Backforms Privacy Policy

1. Commercial Identity & Corporate Disclosures

Backforms is a proprietary commercial digital product and registered Trade Name / DBA (Doing Business As) owned, maintained, and operated by:

• Legal Entity: AC Softworks, LLC
• State of Formation: CO, United States
• Principal Office: 10603 E Jewell Ave, Unit G146, Aurora, CO 80012, USA
• Corporate Portal: www.acsoftworks.com
• Privacy Desk Email: info@backforms.com

2. Dual Capacities: Data Controller vs. Data Processor

Under statutory data privacy frameworks, including the EU/UK General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA/CPRA”), and the Colorado Privacy Act (“CPA”), Backforms operates in two distinct legal capacities:

3. Categories of Information Collected

We limit information collection strictly to data required to operate, secure, and deliver form routing and notification services:

4. Legal Bases for Processing

Under GDPR Article 6 and applicable privacy statutes, we process personal information on the following legal bases:

• Contractual Performance: Processing necessary to provide form routing endpoints, dispatch alerts, and execute your subscription tier agreements.
• Legitimate Interests: Necessary to defend infrastructure against spam, automated abuse, DDoS attacks, and unauthorized access.
• Statutory Compliance: Compliance with applicable tax, financial accounting, and regulatory recordkeeping obligations.
• Consent: Where you have granted express, affirmative consent for specific optional integrations or communications.

5. Third-Party Sub-Processors

Backforms engages verified, enterprise-grade cloud sub-processors to fulfill infrastructure, security, and dispatch functions:

6. Specific Disclosure: WhatsApp Business Cloud API Integration

When you activate Managed WhatsApp Notifications on Backforms:

• Notifications are transmitted exclusively through Meta's verified WhatsApp Business Cloud API using pre-approved notification templates (form_alert).
• Messages are directed exclusively to the authorized telephone number designated by you in your dashboard settings to notify you of incoming form leads.
• Backforms never uses customer recipient phone numbers for marketing, promotional campaigns, or third-party advertising.
• Recipient phone numbers and transmission logs are masked in dashboard interfaces to prevent unauthorized visual disclosure.

7. Data Security & Encryption Standards

AC Softworks, LLC implements administrative, physical, and technical safeguards designed to protect personal data from unauthorized access, alteration, disclosure, or destruction:

• Transmission Encryption: All HTTP communications with Backforms APIs, endpoints, and dashboards are strictly enforced via Transport Layer Security (TLS 1.3).
• Encryption at Rest: Database tables and uploaded file attachments are encrypted at rest using industry-standard AES-256 cryptographic algorithms.
• Cryptographic Webhook Signatures: Custom webhooks support SHA-256 HMAC digital signatures, enabling customer endpoints to verify payload authenticity and origin integrity.

8. Retention & Permanent Erasure

• Submission Records: Form submissions are retained according to your active subscription plan quota (30 days for Free tier, 365 days for Pro and Agency tiers), or until deleted manually by the user.
• Account Deletion: You may request complete account deletion at any time via your dashboard settings or by following our Data Deletion Instructions. Account deletion permanently purges database records, endpoint routes, and associated file attachments.
• Billing Records: Transaction and invoice records are preserved by Polar.sh for statutory tax and financial reporting retention periods.

9. Statutory Privacy Rights (GDPR, CCPA/CPRA, CPA)

Depending on your jurisdiction, you possess specific statutory rights regarding personal data held by Backforms as a Data Controller:

• Right of Access & Portability: The right to request confirmation of processing and obtain a copy of your personal information in a structured, commonly used machine-readable format (CSV/JSON).
• Right to Rectification: The right to request correction of inaccurate or incomplete personal records.
• Right to Erasure (“Right to be Forgotten”): The right to request permanent deletion of your personal account and associated data.
• Right to Opt Out of Sale / Sharing: AC Softworks, LLC does NOT sell, rent, monetize, or share personal data or form submissions with third parties or data brokers.
• Non-Discrimination: We will not deny goods or services, charge different prices, or provide a different level of quality for exercising statutory privacy rights.

10. Children's Privacy (COPPA Compliance)

Backforms is a developer infrastructure service designed strictly for commercial, professional, and business use. We do not knowingly solicit, collect, or process personal information from children under thirteen (13) years of age. Customers are expressly prohibited from deploying Backforms endpoints to collect personal data from children under 13 without obtaining verifiable parental consent as mandated by the Children's Online Privacy Protection Act (COPPA). If you believe a child under 13 has submitted personal information to our platform, contact us immediately at info@backforms.com for prompt investigation and permanent erasure.

11. Amendments to This Policy

We reserve the right to amend this Privacy Policy periodically. Notice of material modifications will be provided via the Backforms dashboard or by sending an advisory to your primary registered email address. The “Last Revised” timestamp at the head of this document denotes the effective date of revisions. Continued use of Backforms after changes are posted constitutes acceptance of the amended policy.