This policy is a working draft pending legal review. It describes our intended practices and will be replaced by the reviewed version before general availability.
Privacy policy
Who we are
Backstory, Inc. ("Backstory") provides a session replay and analytics service to business customers. This policy covers this website and our role as a processor for customer data in the service.
This website
We record visits to this website with our own product, behind a consent gate. What you type is masked. We use cookieless aggregate page analytics. We honor Global Privacy Control. Forms you submit (waitlist, contact, trust requests) are stored to respond to you and are not sold.
Cookies
The website sets no tracking cookies. A theme preference is stored in local storage. The dashboard sets a session cookie after login.
The service
Our customers decide what their applications record. We process that data on their instructions under a Data Processing Agreement and, for healthcare customers, a Business Associate Agreement. Masking is applied on the end user's device before data reaches us. Data is encrypted in transit and at rest with keys per customer and per end user. Customers can export or erase an end user's data from the dashboard; erasure destroys the corresponding encryption key.
Retention
Customers configure retention per project between 1 and 400 days. Audit logs are retained for six years. Website form submissions are retained for 24 months.
Subprocessors and transfers
Our subprocessors and their locations are listed in the trust center. EU customer data is processed in the EU. Transfers rely on Standard Contractual Clauses where required.
Your rights
If you are an end user of a customer's application, contact that customer; we act on their instructions. If you are a website visitor or dashboard user, contact hello@backstory.io to access, correct, export, or erase your data.
Changes
We will post changes here and notify customers of material changes by email at least 30 days in advance.