Privacy Policy

Effective Date: September 9, 2026

Company Name: Beespoke Services Ltd (trading as Backona)
Website: backona.com, backona.ai and subdomains
Contact Email: [email protected]
Company Address: 4th Floor, 18 St. Cross Street, London, United Kingdom, EC1N 8UN

At Beespoke Services Ltd, trading as Backona ("Backona," "we," "us," or "our"), we are committed to safeguarding the privacy and security of your personal data. This Privacy Policy outlines how we collect, use, and protect the personal data of users who interact with our website and use our products and services—including Backona AI, Backona CMP (Consent Management Platform), Backona CA (Clever Analytics), Backona SST (Server Side Tagging), and our consulting and other services—in compliance with the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and relevant international data privacy laws.

1. Our Role: Controller and Processor

Our role under data protection law depends on whose personal data is processed and why. This Privacy Policy describes the personal data for which we are the data controller. It does not describe, and does not determine the purposes of, personal data that we process as a processor on behalf of a business customer.

1.1 Where we act as data controller

Beespoke Services Ltd is the data controller for:

• personal data of our own customers and prospective customers, including account, billing, support and product usage data;
• personal data of visitors to our own websites at backona.com and backona.ai and their subdomains;
• personal data of individuals who contact us, subscribe to our communications, or are invited to a Backona workspace.

For any inquiries regarding this processing, please contact us at [email protected].

1.2 Where we act as data processor

Where a business customer uses our products to process personal data relating to visitors of their own websites and applications, that customer is the data controller and we are their data processor. This applies in particular to:

• Backona CMP: consent records collected through a consent banner that our customer deploys on their own properties;
• Backona SST: event and identifier data forwarded through a Server Side Tagging container that our customer configures;
• Connected third-party accounts: data we retrieve from a customer's Google, Meta or other connected accounts at their instruction.

For that personal data our customer determines the purposes and means of processing, and our obligations are set out in our Data Processing Agreement. Under the CCPA and comparable U.S. state privacy laws we act as a service provider in respect of that data.

If you are a visitor to a website that uses Backona CMP and you have a question about your consent record, see Section 15 below.

2. Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Data Collected via Backona Products and Services

• User Input Data: Information you provide when interacting with our products (e.g. Backona AI queries and commands, configuration in Backona CMP, Backona CA, or Backona SST). This data is processed to deliver the requested functionality and insights.
• Interaction Logs: Data related to your usage of our products and services, such as interaction history, frequency of use, and session duration. This information helps us improve functionality and user experience.
• Technical Data: Information about the device and software you use to access our products and website, including IP address, device type, browser information, and operating system.
• AppSumo Data: If you purchase Backona AI through a third-party marketplace such as AppSumo, we may receive limited personal data (such as your name, email address, and plan tier) for the purpose of activating and managing your access. This data is used strictly to fulfil our contractual obligations and will not be used for unrelated marketing without consent.
• Google API Data: Where a product supports it (e.g. Backona AI), we access and process users' enabled Google API data through authorized OAuth connections, strictly limited to the scopes explicitly consented to by users. This may include data from Google Analytics 4 (website traffic and engagement metrics), Google Search Console (search performance, queries, impressions, click-through data), and Google Ads (campaign performance, keyword data, ad spend, and demographic insights), depending on which integrations you enable.
• Facebook Marketing API Data: Where a product supports it (e.g. Backona AI), if you choose to connect your Facebook account, we access data from the Facebook (Meta) Marketing API through an authorized OAuth connection. This includes advertising account metadata (account name, currency, timezone), campaign data (status, budgets, objectives), performance insights (impressions, clicks, spend, reach, conversions), and pixel tracking data. Access is strictly limited to the scopes you explicitly consent to during the Facebook authorization process (ads_read, ads_management). We store only your OAuth access token and its expiration date; we do not collect your Facebook profile information (such as name, email, or profile picture).

2.2 Data Collected via the Website

• Identification and Contact Data: Information you provide through forms on our website, such as name, email address, and other contact details, typically during registration, inquiries, or newsletter sign-ups.
• Usage Data: Information about your interaction with our website, including pages visited, time spent on the site, and navigation patterns. This data is collected through cookies and similar technologies.
• Technical Data: Information related to the device you use to access our website, such as IP address, browser type, and operating system.

