Privacy Notice

Effective Date: 1 January 2026

Our Commitment to Your Privacy

At Backbench ("we," "us," or "our"), we understand that you care about your privacy. This notice explains how we handle information about you when you use our platform. Our aim is to help you understand what information we collect, why we collect it, and how you can control it.

Throughout this notice, we use specific terms that have particular meanings:

"Member" refers to any individual who has registered on Backbench as a verified member of an organisation, including those who create or sign petitions, comment on petitions, or hold a Governing Body Member role.
"Organisation Admin" refers to any individual who manages a Backbench instance on behalf of a registered organisation, including configuring membership tiers, thresholds, and moderating content.
"Personal Data" refers to any information that can identify you or be linked to you, such as your name, email address, or membership number. This includes information protected by privacy laws as "personal data" or "personal information".
"Services" means all Backbench platforms, including our website and web application. This excludes third-party applications you might connect to Backbench.
"Website" refers to any Backbench-owned website that links to this privacy notice.

When This Notice Applies

This privacy notice covers information where Backbench acts as the decision-maker about how your personal data is used (also known as "Backbench Controlled Information"). This typically includes information you provide when creating your account, visiting our website, or using our platform features — whether you are a Member or an Organisation Admin.

For Members: When you use Backbench to create or sign petitions, your membership details (including your name, membership number, tier, and weighted vote) form part of the petition's signatory record. This record is associated with your account and with the petition you signed.

For Organisation Admins: When you configure your organisation's instance, you may input information about membership tiers, thresholds, and governing rules. You are responsible for ensuring your use of the platform complies with applicable data protection laws in your jurisdiction.

This notice does not cover information we collect when you are acting in a business capacity (for example, as an employee or contractor of a company using our platform).

Information We Collect

Information You Give Us

When you interact with Backbench, you may provide us with various types of information:

Website interactions. When you visit our website, you might fill out forms to request information or contact us. We collect the information you provide, such as your name, email address, and any message you send.
Account setup. When you create an account, we collect your full name, email address, username, and password. If you are signing up as a Member, we also collect your membership number and the membership tier you select.
Member profile. Members may optionally add a profile photo and other profile information visible to other authenticated members of their organisation.
Petition data. When you create a petition, we collect the petition title, description, type, any supporting documents you upload, and your configuration choices (deadline, threshold type). When you sign a petition, we record your name, membership number, tier, voting weight at time of signing, and timestamp. Signature withdrawals are also recorded. Please do not include sensitive personal information — such as information about racial or ethnic origin, religious beliefs, political opinions, health, or other protected characteristics — in petition content or supporting documents unless strictly necessary, as this information may be visible to other members and included in petition exports.
Comments. Comments you post on petitions are stored and associated with your account. Comments are visible to all authenticated members of your organisation.
Marketing preferences. If you are interested in learning more about Backbench, you might provide contact information through our website forms or at events we attend. We use this to communicate with you about our services.

If you would like a list of third-party subprocessors entrusted with your data, please contact us using the details in the "Contact Us" section below.

Information We Collect Automatically

When you use Backbench, we automatically gather certain technical information to make the platform work smoothly and securely. We may use cookies, tracking pixels, and similar technologies (with your consent where required by law) to collect this information. Here is what we collect:

Device and connection information. When you access Backbench, we automatically receive information from your device, including your IP address, device type, operating system, browser version, and approximate location based on your IP address. We also collect information about how you arrived at our website (for example, which website referred you).
Cookies and local storage. We use small text files called cookies and browser storage to remember your preferences and keep you logged in. Some cookies are temporary and disappear when you close your browser, while others persist until you delete them. You can manage cookies through your browser settings or our cookie preference centre (if available). Some cookies are linked to your Backbench account, while others are not.
Platform usage. We may track how you use Backbench to understand which features are most helpful and identify areas for improvement. This includes information like which features you use most, which petitions you view, and how you navigate the platform.

Information from Other Sources

Sometimes we receive information about you from third parties. This might include:

Marketing and lead generation companies that help us reach potential users, providing contact information and professional details.
Third-party services you connect to Backbench, such as calendar apps or communication tools. When you authorise these connections, we receive information according to your permissions and their privacy policies. We encourage you to review the privacy policies of any services you connect to Backbench.

