Privacy policy

Backlot is a content-management platform for creator agencies. An agency opens a workspace, invites the people it works with, and runs its production through it.

This page explains what we store about you, why, who else handles it, and what you can ask us to do with it. It sits beside the Terms of use. Anything you want to ask about it goes to hello@getbacklot.com.

For the files on a workspace, the workspace owner decides what is kept and who sees it, and we process them on the owner's behalf. For your account, and for anything you send us directly, we decide, and this page is our promise about it.

Your account. Your name, your email address, and your password in hashed form — we never see or store it in readable form. If you sign in with Google instead, Google tells us your name, your email address and your Google account id, along with the basic profile details Google shares at sign-in; we never receive your Google password.

Your place on a workspace. Which workspaces you belong to, your role on each, what you may do there, the notification settings you chose, and when you accepted the Terms of use.

The work. The files uploaded to a workspace and the details attached to them: captions, notes, comments, dates, earlier versions, and the preview image, dimensions and length we read from a file so it can be shown properly.

The access record. Every time a file is shown or downloaded, Backlot records who opened it, which file it was, and when — and the workspace's managers can see that record.

Telegram, if you connect it. Your Telegram username and the chat id our bot needs to message you.

Connected assistants, if you connect one. If you let an AI assistant work on a workspace through Backlot Connect, we keep a record of that permission and of each action the assistant takes, so the workspace can see what was done in its name.

Billing. Card and payment details are held by Stripe, never by us. Subscriptions are sold through Link, a Stripe company, which acts as the merchant of record: it takes the payment, adds any sales tax or VAT, and sends the receipt. We keep only the references Stripe gives us for the workspace's customer and subscription, the plan, and whether it is on trial, paid up or overdue.

When you write to us. The “Talk to us” form on our home page keeps the agency name, email address and Telegram username you give it.

Partners. If you join our partner program we keep your name, email address and partner code, and we count visits that arrive through a partner link (the page they landed on and when — nothing that identifies the visitor).

To run the workspace; to show each file only to the people allowed to see it; to send the notifications you asked for, by email and, if you connected it, on Telegram; to take payment for a workspace; to keep the access record, because knowing that access is written down makes people think twice; and to reply to the people who wrote to us.

We use it for nothing else. We do not sell it, we do not hand it to advertisers, and we do not use content to train artificial intelligence — ours or anyone else's.

A small number of companies run parts of the service for us. Each one receives only what its part needs:

• Supabase — the database, file storage and sign-in, in the regions configured for the service (EU or US).
• Vercel — hosting the website and the app.
• Stripe — payments and subscriptions, sold through Link as the merchant of record.
• Resend — the emails we send you, such as invitations, sign-in links and password resets.
• Telegram — only if you connect it for notifications.
• Google — only if you choose to sign in with Google.

If you connect an AI assistant through Backlot Connect, what it asks for is sent to that assistant's provider, under your agreement with them.

Beyond these, we share personal data only when the law requires it.

We use a few cookies, and none of them is for analytics or advertising:

• The sign-in cookies that keep you signed in. Without them, the app cannot work.
• A referral cookie, set only when you arrive through a partner's link. It holds that partner's code for 90 days, so the partner is credited if you sign up or write to us.
• A partner-recruitment cookie, set only when you follow a link inviting you to join the partner program. It holds the inviting partner's code for 90 days.

The app also remembers in your browser that you have already seen the prompt to connect Telegram, so it does not ask twice. That never leaves your device.

Workspace content stays until the workspace owner deletes it, or until the workspace is closed. Your account details go when your account does.

The access record stays as long as the workspace does, even after the file it describes has been deleted — that is what makes it a record.

Deleted data leaves our backups on their normal cycle.

You can change your name and email address from your profile, and disconnect Telegram whenever you like. To see what we hold about you, or to have it deleted, write to hello@getbacklot.com. Where the data sits on a workspace someone else owns, we pass the request to that owner, because it is theirs to act on.

If you are in the European Union or the United Kingdom, the GDPR gives you the right to access your data, to have it corrected or erased, to receive it in a portable form, and to object to how we use it — and, if you are not happy with our answer, to complain to your data protection authority.

When we change this policy, we update the date at the top of this page. If the change matters to how your data is used, we tell you before it applies.

Questions about any of it go to hello@getbacklot.com.