2.3 Organization and Team Member Data

When you create an organization or invite users to join your workspace in products that support this (e.g. Backona AI), we process the following personal data:

• Name, email address, and role of invited users
• Metadata such as invitation date, inviter's email, and whether the invite was accepted
• Login data if the invitee joins the platform

You confirm that you have appropriate permission to provide personal data of others when inviting team members. The invitee may choose to access Backona using a different email address from the one you provided. This data is used solely for facilitating access to our products and will not be used for marketing without explicit consent.

3. Purpose and Legal Basis for Processing

We process your personal data for the following purposes and under the following legal bases:

3.1 Backona Products and Services

• Performance of a Contract: To provide the Backona products and services you request, including processing your inputs, configurations, and data to deliver tailored insights, consent management, analytics, and other functionality.
• Legitimate Interests: To analyze usage patterns, improve our products' functionality, and develop new features based on user interactions.
• Inviting Team Members and Managing Organizations: Where a product supports teams (e.g. Backona AI), we process the personal data of invited users under our legitimate interests in enabling team collaboration and managing user accounts. It is the inviter's responsibility to ensure they have the invitee's consent or authority to share their information.

3.2 Website

• Performance of a Contract: To manage your account, respond to inquiries, and provide you with information and services.
• Legitimate Interests: To monitor and improve our website, personalize your experience, and conduct marketing activities.
• Consent: For sending marketing communications and storing non-essential cookies on your device. You can withdraw your consent at any time by contacting us at [email protected].
• Transactional Communications on Behalf of Users: Our products (e.g. Backona AI) may send system-generated emails (e.g. team invitations) to users on behalf of another user. These are transactional and necessary to enable product functionality, and not considered marketing communications.

4. Cookies and Similar Technologies

To ensure our website and applications function securely and effectively, Backona utilizes cookies and similar tracking technologies. We categorize these cookies based on the specific services you interact with, such as our informational website and the Backona AI product platform.

4.1. Website and General Service Cookies

For visitors navigating our primary website and related promotional pages, we utilize various cookies to manage performance, analytics, and user preferences. Detailed information regarding these specific cookies—including their providers, purposes, and expiration dates—is dynamically maintained and available within the Cookie Consent Banner presented upon your first visit to the site. You may review and update your consent preferences for these website-specific cookies at any time via the banner settings.

4.2. Backona AI Product Cookies

When you access and use the core Backona AI product, we deploy specific, purpose-driven cookies to facilitate secure authentication, maintain session continuity, and process transactions correctly. Below is an outline of the cookies utilized by the Backona AI product application:

Necessary and Functional Cookies

These cookies are essential for the core operation of the application, including security and transaction processing.

• appSelectedPricePlan
  • Expiration: 1 Week
  • Purpose: Temporarily retains the subscription plan ID selected by the user on the pricing page to seamlessly transition to the Stripe checkout process.
  • Justification: This cookie is essential for finalizing transactions. Without it, the user would lose their selected plan during checkout. Furthermore, when enforcing localized pricing (e.g., presenting prices in PLN), the absence of this cookie could result in currency or pricing discrepancies, causing user confusion and checkout failure.
• appSessionId
  • Expiration: 1 Week
  • Purpose: Acts as the primary identifier for your authenticated user session within the application.
  • Justification: Essential for maintaining access to your account and securely cross-referencing your session in our database. It ensures that when you explicitly log out, the session is appropriately cleared from our secure servers.
• csrfToken
  • Expiration: Session (cleared when your browser is closed)
  • Purpose: Stores a unique cryptographic token utilized during the authentication process.
  • Justification: A critical security requirement designed to protect user accounts and the application infrastructure against Cross-Site Request Forgery (CSRF) attacks.
• appLastLoginEmail
  • Expiration: 6 Months
  • Purpose: Stores an encoded reference to your last successfully used email address to present a streamlined "Continue as..." login suggestion upon your return.
  • Justification: While not strictly necessary to use the application, this cookie significantly reduces authentication friction. If declined or cleared by the user, the application functions normally, but the user will be required to manually re-enter their email credentials upon their next visit.

