Privacy Policy

Last updated: October 20, 2026 · Version 2026-10-20

1. Who We Are and What This Covers

Backsplice is operated by Backsplice LLC ("we", "us"). This policy explains how we handle information about the people who use the service and visit our website. For that information (account, usage and security, billing information, and messages you send us) we decide how it is used, as its controller.

The records an organization puts into Backsplice belong to that organization. We process them on its behalf, as its processor (a service provider under US state privacy laws), under our Data Processing Agreement ("DPA"), and this policy describes how the service treats them. Where they include protected health information, we are the organization's business associate, and we use and disclose that information only as our business associate agreement with the organization permits; for protected health information, that agreement controls where it and this policy differ.

2. Information We Collect

Account information: your name, email address and password (stored only as a one-way hash), your second-factor enrollments, and, when your organization uses single sign-on or SCIM, the identifiers your identity provider sends
Organization content: what your organization enters, including systems, models and vendors, assessments and answers, reviews and approval decisions, model and system cards, governance and compliance registers, policies, comments and uploaded evidence files. For an organization that is a covered entity or a business associate, this can include protected health information
Usage and security data: IP address, browser user agent, sign-in events, and a security audit log of activity in your organization
Billing information: your billing contact and subscription status. Card details are entered on our payment processor's hosted pages; we do not receive card numbers
Messages you send us: what you write in our contact and demo-request forms or by email

3. How We Use Information

To provide, secure and support the service
To send service email: sign-in and security messages, invitations, notifications your organization turns on, billing receipts, and the trial and plan reminders described below
To answer your questions and requests
To detect and prevent abuse and unauthorized access
To meet legal obligations and enforce our agreements

We do not sell or share personal information, as US state privacy laws use those words, and we do not use organization content to advertise to anyone or to train AI models. Where the GDPR or the UK GDPR applies, we rely on performing our contract with you or your organization (to provide the service and send service email), our legitimate interests (to secure the service, prevent abuse and answer questions), our legal obligations, and your consent where we ask for it.

4. Watney and the Model Provider

Watney, the service's AI assistant, is off until an organization admin opts in, and it is not part of the Free plan. Once it is on, each task sends the model provider only what that task needs: records you typed, documentation you pasted in, and the contents of uploaded evidence files (or its earlier summaries of them) when Watney reviews or drafts an answer or summarizes evidence. Anything typed into a record can contain personal information, whatever the field is for. We have a business associate agreement with the model provider, with zero data retention: the provider does not keep what Watney sends it once it has answered, except where the law requires it.

The model provider and the models are named on Watney's system card, which is the place to check how that provider handles what it receives. Separately, Backsplice staff have an assistant of their own for questions about the platform. It is off unless staff switch it on. When it is on, its questions and answers can include account names, email addresses and records from any organization, and it reaches the same provider whatever an organization's own setting is. Its conversations are deleted automatically, sooner than an organization's data after a closure request.

5. Sharing and Sub-processors

We share information only with the service providers we use to run Backsplice:

Hosting: DreamHost, which runs the servers and the database the service runs on
Backup storage: where the backups described in section 6 are copied, off the server the service runs on
Email delivery: sending service email
Payments: Stripe, for checkout, subscriptions and invoices
AI model provider: the provider named on Watney's system card, for organizations that have turned Watney on (including the web searches the provider runs, through its own search service, from queries its model writes, when Watney researches a model card), and for the staff assistant described in section 4

We keep this list current, and the DPA says how organizations are told of a new sub-processor. We have business associate agreements with DreamHost, with our backup storage provider and with our email delivery provider; section 4 says what applies to the AI model provider.

Your organization's admins can also send data to places they choose, such as a webhook, a SIEM, or an auditor or guest link. We disclose information when the law requires it, or to protect the rights, property or safety of Backsplice, our customers or others. If a government body or a court asks us for an organization's content, we refer it to the organization where we can, and we tell the organization before we disclose it unless the law forbids us to.

6. Retention and Deletion

We keep an organization's content while the organization exists, except for two kinds of record that are deleted sooner:

Watney's research on model cards. A Research with Watney conversation is deleted 12 months after its last request, and a public-model lookup 12 months after it was made. A value someone applied to a card is part of the card and is kept.
Closed requests from individuals, where an admin sets a period. If an organization admin sets a retention period for closed requests, each closed request is deleted that period after it was closed, except that a request recorded under a law whose records must be kept longer is kept at least six years after it was closed, and a restriction the organization agreed to, which may still be in effect, is not deleted this way. No period is set unless an admin sets one.

The security audit log records each such deletion with a count, never the content. Copies remain in our backups until those backups expire, as described below. The research period is part of this policy: a change to it is a change to this policy, made as section 12 describes.