How We Use Your Information

We use the information we collect to provide and improve Backbench. Here are the main ways we use your information:

Delivering our services. We use your information to provide the petition creation, signature collection, threshold tracking, and governance tools that make Backbench work.
Maintaining the audit trail. Signature records, including your name, membership number, tier, and weighted vote, are stored as part of the immutable petition audit log to support the integrity of the petitioning process.
Communicating with you. We send you important updates about your account, changes to our terms or policies, petition-related notifications (such as threshold reached or petition closed), and responses to your questions.
Marketing and preferences. With your permission, we may send you information about new features or updates. You can opt out at any time.
Improving Backbench. We analyse how people use our platform to identify bugs, understand which features are most valuable, and plan improvements.
Keeping Backbench secure. We use information to detect and prevent fraud, unauthorised access, and other security threats — including the submission of fabricated membership numbers.
Legal compliance. We may use or disclose information when required by law or to protect our rights and the rights of our users.

We do not sell your personal information. We do share information in these limited circumstances:

Within your organisation's instance. Petition content, signatory lists (name, tier, and weighted vote), and comments are visible to all authenticated Members of the same organisation on Backbench. This sharing is necessary for the platform to function.
With Organisation Admins. Organisation Admins can view the full audit log for their organisation's instance, including all signatures, withdrawals, and exports with timestamps.
Petition exports. When a petition creator or Organisation Admin exports a petition PDF, the export includes the names, membership numbers, tiers, and vote weights of all signatories. This export may be submitted to your organisation's governing body as part of a formal requisition. By signing a petition, you acknowledge that your information may be included in any such export and submission. Members who do not wish their information to appear in an export should not sign the petition. The petition creator and any Organisation Admin who shares the export externally are responsible for how it is used and for compliance with applicable data protection laws.
Organisation Admins as independent data controllers. When an Organisation Admin exports petition data and shares it outside the Backbench platform — for example, by submitting a petition PDF to the governing body — the Admin acts as an independent data controller with respect to that downstream use. Backbench's role is limited to providing the platform and generating the export. Admins are solely responsible for ensuring their use of exported data complies with applicable data protection laws, including the Personal Data (Privacy) Ordinance (Cap. 486) or equivalent legislation in their jurisdiction.
Third-party service providers. We work with trusted companies that help us operate Backbench, such as hosting providers, email providers, and security tools. These companies can only use your information to provide services to us — they cannot use it for their own purposes.
Advertising partners. We may share limited information with advertising partners to show you relevant ads about Backbench. This might be considered "sharing" under some privacy laws. You can opt out as described in the "Your Rights" section below.
Business transfers. If Backbench is acquired or merges with another company, your information may be transferred as part of that transaction.
Legal requirements. We may disclose information if required by law, court order, or government request.
Protecting rights. We may share information to protect Backbench's rights, your safety, or the safety of others.
With your permission. We may share information when you explicitly ask us to.

Keeping Your Information Secure

We take the security of your information seriously and have implemented administrative, technical, and physical safeguards in accordance with industry standards and best practices. Our security measures include, but are not limited to:

Encrypting data during transmission and while stored
Regular security testing and monitoring
Access controls — restricting access to information to only those employees or subprocessors with a legitimate business need
Regular team training on data protection and privacy obligations
Incident response plans for addressing potential breaches or security issues

While no system is 100% secure, we are committed to responding promptly to security risks. In the unlikely event of a breach affecting your information, we will notify you and relevant authorities as required by law, providing clear information about the incident and our planned remediation steps.

Your Rights

Depending on where you live, you may have certain rights regarding your information. We extend these rights to all users where possible, regardless of jurisdiction:

Access: You can request a copy of the information we hold about you.
Correction: You can ask us to correct inaccurate information.
Deletion: You can request deletion of your account at any time through your account settings. Some data may be retained for legal, regulatory, or legitimate business purposes as described in the "How Long We Keep Your Information" section. Note that signatures recorded on petitions form part of an immutable audit trail — withdrawal of a signature is logged but the record of the withdrawal is retained.
Data portability: You can request your data in a portable format.
Objection: You may object to certain uses of your information.
Restriction: You can request that we limit certain uses of your data.
Withdraw consent: If we rely on your consent for any use of your information, you may withdraw it at any time.
Opt out of marketing: You can unsubscribe at any time via the link in our marketing emails, or by contacting us.

To exercise your rights, please contact us using the details in the "Contact Us" section below. We may need to verify your identity before processing your request.

If you disagree with our response or wish to appeal, please contact us using the details in the "Contact Us" section below with the subject "Data Privacy Request Appeal."

Cookie preferences can be managed through your browser settings and, where enabled, via our cookie consent tool. We honor Global Privacy Control signals in certain locations, and you may opt out of targeted advertising according to browser/device instructions. Note that some preferences may be browser- or device-specific.

You also have the right to lodge a complaint with your local data protection authority if you are dissatisfied with how we handle your request.