5. Data Sharing and Transfers

5.1 Data Processors and Third-Party Services

We do not sell your personal data. We may share your data with trusted third-party service providers who process data on our behalf, including:

• Infrastructure Providers: Such as cloud infrastructure providers for hosting and Docker images repository for code distribution.
• AI Model Integrations: Including OpenAI and Anthropic Claude for AI processing, and LangChain for interaction logging.
• Analytics and Marketing Tools: Such as Google Analytics, Matomo, Microsoft Clarity, Google Ads, Facebook Pixel, and LinkedIn Marketing.
• Email Communication Providers: Such as Sender, for managing newsletters and transactional email communications.
• Google APIs: If you enable Google integrations in a product that supports them, data is exchanged with Google via the Google Analytics API, Google Search Console API, and/or Google Ads API to retrieve your analytics, search performance, and advertising data. This data is transmitted securely and processed solely to deliver the relevant product features.
• Facebook (Meta) APIs: If you connect your Facebook Ads account to a product that supports it (e.g. Backona AI), data is exchanged with Meta via the Facebook Marketing API to retrieve your advertising account information, campaign data, and performance insights. This data is transmitted securely and processed solely to deliver the relevant product features.
• Marketplace Platforms: If you register through AppSumo, we may receive and share minimal personal data with AppSumo to confirm license validity and usage for fraud prevention or technical support purposes.

Your data may be transferred to and processed in countries outside the UK and EEA, including the United States (e.g., by OpenAI, Anthropic, Stripe, and Google). Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on the service provider's certification under the EU-U.S. Data Privacy Framework, where applicable.

List of all Third-Party Services Used within Backona Products and Services

The table below covers the third parties involved across our products and our own website, and applies to the personal data for which we are the controller (Section 1.1). It does not describe the processing of consent records collected through a customer's Backona CMP banner. Consent records are stored only on infrastructure operated by OVHcloud in London, United Kingdom, and are not shared with any of the AI, analytics, advertising, payment or communication providers listed below. The authorised sub-processors for that data are listed in Annex 2 of our Data Processing Agreement.

5.2 AI/ML Models Training

We do not retain user data obtained through Google Workspace APIs or other third-party APIs for the purpose of developing, improving, or training generalized AI or machine learning models. We strictly use data in accordance with user permissions and only to deliver the core functionalities of our products. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. The use of other APIs data will adhere to the API provider's terms of service and privacy policy.

5.3. Google Workspace API Data Usage

Backona's use and transfer of information received from Google Workspace APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use of user data requirements.

5.4. Facebook (Meta) Marketing API Data Usage

Where a product supports the Facebook Marketing API (e.g. Backona AI), we access it solely to provide advertising analytics and campaign management features. Data retrieved from the Facebook Marketing API (including ad account details, campaign information, performance metrics, and pixel data) is:

• Used exclusively to deliver the core analytics functionalities of that product as requested by the user.
• Not sold, leased, or transferred to any unrelated third party.
• Not used for developing, improving, or training generalized AI or machine learning models.
• Not used for purposes unrelated to the service the user has authorized.

Our use of the Facebook Marketing API complies with Meta's Platform Terms and the Meta Developer Policies. You may revoke Backona's access to your Facebook data at any time by disconnecting your Facebook account in the product's settings or by removing the app from your Facebook Business Integrations settings.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting obligations. The following retention periods apply:

• Account data (name, email, login credentials): Retained for the duration of the active account, plus 12 months after account closure for legal and audit purposes.
• Interaction logs and usage analytics: Retained for up to 24 months from the date of collection.
• Marketing data (newsletter preferences, consent records): Retained until you withdraw consent or unsubscribe.
• Team invitation metadata: Retained for up to 12 months for audit and security purposes, even if the invitation is not accepted. Users may request deletion of unaccepted invites by contacting us.
• Third-party integration data (Google, Facebook): Deleted upon disconnection of the integration or within 30 days of a deletion request.
• Payment and transaction records: Retained for up to 7 years to comply with tax and financial reporting obligations.

