LEGAL — PRIVACY POLICY
Privacy Policy
Last updated
In plain words
We collect as little as we can. The public site sets no cookies and uses cookieless, aggregated analytics. We only learn who you are if you send us something — a contact form, a request to email your audit result, or a scan report purchase — and we use it to answer you and deliver what you asked for. Our database is hosted in the EU. We never sell your data, and you can ask us to see, correct or delete it at any time.
Who is responsible
The controller of your personal data is the operator of backloo.com (Backloo):
- Email: hello@backloo.com
For anything privacy-related, including exercising your rights, write to hello@backloo.com.
When you browse the site
The site is hosted on Vercel. To deliver pages and protect the site, Vercel processes technical request data such as your IP address, browser type and the page requested.
We measure traffic with Vercel Web Analytics and Speed Insights. They set no cookies, build no personal profiles and show us only aggregated numbers — page views, referrers, countries, device types and page speed — plus anonymous counts of actions such as “form sent”.
Cookies and browser storage
The public site sets no cookies, so there is no cookie banner. It does use your browser's own storage, which never leaves your device on its own:
- First-touch attribution (local storage): the page you first landed on, the referring site and any UTM campaign tags. It is sent to us only if you submit the contact form, together with your message.
- Session storage (cleared when you close the tab): carries your Rescue Audit result to the contact form if you choose to send it, and stops the same analytics event from being counted twice.
- Client portal: invited clients who sign in get a sign-in token stored in their browser, which is strictly necessary to keep them signed in.
You can clear this storage at any time in your browser settings.
The contact form
When you write to us via the form on /contact or the homepage, we receive your name, email, project type, optional budget, your message, your Rescue Audit result if you attach it, and context about the visit: landing page, referrer, UTM tags, the page you sent the form from and your language. A hidden spam trap field helps us filter out bots.
We store the inquiry in our database and send two emails: a confirmation to you and a notification to us. We use the data to reply and to prepare a possible project (steps taken at your request before a contract, Art. 6(1)(b) GDPR). We use the attribution details to understand which channels bring inquiries (legitimate interests, Art. 6(1)(f) GDPR).
The Rescue Audit
Your audit answers are processed in your browser. We only see anonymous, aggregated analytics counts (such as how often each answer is chosen), never linked to you. If you share your result, the answers are encoded in the link itself. If you ask us to email you the result, we store your email address and the result as an inquiry and send you one email. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us.
The Website Scan
- What we store: the address you submit, the scan results and a keyed hash (HMAC) of your IP address. We never store the IP address itself; the hash is used only to limit scans to 5 per connection per day and is deleted together with the scan.
- What we fetch: the public content of the scanned website. Google's PageSpeed Insights API receives the address to measure performance.
- Unpaid scans are deleted automatically after 30 days.
- If you buy the full report, Polar processes your payment as an independent controller under its own privacy policy. We receive your email address and the order status, and we email you the private report link.
- The AI-written part of the report is generated by sending the scan findings and the scanned site's public page text to Anthropic's Claude API. No personal data about you as the buyer is sent.
- Paid reports are kept so your link keeps working, until you ask us to delete them.
Running the free scan and preventing abuse are based on our legitimate interests (Art. 6(1)(f) GDPR). Delivering a paid report is necessary to perform the contract (Art. 6(1)(b) GDPR).
Client portal
Clients we invite to the portal get an account with their email address and a securely hashed password. We process this account and the project data shared there to provide the portal (Art. 6(1)(b) GDPR) for as long as you have access, or until you ask us to delete it.
Who processes your data
We share data only with the providers that run the site for us, each only for its task:
| Provider | Role | Location |
|---|---|---|
| Vercel | Website hosting, serverless functions, cookieless analytics | USA |
| Convex | Database for inquiries, scans and portal accounts | EU region (Ireland) |
| Resend | Sending confirmations, results and report links by email | USA |
| Polar | Payments for the full report — merchant of record and independent controller | USA |
| Anthropic | Generating the AI-written part of the paid report | USA |
| PageSpeed Insights API for performance measurements | USA |
Where data is transferred outside the EU/EEA, the transfer relies, where applicable, on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. We never sell your data or use it for advertising.
How long we keep it
- Inquiries (contact form, emailed audit results): up to 24 months after our last contact, unless a contract follows — then for the duration of the contract and the periods the law requires.
- Unpaid scans: 30 days.
- Paid scans and reports: until you ask us to delete them.
- Accounting records: as long as tax and accounting law requires.
Your rights
Under the GDPR you have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, object to processing based on legitimate interests, and withdraw your consent at any time without affecting earlier processing. Write to us and we will respond within one month. We do not make automated decisions about you that have legal or similarly significant effects.
You can also lodge a complaint with a supervisory authority — in Slovakia the Úrad na ochranu osobných údajov SR, in the Czech Republic the Úřad pro ochranu osobních údajů, or the authority in the EU country where you live or work.
Changes to this policy
We update this policy when our tools or providers change. The date at the top shows the current version; material changes are announced on this page.