How Long We Keep Your Information

We keep your information only as long as necessary to provide you with Backbench services and to fulfil the purposes outlined in this notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

Specifically, we retain:

Active accounts: Account information while your account is active and for up to seven years after account closure, unless longer is required by law.
Petition and signature records: Petition content and signatory records (including withdrawn signatures, marked as withdrawn) are retained for as long as the petition exists on the platform. Audit logs are immutable and append-only and are not deleted while the organisation's instance remains active.
Support and transactions: Support-related and transactional data for at least six months.
Financial and anti-fraud: Records relating to financial transactions and fraud prevention for as long as legally required.
Marketing: Marketing preferences until you opt out or request deletion.

When we no longer need your information, we securely delete or anonymise it according to our data retention and deletion procedures, subject to applicable law.

If you request deletion of your account, we will honour your request unless we have a lawful reason to retain it, such as complying with legal obligations or resolving disputes. Account deletion will immediately remove your login credentials and permanently anonymise your personal identifiable information. Your username is reserved for 90 days to prevent impersonation before being released for reuse.

International Data Transfers

Backbench operates globally, which means your information may be stored or processed in countries outside your own. Some countries where we, or our subprocessors, operate may not have the same data protection laws as your country.

When we transfer your information internationally, we implement appropriate safeguards as recognised by authorities (such as the GDPR, the Personal Data (Privacy) Ordinance (Cap. 486), or other local privacy laws), including:

Standard contractual clauses approved by data protection authorities
Data processing agreements with our vendors and subprocessors
Certification programmes, codes of conduct, or other legally recognised mechanisms

Our primary data storage and processing partners include (but are not limited to):

Supabase for authentication and database
Cloud hosting services (e.g., AWS, GCP, Azure, Hostinger)
Email and customer support providers (e.g., AWS SES, Google Workspace)

For a current list of our main subprocessors or to request more information on international transfers, please contact us using the details in the "Contact Us" section below.

By using Backbench, you consent to these international transfers subject to the described safeguards.

Children's Privacy

Backbench is designed for users who are 18 years or older. The platform is intended for use by verified members of private organisations and is not directed at children or minors.

We do not knowingly collect personal information directly from children under 18. If you believe a child under 18 has provided us with information, please contact us immediately using the details in the "Contact Us" section below. If we discover we have collected information from a child, we will delete it as soon as reasonably possible.

We do not knowingly market our services to children and our platform is not intended for direct use by anyone under 18 years of age.

Additional Information for California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights. This section applies only to Backbench Controlled Information about California residents.

Categories of Information We Collect

In the past 12 months, we have collected these categories of personal information: identifiers (like name and email), information listed in the California Customer Records statute, internet activity, geolocation data, professional and membership information, and inferences drawn from other information.

Your California Privacy Rights

As a California resident, you can:

Request to know what personal information we have collected about you, where it came from, why we collected it, and who we have shared it with
Request correction of inaccurate information
Request deletion of your personal information (though we may need to keep some information to provide services to you or to maintain the integrity of petition audit records)

If you ask us to delete information we need to provide Backbench, you may no longer be able to use our services.

You can authorise someone else to make these requests on your behalf. To do so, you or your authorised agent must provide proof of authorisation, such as a signed written authorisation. We may ask for additional information to verify authorisation, especially if we suspect fraud.

California law defines "sale" broadly to include sharing information for targeted advertising across different websites (called "cross-context behavioral advertising"). When we use "Share" or "Sharing" with a capital letter in this section, we mean this specific legal definition.

We may Share device information and identifiers (like IP addresses and cookies) with advertising partners to show you relevant ads about Backbench. We do not otherwise "Sell" your personal information as defined by California law, and we have not done so in the past 12 months.

To opt out of Sale or Sharing, use the "Your Privacy Choices" link in our website footer or contact us directly. Your opt-out applies to the browser and device you use.

We do not knowingly Sell or Share information from anyone under 18.

Non-Discrimination

California law protects you from discrimination for exercising your privacy rights. Backbench will not discriminate against you for exercising your rights under California law.

Updates to This Notice

We may update this privacy notice from time to time to reflect changes in our practices, legal requirements, or the functionality of our services. If we make material changes, we will notify you by posting the updated notice here, updating the effective date at the top, and (where appropriate) by email or through an in-app notification prior to those changes taking effect.

We recommend that you review this notice regularly to understand how your information is protected.

Your Privacy Choices

We provide tools for you to manage your privacy. You can:

Opt-Out of Sale/Sharing: If you are a California resident, you can opt out of the "Sale" or "Sharing" of your personal information
Marketing Communications: Unsubscribe from marketing emails at any time using the link in the footer of our emails.

Contact Us

If you have questions about this privacy notice or want to exercise your rights, please contact us via one of the following methods:

Contact Us form
Email: privacy@backbench.net