Where data is no longer needed for its original purpose and no legal obligation requires further retention, it will be securely deleted or anonymised.

6.1 Backona CMP Consent Records

Consent records collected through a customer's Backona CMP banner are processed by us as a processor on that customer's behalf, and the customer decides how long they are kept. Where the customer has not instructed otherwise, our default retention is:

• Consent records: Automatically deleted 24 months after the last consent action recorded against the consent identifier. Where a visitor takes a further consent action, the 24-month period restarts from that action.
• Consent history per identifier: The 10 most recent consent actions are retained; earlier actions are discarded as new ones are recorded.
• Retention after a customer's subscription ends: Consent records are retained on the same schedule. The record exists so that our customer can demonstrate that consent was obtained, as required by Article 7(1) UK GDPR, and deleting it when their subscription ends would destroy their own evidence. During that period we use the records for no purpose other than making them available to that customer. A customer may instruct us to delete them earlier at any time.
• Consent cookies on the visitor's device: The consent identifier cookie (cBConsentId) and consent state cookie (cBModeMap) are first-party cookies set on the visitor's own device with a lifetime of 365 days.

Full details, including exactly what each consent record contains, are set out in Section 11 and Annex 1 of our Data Processing Agreement.

7. Data Security

We implement robust security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption of data in transit using TLS/SSL protocols.
• Secure storage of authentication tokens and credentials with restricted access.
• Use of CSRF protection and state validation for third-party OAuth flows (e.g., Google, Facebook).
• Regular review of access controls and security practices.
• Infrastructure hosted with reputable providers that maintain industry-standard physical and network security.

While we take reasonable steps to safeguard your data, no method of electronic transmission or storage is completely secure. We encourage users to take their own precautions, such as using strong passwords and keeping login credentials confidential.

Business customers assessing us as a vendor will find our technical and organisational measures set out in detail in Annex 3 of our Data Processing Agreement.

8. Children's Data

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that personal data has been collected from a person under 18 without appropriate parental or guardian consent, we will take steps to delete that data promptly. If you believe that we may have inadvertently collected data from a minor, please contact us at [email protected].

9. Automated Decision-Making and Profiling

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you. While our products (e.g. Backona AI) use artificial intelligence to generate insights and analytics, these outputs are intended as informational tools only and do not constitute automated decisions about individuals.

10. Your Rights Under GDPR

You have the following rights concerning your personal data:

• Right to Access: Obtain a copy of your personal data.
• Right to Rectification: Correct any inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data under certain circumstances.
• Right to Restrict Processing: Request limited use of your data under certain conditions.
• Right to Object: Object to the processing of your personal data based on our legitimate interests.
• Right to Data Portability: Request your data in a structured, commonly used format.
• Right to Withdraw Consent: Withdraw any consent given for processing at any time.
• Right to Lodge a Complaint: Lodge a complaint with the UK Information Commissioner’s Office (ICO): www.ico.org.uk / Tel: +44 303 123 1113

To exercise these rights, please contact us at [email protected].

11. Third-Party Purchases and Marketplace Deals

If you access any Backona product (e.g. Backona AI) through a third-party deal platform such as AppSumo, your rights under this policy remain unaffected. However, your interactions with the marketplace itself (e.g. refunds, purchases) are governed by their privacy and data practices.

12. Revoking Third-Party Integrations

You may disconnect or revoke any third-party integration at any time:

• Google: Revoke access from your Google Account permissions or by disconnecting within the relevant Backona product's settings (e.g. Backona AI Settings).
• Facebook (Meta): Revoke access from your Facebook Business Integrations settings or by disconnecting within the relevant Backona product's settings (e.g. Backona AI Settings).

Upon revocation, Backona will no longer be able to access data from the disconnected service. Previously retrieved data may be retained in accordance with Section 6 (Data Retention) unless you request its deletion.

