Privacy Policy

1. Who operates Backfoot

Backfoot is operated by Backfoot Technologies Ltd (“Backfoot”, “we”, “us”, or “our”), company number 14723767, registered in England and Wales, with registered office at 3 Place Farm, Wheathampstead, St. Albans, England, AL4 8SB.

For privacy questions, contact privacy@backfoottech.com.

2. Information we may collect

Depending on how a business uses the service, Backfoot may process:

• Business and account information, such as a business name, team-member details, login information, and account settings.
• WhatsApp Business Account identifiers and related account or phone-number identifiers made available through Meta Embedded Signup.
• Customer conversation content, including messages sent to or from a connected business, where the business uses Backfoot to receive and respond to those messages.
• Message metadata and status information, such as timestamps, delivery or read status, message identifiers, and conversation assignments.
• Technical logs and security information needed to operate, troubleshoot, protect, and improve the service, such as access records, device or browser information, and error details.

We obtain this information from businesses and their authorised team members, from Meta and the WhatsApp Business Platform, from individuals who communicate with a connected business, and automatically through the operation and security of the service.

3. Why we process information

We process information to provide and maintain the shared inbox, connect a business’s WhatsApp Business Account, support authorised team access, manage message templates, display message status, respond to support requests, prevent misuse, maintain security, and comply with applicable legal obligations.

Where Backfoot determines the purpose of processing, we rely on:

• Contract, where processing is necessary to enter into or perform a contract with an individual.
• Legitimate interests in operating, administering, securing, troubleshooting, and supporting the service and preventing misuse, where those interests are not overridden by an individual’s rights and interests.
• Legal obligations where we need to process information to comply with applicable law.

Where a business uses Backfoot to handle customer and conversation information, Backfoot generally processes that information on the business’s instructions. The business is responsible for determining its lawful basis and providing any required notices.

4. Roles and instructions

For business customer data, the business using Backfoot will generally decide why customer and conversation information is used. Backfoot generally processes that information on the business’s instructions to provide the service. Businesses are responsible for giving appropriate notices, obtaining any required permissions, and using WhatsApp lawfully.

5. Service providers and sharing

We may share information with service providers that help us operate Backfoot, only as needed for those services and subject to appropriate contractual or organisational safeguards. These may include:

• Meta Platforms and the WhatsApp Business Platform, when a business connects and uses its WhatsApp Business Account.
• Cloudflare, for website and application hosting, content delivery, and network security.
• Amazon Web Services, for webhook ingestion, secure queueing, backend processing, application infrastructure, and operational logging.
• Supabase, for application data storage, authentication, and related backend infrastructure.

We may also disclose information where required by law, to protect rights and safety, or in connection with a business transfer, subject to applicable requirements. We do not sell personal information.

6. International transfers

Backfoot is established in the United Kingdom. Our direct AWS infrastructure is hosted in the United Kingdom, while our current Supabase project is hosted in Canada. Some service providers and subprocessors may also process information in the United States, Singapore, or other countries identified in their applicable data-processing terms.

Where personal information is transferred outside the United Kingdom, we use an applicable UK adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses. You may contact privacy@backfoottech.com for further information about the safeguards that apply.

7. Security

We use reasonable technical and organisational measures designed to protect information against unauthorised access, loss, misuse, or alteration. No internet service can guarantee absolute security. Businesses should protect their account credentials and limit access to authorised team members.

8. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to a business customer’s lawful instructions and applicable legal requirements. Our normal retention periods are:

• Conversation content: 90 days, unless a different period is configured or lawfully requested by the business customer.
• Failed-job information: 30 days after the failure is resolved.
• Usage and operational records that do not contain message content: 12 months.
• Customer-provided knowledge sources: until deleted by the customer or the customer relationship ends.
• Account and contractual records: for the customer relationship and for any additional period needed for legal, tax, accounting, or dispute-resolution purposes.

We may retain information for longer where required by law, needed to establish or defend legal claims, or lawfully instructed by a business customer. Deleted information may remain in protected backups until the applicable backup cycle expires.

9. Rights and requests

Depending on applicable law, individuals may have rights to access, correct, delete, restrict, or object to certain processing, and to receive a portable copy of certain information. If a request relates to a business customer’s data, we may refer the requester to that business or coordinate with the business as appropriate.

To ask a privacy question or make a request, email privacy@backfoottech.com with enough information for us to understand the request. We may verify the requester’s identity and authority before acting.

You also have the right to complain to the UK Information Commissioner’s Office. Information about making a complaint is available at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concerns first.

10. Automated decision-making

Backfoot does not use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.

11. Policy updates

We may update this policy from time to time. We will post the updated version on this page and update the date above. If a change materially affects how we use information, we will provide any additional notice required by law.