Privacy Policy

Summary

• We collect only what we need to run BackRead well.
• We never sell your data, and we never train outside models on your documents.
• Your documents are visible only to you and the readers you choose.
• You can access, correct, or delete your data at any time.
• We build to prevent data leaks, and we comply with the NDPR, the Nigeria Data Protection Act, and the GDPR.

1. Who we are

BackRead is a document intelligence service that lets you share documents and understand how they are read. This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it.

For the purposes of the Nigeria Data Protection Regulation (NDPR), the Nigeria Data Protection Act 2023, and, where it applies, the EU and UK General Data Protection Regulation (GDPR), BackRead is the data controller for the account and marketing data we hold about our users, and a data processor for the document and reader data our users choose to process through the service.

We designed BackRead so that understanding your readers never comes at the cost of their privacy or yours. Reading this policy should leave you reassured, not uneasy.

2. The data we collect

We collect only what we need to run the service well. We group it into four categories:

• Account data: your name, email address, password (stored only as a secure hash, never in plain text), and, for organization accounts, your company name and team membership.
• Document data: the documents you upload, their contents, and any metadata attached to them. These are yours. We store them so we can display them to the people you share them with.
• Reader data: when someone opens a document you shared, we record activity such as pages viewed, time on page, questions typed into the document, and the resulting signals used to produce a verdict. This is captured to give you the insight the product exists to provide.
• Technical data: IP address, browser type, device information, and similar diagnostic data collected automatically to keep the service secure and working.

We do not collect special categories of personal data (such as health, religion, or biometric data) and we ask that you do not upload documents whose primary purpose is to process such data through BackRead.

3. Our lawful basis for processing

Under the NDPR and GDPR we must have a lawful basis for every use of personal data. Ours are:

• Contract: we process your account and document data because it is necessary to provide the service you signed up for.
• Legitimate interests: we process technical and limited usage data to secure, maintain, and improve the service, balanced carefully against your rights.
• Consent: where we rely on consent, for example non-essential cookies or marketing email, you may withdraw it at any time without affecting your use of the product.
• Legal obligation: we may process data where the law of the Federal Republic of Nigeria requires it.

Readers whose activity is captured are informed that the document is a BackRead document. As the person sharing a document, you are responsible for having a lawful basis to share it and to observe how it is read.

4. How we use your data

We use personal data to operate the document companion, produce reading signals and verdicts, show you reader activity, secure your account, provide support, and, where you have opted in, send you product updates. We never sell your personal data, and we never use the contents of your documents to train external models or for any purpose other than delivering the service to you.

5. When we share data, and when we do not

We do not sell, rent, or trade personal data. We share it only in these limited situations:

• Service providers: vetted infrastructure partners (such as hosting and email delivery) who process data strictly on our instructions under written agreements that meet NDPR and GDPR standards.
• Your own instructions: when you share a document, its intended recipients can see it. That is the point of the product, and it happens only when you choose it.
• Legal requirements: where we are compelled by a valid order under Nigerian law, disclosed only to the extent required.
• Business transfers: if BackRead is ever involved in a merger or acquisition, data would transfer under the same protections described here, and you would be notified.

Beyond these, your data stays within BackRead.

6. How we protect your data

Security is not a feature we bolt on; it is how the service is built. We apply layered technical and organizational measures designed to prevent data leaks:

• Encryption in transit and at rest for documents and account data.
• Strict access controls, so that documents are visible only to the account that owns them and the readers that account explicitly shares with. Enforced at the database level, not just in the interface.
• Row-level security policies that make it technically impossible for one account to read another account's documents or reader data.
• Hashed, salted passwords, so that even we cannot see your password.
• Continuous monitoring, least-privilege internal access, and prompt patching.

No system can promise perfection, but we hold ourselves to a high standard and treat any incident with the seriousness it deserves. If a breach ever affected your personal data, we would notify the National Data Protection Commission and affected individuals in line with the timelines set by Nigerian law and the GDPR.

7. How long we keep data

We keep personal data only as long as we need it. Documents and reader data remain until you delete them or close your account. Account data is retained for the life of your account and for a short, defined period afterward to meet legal and accounting obligations, then securely erased. You can delete individual documents at any time, which removes their associated reader data.

8. Your rights

Under the NDPR, the Nigeria Data Protection Act, and the GDPR where it applies, you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Erase your data (the right to be forgotten), subject to our legal obligations.
• Restrict or object to certain processing.
• Data portability, receiving your data in a structured, commonly used format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, contact us using the details below. We will respond within the timeframe required by law, and we will never charge you for making a request in ordinary circumstances.

9. International transfers

Where personal data is transferred outside Nigeria, we ensure an adequate level of protection through appropriate safeguards, such as contractual clauses that bind the recipient to standards equivalent to the NDPR and GDPR. We transfer data internationally only where it is necessary to provide the service and lawful to do so.

10. Cookies

We use a small number of essential cookies to keep you signed in and to keep the service secure. Any non-essential cookies, for example analytics, are used only with your consent, which you can manage or withdraw at any time.

11. Children

BackRead is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us data, contact us and we will remove it.

12. Changes to this policy

We may update this policy as the service or the law evolves. When we make a material change, we will update the date at the top and, where appropriate, notify you directly. Continued use of BackRead after a change means you accept the updated policy.

13. Contact us

If you have any question about this policy, or wish to exercise a right, the fastest way to reach our data protection team is the live chat on our website. We treat every message from a user or a reader with care and respond promptly.