12.1 Facebook Data Deletion

If you wish to have your Facebook-related data deleted from Backona, you may do so in any of the following ways:

1. From within the product: In the Backona product that uses Facebook (e.g. Backona AI), navigate to Settings and disconnect your Facebook account. This will immediately remove your stored Facebook OAuth access token and revoke Backona's ability to access your Facebook data.
2. From Facebook directly: Go to your Facebook Settings > Business Integrations, find "Backona" in the list, and click Remove. This revokes Backona's access. To also delete the data already stored by Backona, please follow up with a deletion request as described below.
3. By contacting us: Send an email to [email protected] with the subject line "Facebook Data Deletion Request". Please include the email address associated with your Backona account. We will process your request and delete all Facebook-related data associated with your account within 30 days, in accordance with applicable data protection laws.

What data is deleted: Upon a deletion request, we remove your Facebook OAuth access token, access token expiration data, Facebook Ads account configuration, and any cached Facebook advertising data (campaign data, insights, and pixel data) associated with your account.

Confirmation: Once the deletion is complete, we will send a confirmation to the email address associated with your Backona account.

13. International Representation and B2B Requests

Our Data Processing Agreement applies automatically where we process personal data on your behalf as a business customer, and forms part of our Terms of Use. If you require a separately executed copy for your records, or if you are located in the EU and require local representation under Article 27 of the GDPR, please contact us at [email protected].

14. U.S. State Privacy Notice

Backona does not sell or share personal data as defined under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) or other applicable U.S. state privacy laws.

If you are a resident of California or another U.S. state with applicable privacy legislation, you have the right to:

• Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Request disclosure of the categories of sources from which personal information is collected.
• Request disclosure of the business or commercial purpose for collecting your personal information.
• Request disclosure of the categories of third parties with whom we share your personal information.
• Request deletion of your personal information, subject to certain exceptions.

To exercise any of these rights, please contact us at [email protected]. We will respond to verifiable requests within the timeframes required by applicable law.

Where we process personal information on behalf of a business customer, we act as a service provider under the CCPA. We process that personal information only to perform the services specified in our agreement with that customer, we do not sell or share it, we do not retain, use or disclose it for any other purpose, and we do not combine it with personal information from other sources except as the CCPA permits a service provider to do. The full service provider terms are in Section 13 of our Data Processing Agreement. If your request concerns data held on behalf of one of our customers, please direct it to that business; see Section 15 below.

15. If You Are a Visitor to a Website Using Backona CMP

This section is for people who reached this page from a cookie banner on someone else's website.

If you saw a cookie consent banner powered by Backona CMP, that banner belongs to the operator of the website you were visiting, not to Backona. That website operator is the data controller for your consent choices. They decide what the banner says, which categories it offers, which cookies and trackers their site uses, and how long your consent record is kept. Backona operates the banner on their behalf as their processor, under our Data Processing Agreement.

What we store when you make a consent choice. Where the website operator has enabled the consent audit log, we record a randomly generated consent identifier held in a first-party cookie on your device, which of the consent categories you accepted or rejected, the time of your choice, the address of the page you were on and the website's hostname, an identifier for the website operator's own configuration, your browser's user agent string, and the version of the consent notice in force at the time.

We also record your IP address, but only in truncated form: we remove the final part of the address before storing it, so what remains identifies a broad range of addresses rather than your connection. The full address is never written to our storage. We do not look up your location from it.

We do not collect your name, email address, telephone number or any account identifier through the banner, and we do not use the consent identifier to track you across different websites.

How to exercise your rights. Because the website operator is the controller, please direct any request about your consent record to them. You can find their contact details in the privacy notice linked from the banner. You can help them locate your record by quoting your Consent ID, which is shown to you in the banner's preferences panel. On their instruction we will provide or delete the record we hold for that identifier.

Changing or withdrawing your choice. You can reopen the banner's preferences panel on the website in question at any time to change or withdraw your consent, and you can clear the consent cookies through your browser settings.

If you contact us directly about a consent record, we will tell you that the request needs to go to the website operator and pass it on to them, as we are not permitted to act on it without their instruction.

Contact Information

Beespoke Services Ltd (trading as Backona)
4th Floor, 18 St. Cross Street,
London, United Kingdom, EC1N 8UN
[email protected]