Privacy Policy

Backstop Kit ("we", "us", "our") is operated by Backstop Kit, based in Queensland, Australia. We provide a SaaS platform at backstopkit.com that helps freelancers manage project scope, detect scope creep, and generate change orders. For privacy-related enquiries, contact us at: privacy@backstopkit.com

2.1 Account Information When you create an account, we collect your name and email address through our authentication provider, Clerk. You may optionally provide additional profile information. 2.2 Project and Business Data Information you enter into Backstop Kit, including project names, client names, client email addresses, deliverables, scope requests, change orders, and any documents you upload for AI analysis. 2.3 Business Branding If you upload a business logo, it is stored securely in our cloud storage. 2.4 Usage and Technical Data We collect information about how you use Backstop Kit, including pages visited, features used, error reports, and device and browser information. This is collected through Sentry (error monitoring) and standard server logs. 2.5 Communications If you contact us by email, we retain those communications to respond to your enquiry and improve our service. 2.6 Billing Data (when billing is live) Payment information is processed directly by Stripe. We do not store your credit card details. We retain billing records including transaction history and subscription status.

We use your information to: • Provide, operate, and maintain the Backstop Kit service • Process and analyse scope requests using AI (via the Anthropic API) • Send change orders and notifications on your behalf via email (via Resend) • Monitor and improve service performance and reliability (via Sentry) • Respond to your support and privacy enquiries • Process subscription payments and manage billing (via Stripe) • Comply with our legal obligations We do not use your information for advertising purposes. We do not sell your personal data to third parties.

Backstop Kit uses the Anthropic API to analyse scope requests and generate change orders. Your project content is sent to Anthropic's API for processing in real time. This content is not retained by Anthropic beyond the scope of the API request and is not used to train AI models. For more information, see Anthropic's privacy policy at anthropic.com/privacy.

To provide Backstop Kit, we share data with the following trusted third-party services: • Clerk — Authentication and user management (name, email address) • Supabase — Database and file storage (all project and account data) • Anthropic — AI scope analysis and change order generation (project content, deliverables, scope requests) • Resend — Transactional email delivery (recipient email, email content) • Sentry — Error monitoring and performance (usage data, error reports) • Vercel — Website and API hosting (request data, server logs) • Stripe — Payment processing and subscription management (billing information) We do not share your data with any other third parties except where required by law.

We retain your data for the following periods: • Active accounts — for the lifetime of your account • Deleted accounts — personal data is deleted within 30 days of an account deletion request • Project data (projects, deliverables, scope requests, change orders) — deleted within 30 days of account deletion • Billing records — retained for 7 years as required by applicable financial regulations • Audit and security logs — retained for 12 months

We implement industry-standard security measures to protect your data, including: • Row Level Security (RLS) on our database — every query is verified against your identity before data is returned • Encrypted connections — all data transmitted to and from Backstop Kit uses TLS encryption • Authentication security — provided by Clerk, including encrypted sessions and compromised password detection • Access controls — your data is only accessible to you and the services listed in Section 5

Depending on your location, you may have the following rights regarding your personal data: All Users • Access — request a copy of the personal data we hold about you • Correction — request correction of inaccurate personal data • Deletion — request deletion of your personal data (subject to legal retention requirements) • Portability — request your data in a portable format EU and UK Users (GDPR and UK GDPR) In addition to the rights above, you have the right to object to processing, restrict processing, withdraw consent, and lodge a complaint with your local data protection authority. Our lawful basis for processing is the performance of our contract with you. California Users (CCPA) California residents have the right to know what personal information is collected, the right to delete it, and the right to opt out of its sale. We do not sell personal information. Australian Users (Australian Privacy Act) We handle your personal information in accordance with the Australian Privacy Principles (APPs). You have the right to access and correct your personal information and to make a privacy complaint. To exercise any of these rights, contact us at privacy@backstopkit.com. We will respond within 30 days.

Backstop Kit uses only the cookies necessary for authentication and session management, set by our authentication provider Clerk. We do not use advertising, tracking, or analytics cookies.

Backstop Kit is operated from Australia. Your data may be processed and stored in the United States and other countries where our third-party service providers operate. Where data is transferred outside Australia or the European Economic Area, we ensure appropriate safeguards are in place in accordance with applicable privacy laws.

Backstop Kit is intended for use by adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, please contact us at privacy@backstopkit.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by a prominent notice within the app. The date at the top of this policy indicates when it was last updated. Continued use of Backstop Kit after changes take effect constitutes acceptance of the updated policy.

For any privacy-related questions, requests, or complaints, please contact us at: Email: privacy@backstopkit.com Website: backstopkit.com If you are located in the EU or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.