Privacy policy

1. Who is responsible for your data?

Backify is operated by Firesub AB, Gotö långgata 58, 725 91 Västerås, Sweden (registration number 556847-0578; VAT SE556847057801). Firesub AB is the data controller for personal data used to operate the Backify website and platform, manage accounts and subscriptions, secure the service, and respond to enquiries. In this policy, “Backify,” “we,” and “us” refer to Firesub AB. You can contact us at hello@backify.dev.

Applications built with Backify have their own data responsibilities. The organization operating an application generally decides why and how its users’ personal data is processed. Where Backify processes application data on that organization’s behalf, its instructions and the applicable service and data-processing agreements govern that processing.

2. Data we process

Account & organization

Name, email address, sign-in identifiers, organization membership, teams, roles, and access assignments. Information may come from you, your organization’s administrators, or the identity provider you use.

Billing & subscriptions

Company and billing contact details, tax identifiers, subscription selections, usage records, and payment or invoice references. Stripe processes payment details through its hosted payment flows.

Development & deployment

Application configuration, connected repository references, build and deployment records, approvals, recorded development requests, and associated coding-tool metadata. Source code and artifacts may be processed as part of the workflow you initiate.

Service & security records

Request and diagnostic information such as IP addresses, browser or device information, timestamps, errors, and audit events used to operate and protect the service.

Support & application content

Messages and information you send us, and content submitted to applications or platform capabilities, which may contain personal data depending on your use.

Only submit personal data you are authorized to use. Keep passwords, access tokens, and unnecessary sensitive information out of development requests, source code, and support messages.

3. Why we process personal data

Where the GDPR applies, the legal basis depends on the activity and our relationship with you:

• Providing the service: creating accounts, authenticating users, running requested workflows, managing subscriptions, and providing support. We rely on performance of a contract with you, or our legitimate interest in providing the service to your organization when it is the customer.
• Operating and protecting Backify: managing organization access, investigating errors and abuse, maintaining audit records, and improving reliability. We rely on our legitimate interests in running a secure, dependable platform, balanced against your rights.
• Meeting legal requirements: maintaining required accounting records and responding to lawful requests. We rely on the applicable legal obligation.
• Optional activities requiring consent: where we ask for consent, we explain the purpose when requesting it. You can withdraw that consent without affecting processing that took place before withdrawal.

Some account and billing information is necessary to provide the service or meet legal requirements. Without it, we may be unable to create an account, process a subscription, or fulfil your request.

4. AI and connected development tools

When you connect a coding tool or use an AI capability, the information processed depends on the tool, model, permissions, and workflow you choose. Prompts, relevant code, application content, and outputs may be processed by the selected provider to carry out that request.

Connected workflows can record your development requests and metadata such as the coding tool, model, SDK version, and source revision as application history. These records can include personal data you place in the request.

Your independently selected coding assistant also handles data under its own terms and privacy policy. Review its data-use, training, and retention settings, together with the terms for any model service you enable. Do not assume every tool or model has the same data practices.

5. Sharing, hosting, and international transfers

Data may be accessible to authorized members of your organization according to their access, and to service providers needed to run the selected workflow. These include hosting and infrastructure providers, identity providers, Stripe for billing, GitHub for connected source control, and model or integration providers you enable. External services may also act as independent controllers for their own activities.

We may disclose relevant data where required by law or necessary to investigate abuse, protect the service, or establish, exercise, or defend legal claims.

Backify-managed hosting and deployment into your Azure subscription have different data boundaries. A selected application region applies to the relevant application resources; it does not mean all account, billing, support, deployment, or control-plane data stays in that region or your subscription. Changing a default region does not move existing data.

Providers and connected services may process data outside your country, including outside the EEA. Where the GDPR requires safeguards for a transfer, these must be addressed through the applicable arrangements, such as an adequacy decision or standard contractual clauses. Contact us to confirm the providers, locations, and transfer arrangements applicable to your service before submitting data with specific residency requirements.

6. Cookies and browser storage

The cookie consent notice lets you choose “Essential only” or “Accept preferences.” We store this choice as backify-cookie-consent in local storage so we can respect it on later visits. You can change your choice using Cookie settings in the footer.

Only if you accept preferences does the website save your theme as backify-theme and pricing currency and billing interval as backify-pricing in local storage. These preferences remain until you change them, withdraw consent or clear site data. Choosing Essential only removes saved theme and pricing preferences; you can still change them for the current page.

The website can read a backify-portal-auth indicator to choose between “Sign in” and “Go to portal.” This indicator does not grant access. Platform sign-in uses separate authentication and session mechanisms.

Website fonts are served from Backify's own website. Connected identity and payment services may use their own cookies when you visit them. We do not load advertising or optional analytics cookies on this website.

You can clear local storage or manage cookies in your browser. Blocking necessary session storage may prevent sign-in or other service features from working.

7. Retention and security

Retention depends on the purpose and category of data: account and organization records support the service relationship; deployment, diagnostic, and audit records support operations, security, and investigations; billing records follow applicable accounting requirements. Contractual obligations, unresolved disputes, and legal holds may require longer retention. Application content follows the relevant organization’s instructions and service arrangements.

Closing an account or deleting an application does not necessarily remove billing records, audit records, or backup copies immediately. Contact us for the retention and deletion arrangements that apply to your data.

Backify uses scoped access, separate deployment and runtime identities, server-side authorization, and audit records to protect platform operations. Application owners must also enforce authorization and configure their applications appropriately. See Security & governance for the platform’s security boundaries.

8. Your privacy rights

Depending on the law that applies, you may request access to, correction of, or deletion of your personal data; restriction of processing; or a portable copy of eligible data. You may object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you may withdraw it at any time.

Email hello@backify.dev with your request and enough context to locate the relevant account or service. We may need to verify your identity and authority before disclosing or changing data. Please do not send passwords or access tokens.

These rights are subject to applicable conditions and exceptions. You can also complain to your local data protection authority. The European Commission’s guidance on individual rights explains GDPR rights and how to exercise them.

9. Contact and policy updates

For questions about this policy, privacy requests, or the data-processing arrangements for your organization, contact Firesub AB at hello@backify.dev or by post at Gotö långgata 58, 725 91 Västerås, Sweden (registration number 556847-0578; VAT SE556847057801).

We may update this policy as the platform, our processing activities, or legal requirements change. The date at the top identifies the latest revision. Where required, we will provide additional notice of material changes.