | 30 days |
| Test data: what a test key booked or paid, and who for | 30 days, or until you delete it |
| Messages a website's contact form received | 365 days, and spam 30 days, or until the business deletes them |
| Individual web analytics events | 60 days |
| Daily analytics counts | 760 days |
| Who touched a payment connection, and from where | 365 days |
| Messages received from a payment provider | 180 days |
| Messages received from our billing provider | 180 days |
| Fault reports and request timings, at Sentry | At most 90 days |
| Payment and refund records | Ten years, as accounting records |
Deleting a website deletes its content, its appointments, its customer records and its messages, and deletes its analytics. Deleting your account does the same for every website on it and then deletes the account. Both are immediate and neither can be undone. Payment records and the accounting trail survive, as described above. Test data is what a website's test keys made while it was being tried out. It goes after 30 days, or at once when you delete it, test payments included, since none of it is an accounting record.
Who else touches it
Stripe processes payments, both your subscription and the payments your own customers make to you. Resend delivers our email. Our hosting provider runs the servers and the database. A separate storage provider keeps encrypted backups of the database. Sentry receives a report when something in the service fails. On the sign-in and sign-up forms, Cloudflare Turnstile checks that a person rather than a script is asking, before we email the address given, and on a business's booking page it checks the same before a booking is made. Its script sends Cloudflare your IP address, your browser's user agent and characteristics of your browser. Cloudflare says it sets no cookies and uses those signals only to detect bots and to improve how it does so. Cloudflare, Inc. sits in front of the service: every request passes through it on the way to our servers, and a visitor's country and city can come from it. No other company touches it.
The sub-processor list names each one and what it does. We do not sell personal data, we do not share it with advertisers or data brokers, and we do not use it to train machine learning models.
We disclose data to an authority only where we are legally obliged to, and we will tell you unless we are forbidden from doing so.
Where it goes
The database and the application run in Switzerland or the European Economic Area. Switzerland is recognised by the European Commission as providing adequate protection, and the EEA is on the Swiss Federal Council's own list, so data moving in either direction between them needs nothing further.
DigitalOcean, LLC, which runs the servers and the database, is a company based in the United States. Backblaze, Inc., which keeps the encrypted backups, is a company based in the United States. Cloudflare, Inc., which carries requests to the service, is a company based in the United States. Cloudflare, Inc., which keeps the images you upload, is a company based in the United States. The data stays where the paragraph above says, but a company can be required by the law of the country it is based in to hand over what it stores elsewhere. We treat that as a possible transfer, resting on the same safeguards as the transfers described next.
Requests reach the service through Cloudflare, Inc., which handles each one where it arrives: worldwide, at the Cloudflare data centre nearest each visitor. Handling a request outside Switzerland and the European Economic Area is a transfer, and rests on the same safeguards as the transfers described next.
Stripe, Resend and Sentry are United States companies and processing by them may involve a transfer there, Sentry's included although its reports are stored in the European Union. Those transfers rely on the European Commission's Standard Contractual Clauses, with the amendments the Swiss Federal Data Protection and Information Commissioner requires for data under Swiss law, or on those companies' certification under the EU-US and Swiss-US Data Privacy Frameworks where that applies. You can ask us for a copy of the safeguards in place.
Cloudflare, which runs the check on the sign-in and sign-up forms and on booking pages, is a United States company too, and that check rests on the same safeguards.
How it is protected
Personal data is protected by technical and organisational measures suited to the risk, including encryption in transit, separation between accounts, and access limited to those who need it. Annex 2 of the Data Processing Agreement lists them.
Signing in needs access to your email account. You can add an authenticator app as a second step from your profile, which is optional.
Why we are allowed to do this
Under Swiss law, processing personal data to run a service somebody asked for needs no separate justification, provided it is done transparently, in good faith and proportionately, which is what this notice is for. Where European data protection law applies to you, the bases are these:
- Performing our contract with you
- Your account, your websites, your subscription, our support, and the emails that are part of the service.
- Our legitimate interests
- Keeping the service secure and available, preventing abuse, rate limiting, the audit log on a payment connection, and diagnosing faults. We keep these narrow and we do not use them for marketing.
- Our legitimate interest in how our own pages are read
- Counting visits to our public pages with the web analytics described above, which recognises nobody and stores nothing on your device, so we can tell what visitors find and what they miss.
- A legal obligation
- Keeping accounting records, and answering a lawful order.
- On a customer's instructions
- For appointments, customers, contact form messages and website measurement, we act as processor and the business using the platform provides the basis.
We do not process special category data, we make no automated decision that produces a legal effect for anybody, and we do not build a profile of anybody in order to predict or evaluate them.
Your rights
Whether you are in Switzerland, the EU or the EEA, you can ask us for a copy of the data we hold about you, to correct it, to delete it, to restrict or object to what we do with it, and to receive it in a common machine readable format so you can take it elsewhere.
Write to support@backendfree.com. We answer within thirty days, and we tell you if we need longer and why. We do not charge for this. We may need to confirm who you are, and we will not ask for more identification than the request needs.
Much of it you can do yourself: your account details are editable in your dashboard, your published content can be read through the API, and you can delete your entire account from the account screen.
If your data was given to a business using this platform rather than to us, we will pass your request to them and help where we lawfully can, but they are the ones who decide and who must answer.
Children
This is a product for people running a business and it is not directed at children. You must be at least 16 to hold an account. If you believe a child's data has reached us, tell us and we will delete it.
If a business uses this platform to take bookings from children, that is their responsibility to get right, including any parental consent their law requires.
If something goes wrong
If personal data is breached in a way that puts somebody at risk, we notify the Swiss Federal Data Protection and Information Commissioner as quickly as possible, and any other supervisory authority entitled to hear it within 72 hours of becoming aware of it. We tell affected people directly where the risk to them is high, or where an authority asks us to.
Where we hold data as processor for a business using the platform, we tell that business without undue delay so they can meet their own duty, and we give them what they need to do it.
Complaints
Tell us first at support@backendfree.com and we will try to put it right. You do not have to: you can complain directly to the Swiss Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern, or, if you are in the EU or the EEA, to the supervisory authority where you live, where you work, or where you think something went wrong.
Changes to this notice
We update this notice when what we do changes. The date at the top is the last revision. If a change materially affects you we email account holders before it takes effect rather than quietly editing the page.
If you hold data on your own customers through this platform, the Data Processing Agreement is the document that governs it, and changes to sub-processors are notified as described there.