An organization's content is permanently deleted in these cases, with every number below read from the settings the service enforces:

A plan that ends: when a paid subscription is canceled or its payment finally fails, or a Premium trial from before the Free plan ends, the organization moves to the Free plan and keeps its records and files; nothing is deleted for that.
A closure an admin requests: the organization is permanently deleted 30 days after the request, unless an admin cancels it before then.

Your organization's admins are emailed before a paid subscription that was canceled ends, and before a trial from before the Free plan ends (see the Terms of Service, section 4). Until deletion, an organization admin can download a copy of the organization's data from its settings page.

What deletion removes: the organization, the records in it, its uploaded evidence files and the export files generated for it, its members' memberships, and its API keys, integration tokens and webhooks.

What is kept after deletion:

The security audit log. Audit log entries are not deleted with the organization; they stay, still labeled with the organization's identifier, so the record of what happened survives. The service's retention job keeps each entry for six years from when it was written. We keep it that long for security, and to support record-keeping obligations such as HIPAA's six-year documentation rule.
User accounts. A person's account that belongs to no other organization is deactivated, not deleted, so their name and email address remain on the deactivated account. That person can ask us at [email protected] to delete it, and we will, keeping only the audit log entries that name it.
Business associate agreements. An executed business associate agreement between us and the organization, its signatures (including each signer's name, email address and the IP address they signed from) and any signed copy of it we stored are kept for 6 years after the organization is deleted, as HIPAA's documentation rule requires, and then deleted by the service's retention job. An agreement that was never executed is deleted with the organization.
Messages to our team. A message sent through our contact or demo form is our sales record. One an organization admin sends through the contact form while signed in also records the organization, the account and the plan it was on. It is kept after the organization is deleted, no longer linked to the organization's record (it keeps what the person typed and the plan named), and you can ask us at [email protected] to delete it.
Billing records. The log of billing events from our payment processor is kept for as long as we need it for tax, accounting and legal obligations, and Stripe keeps its own records under its own terms.

Copies of deleted data remain in our database and file backups until those backups expire. We keep the most recent 30 daily backups and one backup from each month for 6 years, so a copy of deleted data can remain in a backup for up to 6 years. We keep backups only to recover the service and use them for nothing else; while we keep them they stay protected as the DPA and any business associate agreement with us require, and if we ever restore the service from a backup, we delete again any organization that had been deleted before the restore.

You can ask us to delete personal information about you sooner; see section 8.

7. Security

The measures we can state today:

HTTPS everywhere, with HTTP Strict Transport Security
Session cookies that are secure, HttpOnly and SameSite=Strict
Multi-factor authentication with authenticator apps (TOTP) or passkeys, SAML single sign-on, and SCIM provisioning
A per-organization IP allowlist, and role-based access (admin, contributor, auditor)
A hash-chained audit log: a later change to a recorded entry is detectable unless it is made by someone holding the application's signing key and database access, so the log is tamper-evident, not immutable
TOTP secrets, and the payment-processor API keys we store, encrypted with AES-256-GCM (card numbers go to Stripe, never to us)
Daily backups of the database and files, copied off the server the service runs on
A Data Processing Agreement an organization admin accepts for the organization before any governance records can be created or changed; organization setup (profile, members, sign-in and integration settings) can be done first
For an organization that says it handles protected health information, a business associate agreement executed before the records that may hold it can be added

No system is perfectly secure. If you find a security issue, we welcome a report at [email protected].

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of personal information about you, and to object to or restrict some processing. These rights come from laws including the GDPR, the UK GDPR and US state privacy laws such as California's. Where the information is part of an organization's content, that organization decides on the request, and we help it respond. To make a request, contact [email protected]. We respond within the time the law that applies to you sets. To protect you, we first confirm the request comes from you, usually by writing to the email address on your account, and we may ask for more where the request is about sensitive information.

Your rights under HIPAA over protected health information, such as access, amendment and an accounting of disclosures, are exercised with the covered entity that holds it, such as your health care provider or health plan, not with us. We help the covered entity respond as our business associate agreement with it provides.

9. Cookies and Browser Storage

We use a session cookie to keep you signed in, and your browser's local storage for preferences such as the color theme. We do not use advertising, retargeting or third-party tracking cookies, or third-party analytics. You can block cookies in your browser, but you will not be able to sign in.

10. Children

Backsplice is a business service for people acting in a professional capacity. It is not directed at anyone under 18, and we do not knowingly collect their information. If you believe we have, contact [email protected] and we will delete it.

11. International Transfers

The service is hosted in the United States, and information is stored there. If you are outside the United States, your information is transferred there; for an organization's content, the DPA (section 9) sets out the transfer mechanism.

12. Changes to This Policy

We may update this policy. The version and date at the top of this page change when we do. For a material change, we email organization admins before it takes effect, and users who accepted an earlier version at sign-up are asked to accept the new version before continuing.

13. Contact

For privacy questions and requests, contact:

Backsplice LLC
[email protected]