1. Who is responsible
[TO COMPLETE: company name], [TO COMPLETE: registered address], runs Backup Safe and is responsible ("controller") for the account and billing information described here. For the contents of the databases you back up, you are the controller and we only process them on your behalf (our "processor" role), as set out in the Data Processing Agreement. Contact: [TO COMPLETE: support email].
2. What we collect
| Information | Details |
|---|---|
| Account | your email address; your password (if you set one), stored only as a one-way hash (Argon2); account settings and plan; the email addresses you add as extra alert recipients |
| Sign in with Google | only if you choose it: your Google account ID and the email address Google has verified. We never receive your Google password or any other data from your Google account. |
| Billing | handled by Stripe: we store only Stripe's customer and subscription IDs, your plan and its status. Card details go directly to Stripe and never reach our servers. |
| Database connections | the name you give each database, its connection string (host, user, password, database name), stored encrypted; schedules; the database server version |
| Backups and their records | the encrypted backup files; for each backup: time, size, checksum, status, integrity and restore-test results, and error messages from failed runs (with data rows removed) |
| Own-key encryption | if you turn it on: your public key and your private key encrypted with your passphrase. We never receive or store the passphrase itself. |
| Security | your IP address, kept briefly to limit login, signup and password-reset attempts (at most one hour); a session cookie |
| Emails we send you | alerts, warnings, password-reset links and account emails, sent through our email provider |
We do not use advertising or analytics trackers, and we do not sell personal information.
3. Why we use it
- To provide the service you signed up for: backups, checks, restore tests, restores, alerts (performance of our contract).
- To bill subscriptions and keep financial records (contract and legal obligation).
- To keep the service and your account secure, for example rate limits and alerts about your own account (legitimate interest).
- To send service emails you can't opt out of while you have an account (failed backups, storage limits, billing, cancellation and deletion notices). We don't send marketing emails without your consent.
4. Your database backups
Each backup is encrypted with its own key (AES-256-GCM) before it leaves our server. The keys are protected either by our server key ("standard") or by your own passphrase ("own key"; then nobody but you can decrypt the backup). Backups are decrypted only to verify them, to run restore tests in an isolated environment without internet access (deleted right after each test), and when you ask for a restore or a download. We don't look at the contents of your databases, except where you ask us to help you and give us permission, or where the law requires it.
5. How it is protected
- HTTPS everywhere; backups and database credentials encrypted at rest; private storage that can't be accessed without our keys.
- The server accepts only web and administration connections (other ports are closed); internal databases are not reachable from the internet.
- Restore tests run with no network access, without administrator rights and with time and size limits.
- Passwords are hashed; sessions are signed cookies; sensitive actions need extra confirmation.
6. Service providers (subprocessors)
| Provider | What for | Data |
|---|---|---|
| [TO COMPLETE: server provider and region] | servers that run Backup Safe | everything listed above, in encrypted form where stated |
| Cloudflare, Inc. (R2 storage) | storing encrypted backups and encrypted copies of our database | encrypted files only, never the keys |
| Stripe, Inc. / Stripe Payments Europe Ltd. | payments and subscriptions | email, billing details, payment card |
| [TO COMPLETE: email provider] | sending service emails | the recipient's email address and the email content (alerts, account and billing notices); never backup contents |
| Google LLC | "Continue with Google" sign-in, only if you use it | confirms your Google account ID and verified email to us |
Some providers process data outside your country, including in the USA. Where the law requires it (for example the GDPR or Brazil's LGPD), these transfers are covered by appropriate safeguards, such as the Standard Contractual Clauses included in the providers' data processing terms.
7. How long we keep it
- Backups: for your plan's retention period (Starter 7 days; Pro hourly copies 48 hours and daily copies 30 days), unless you delete them sooner.
- After a subscription ends: backups are kept 14 days so you can retrieve them, then permanently deleted.
- Account information: while you have an account (deletion: section 8). When an account is deleted, our encrypted nightly copies of the Backup Safe database still contain it for up to 30 days, then they expire.
- Billing records: kept by Stripe and by us for as long as tax and accounting law requires.
- Server logs: limited in size and rotated automatically (a few days to weeks, depending on activity).
8. Your rights and deletion
You can see and change your account details in the app, download all your backups at any time, and cancel your subscription yourself. You can ask us at [TO COMPLETE: support email] to access, correct, export or delete your personal information. Depending on where you live, you may also object to or restrict some processing and complain to your data protection authority.
How deleting your account works
You can delete your account yourself in Settings → Delete account; it is deleted straight away. If you ask us instead, we delete it within 30 days after confirming that the request comes from you. Either way:
- Any subscription that could still charge you is cancelled first, and Stripe must confirm the cancellation before anything is deleted, so you are not charged afterwards. (Refunds follow the Refund & Cancellation Policy.)
- The account is blocked: nobody can log in and no new backups or restores start.
- Every stored backup file of the account is permanently deleted, then your database connections (including their encrypted credentials), backup, restore and restore-test records, own-key recovery material and account details.
- We email you a confirmation.
If a step is interrupted (for example a storage error), the account stays blocked and complete until the deletion is run again and finishes; it never stays half-deleted and usable.
What is not deleted immediately: billing records (invoices and payments), which Stripe and we must keep as long as tax law requires; the encrypted nightly copies of our service database, which still contain the account until they expire after 30 days; size-limited server logs until they rotate. We also keep a minimal deletion record (date, numbers of items deleted, what happened to the subscription, and a one-way fingerprint of your email that can't be turned back into the address) to show that the deletion was done. Deletion records are kept for 12 months, unless the law requires us to keep them longer.
9. Cookies
We use one cookie: it keeps you logged in (for up to 14 days) and carries the security token that protects forms. It is set only when you log in. If you sign in with Google, a second short-lived cookie (10 minutes) links Google's answer to your browser and is deleted after sign-in. No advertising or analytics cookies are used.
10. Changes and contact
We will post updates here and email you about important changes at least 30 days before they apply. Questions or requests: [TO COMPLETE: support email].