Privacy Policy

Summary

Aback Stack collects the data needed to run an account and to take a payment. It does not sell personal data and it does not run third party advertising trackers on this site.

Account data

When you create an account we store your email address, a hashed password, your display name, your account preferences and whether your email address is verified.

When you sign in with Google we store the provider identifier, the email address and the name and picture that the provider returns.

• Passwords are hashed with bcrypt and are never stored in a readable form.
• Session tokens are hashed before they are stored, so a database copy does not contain usable sessions.
• Verification and password reset tokens are single use and expire.

Billing data

Payments are processed by the payment provider the deployment configures. Card details never reach our servers. We store the customer identifier, the subscription identifier, the plan, the subscription state and the next billing date so that the application can show the right thing to the right account. For a purchase of the kit we store the payment identifier, the email address and the name you gave the payment provider, the amount and whether it was refunded, so we can answer support requests and send the welcome email.

Technical data

The application writes structured log events for authentication, session and billing operations. The events record an operation identifier, a stage, a status code and non identifying metadata. Secrets, tokens, passwords and authorisation headers are redacted before anything is written.

The browser records a page view and a call to action click in a local data layer. The page view carries the route and the origin of the referring page, and the click carries the identifier of the call to action and the path of the link. Neither event leaves the browser. No third party script is loaded and no identifier is stored.

Retention

Account data is kept for as long as the account exists. A deletion request is actioned within the period the law requires, and the billing records that we are required to keep are retained for the period the law requires.

Your rights

You can ask for a copy of the data we hold, ask us to correct it, or ask us to delete it. Contact us and we will action the request within the period the law requires.

Where the processing is based on consent, you can withdraw that consent at any time without affecting the processing that already happened.

Processors and transfers

We use a small number of processors. Cloudflare hosts the application and stores the database. The payment provider the deployment configures processes the payment. The transactional email provider the deployment configures delivers the email, so it receives the recipient address and the action link of the verification or the password reset message. A sign in provider is a processor only when it is enabled, and it then receives the profile that the provider returns. Each processor receives only the data it needs to do its job.

The account identifiers of the checkout are shared with the payment provider so the payment can be reconciled with the account that started it.

The hosting and database run in the region configured for your Cloudflare account, which is where the data is stored.

Contact

Send a privacy request to privacy@abackstack.com. We will confirm receipt and respond as the law requires.