Privacy Policy

1. Information We Collect

To provide the Service we collect:

• Account information — the name, email address, and password you provide at sign-up. Passwords are stored only as a one-way hash, never in plain text.
• Organization & project data — the organizations, projects, and billing configuration you create.
• Session & authentication data — session tokens issued at sign-in and security-related logs.
• Usage data — technical records of how you interact with the Service (IP address, browser type, access times).

The Service is not directed to children, and we do not knowingly collect personal data from anyone under 16.

2. How We Use Information

We use the information we collect only to:

• Create your account, authenticate you, and manage your session.
• Provide, maintain, and improve the Service.
• Process billing and payments.
• Keep the Service secure and prevent unauthorized access.
• Communicate with you about important service matters.
• Meet our legal obligations.

Our legal bases for this processing (GDPR Article 6; KVKK Article 5) are:

• Performance of our contract with you — to create and run your account, provide the Service, and process billing.
• Our legitimate interests — to keep the Service secure, prevent abuse, and improve it.
• Legal obligation — to meet tax, accounting, and other statutory duties.
• Your consent — where we ask for it separately; you can withdraw it at any time.

3. Sharing of Information

We do not sell your personal data. We share it only:

• With service providers (sub-processors) who help us operate the Service and process data on our behalf and under our instructions.
• When required by a legal obligation or a valid official request.
• With your explicit consent.

Our current sub-processors are:

• Cloudflare — cloud infrastructure, compute, and storage.
• Polar Software Inc. — payments, as our Merchant of Record.
• Resend — transactional email delivery.

We will update this list before adding or replacing a sub-processor.

4. Data Security

We apply reasonable technical and organizational measures — such as encryption, access control, and secure authentication — to protect your data against unauthorized access, alteration, and loss. No method of transmission or storage is 100% secure.

5. Data Retention

We keep your personal data only while your account is active or as long as needed to fulfil the purposes described in this policy. We do not delete your data when a paid plan ends — your organization reverts to the Free plan. Your project database stays available for export for at least 30 days after a plan ends or an account is closed, after which we may permanently delete it. When you delete your account, your data is removed within a reasonable period, subject to any legal retention obligations.

6. Data Residency

When you create an organization you choose where your project database is stored: the European Union or Global. That choice determines the database's location. It does not confine everything else — compute runs on a global edge network, and files you upload to storage are held on our infrastructure provider's global network, wherever your database sits.

Backlex is operated from Türkiye, so your data may be accessed by us from there. Türkiye is not covered by a European Commission adequacy decision. If you are in the EU/EEA and need a specific transfer safeguard for your organization, contact us at hi@backlex.com.

7. Cookies & Sessions

We use strictly necessary cookies and similar technologies to keep you signed in and to authenticate you. These are essential to the core operation of the Service; blocking them in your browser may prevent parts of the Service from working correctly.

8. Your Rights

Under applicable law (the GDPR and the KVKK) you have the right to:

• access your data and receive a copy of it;
• have it rectified, erased, or its processing restricted;
• object to processing, and to data portability;
• withdraw your consent at any time where we rely on it, without affecting processing already carried out;
• lodge a complaint with a data protection supervisory authority — in the EU, the authority in your country of residence or work; in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), after first applying to us as the KVKK requires.

To exercise any of these rights, contact us at hi@backlex.com. We respond within the statutory time limits (30 days under the KVKK; one month under the GDPR).

9. Third-Party Services

The Service may use third-party infrastructure, authentication, and payment providers. These providers only access the data needed to deliver the Service and are subject to their own privacy obligations.

Our public web pages (backlex.com and the docs) additionally load fonts and logo images from third-party content delivery networks — currently Google Fonts, jsDelivr, SimpleIcons, and VectorLogoZone. When a page loads, your browser requests those files directly, which discloses your IP address to the host. These requests set no cookies and are not used to track you. The cloud dashboard itself loads no third-party scripts, fonts, or trackers.

10. Changes

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date on this page.

11. Contact

For questions about this Privacy Policy or your personal data, contact us at hi@backlex.com.