Privacy Policy

1. Who we are

Backstack ("Backstack", "we", "us", or "our") provides a self-hosted control plane for governing AI agents. This Privacy Policy explains what information we collect through this website (backstack.io, www.backstack.io, and site.backstack.io), how we use it, and the choices you have. It covers the marketing website only. It does not govern the Backstack product software once you run it, because that runs on infrastructure you control (see Section 3).

If you have any questions about this policy or your information, contact us at [email protected].

2. Information we collect

We deliberately collect as little as possible. There are three categories:

• Demo-request and contact information. When you submit the "Request a demo" form, we collect the email address you provide, along with the page you submitted from and a timestamp. If you email us directly, we receive your email address, your message, and anything else you choose to include.
• Server logs. Like most websites, our web server and our network provider may record standard technical request data such as IP address, browser user-agent, the page requested, and the date and time. These logs are used for security, abuse prevention, and basic operation of the site.
• Information you volunteer. Anything else you choose to send us in correspondence.

We do not run third-party analytics, advertising pixels, or behavioral tracking on this site, and we do not set tracking cookies. See Section 9.

3. The product is self-hosted

This is the most important point for most readers. The Backstack product runs as software on infrastructure you control. Your tools, credentials, audit logs, and the data flowing through your agents stay inside your own network. We do not receive, route, or store that operational data. By design, your production data does not reach us through normal use of the product. This policy is about the website and our communications with you, not about data handled inside your own deployment.

4. How we use information

We use the information above only to:

• Respond to your demo request and arrange access.
• Reply to emails and other messages you send us.
• Send occasional emails about the product, such as availability and meaningful updates. You can opt out of these at any time (see Section 7).
• Operate, secure, and troubleshoot the website.

We do not use your information for advertising, and we do not sell or rent it.

5. Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases of the GDPR and UK GDPR:

• Consent. When you submit the demo form, you consent to us contacting you about the product. You may withdraw consent at any time.
• Legitimate interests. We rely on our legitimate interest in operating and securing the website, responding to inquiries, and communicating with people who have asked to hear from us, balanced against your rights.
• Legal obligation. Where we must retain or disclose information to comply with applicable law.

6. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only in these limited cases:

• Service providers (subprocessors). We use a small number of providers to operate the site and our email. Today these are Cloudflare, which provides edge, tunnel, and content delivery for the website and processes connection metadata such as IP addresses, and Purelymail, our email provider, which handles email we send and receive. Demo-request submissions are delivered to and stored on our own self-hosted infrastructure rather than a third-party marketing platform.
• Legal and safety. If required by law, legal process, or to protect the rights, property, or safety of Backstack, our users, or others.
• Business transfers. If Backstack is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

7. Your rights and choices

Depending on where you live, you may have some or all of the following rights over your personal information: the right to access it, to correct it, to delete it, to restrict or object to its processing, to data portability, and to withdraw consent. If you are a California resident, the CCPA and CPRA give you the right to know what we collect, to request deletion, to correct inaccurate information, and to opt out of any sale or sharing. We do not sell or share personal information, so there is nothing to opt out of in that sense, and we will not discriminate against you for exercising any right.

To exercise any of these rights, or to unsubscribe from product emails, email us at [email protected] and we will action your request. Product emails also include an unsubscribe option. We will respond within the time required by applicable law.

8. Data retention

We keep demo-request and contact information for as long as needed to follow up with you and to send the product updates you asked for, and after that for a reasonable period for our records, unless you ask us to delete it sooner. Server logs are kept for a short operational window and then rotated or discarded. When information is no longer needed, we delete it or remove its identifying details.

9. Cookies and tracking

This website does not set tracking or advertising cookies, and we do not embed third-party analytics, advertising pixels, or social media trackers. The site loads only its own assets and a small script that powers the "Request a demo" form. That form sends the email you type, the page path, and a timestamp to our own self-hosted server when you submit it. If we ever introduce analytics or cookies, we will update this policy and, where required, ask for your consent first.

10. Security

We take reasonable technical and organizational measures to protect the information we hold, including serving the site over encrypted connections and limiting access to the systems that store demo-request data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to keep our footprint small.

11. International transfers

We operate from the United States, and our service providers may process information in the United States or other countries. If you access the site from outside these countries, your information may be transferred to and processed in a country whose data-protection laws differ from your own. Where required, we rely on appropriate safeguards for such transfers.

12. Children's privacy

This website and the Backstack product are intended for businesses and the people who run them. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page, and for significant changes we will provide a more prominent notice where appropriate. Your continued use of the website after an update means you accept the revised policy.

14. Contact

Questions, requests, or concerns about privacy? Email [email protected] and we will get back to you.

Last updated June 22, 2026.