Privacy Policy Last updated: 3 September 2026 Backspace (“Backspace”, “we”, “us” or “our”) provides digital exposure education and personal online exposure auditing services. We take privacy seriously and aim to collect only the personal information reasonably necessary to provide our services. This Privacy Policy explains what personal information we collect, why we use it, how long we keep it, who may process it in connection with our services, and the rights available to you. 1. Contact details Backspace operates under the trading name Backspace. Correspondence address: Suite 1A 121 Giles Street Edinburgh EH6 6BZ United Kingdom Email: contact@thebackspacehq.com For questions about this Privacy Policy, your personal information, or a request concerning your data, please contact us using the email address above. 2. Information we collect The information we collect depends on how you interact with Backspace and which service you use. Safe Start Plan To provide a Safe Start Plan, we may collect: your email address; your responses to our privacy and online-safety questionnaire; information about your privacy preferences, boundaries and concerns that you choose to provide; and other information you voluntarily provide that is relevant to the service. You are not required to provide your legal name or unnecessary identifying information for a Safe Start Plan. Please avoid providing personal information that is not relevant to the service. Personal Exposure Audit To provide a Personal Exposure Audit, we may collect: your email address; social media usernames, handles, profile URLs or accounts that you ask us to assess; your questionnaire responses; identifiers that you voluntarily provide and specifically ask us to investigate, which may include a name or other information relevant to determining your online exposure; and information identified from publicly accessible online sources during the audit that is relevant to assessing your digital exposure. We do not require additional identifying information where it is unnecessary for the audit. Because the purpose of a Personal Exposure Audit is to identify information that may be discoverable or associated with you online, the audit may identify personal information from publicly accessible sources that you did not provide directly to us. Purchases and enquiries When you purchase a product or service or contact us, information processed may include: your name, if you choose or are required by the relevant service to provide it; email address; correspondence with Backspace; order and transaction information; and information necessary to respond to your enquiry or provide your purchase. Backspace does not directly receive or store your complete payment-card details. Payments are handled through third-party payment services. Early access and marketing If you choose to join our early-access or email list, we may collect: your email address; information relating to your subscription, such as when you subscribed; and your communication preferences. Joining our marketing list is voluntary and is separate from purchasing an audit or other Backspace service. 3. How and why we use your information We use personal information only where we have a lawful basis for doing so. Providing products and services We process information necessary to: process and administer your order; communicate with you about your service; conduct an audit you have requested; prepare and deliver your audit report; and provide customer support relating to your purchase. Where this processing is necessary to provide a product or service you have requested, we generally rely on performance of a contract or taking steps at your request before entering into a contract. Responding to enquiries We use information you provide when contacting us to respond to your questions or requests. Depending on the circumstances, this processing may be necessary to take steps at your request before entering into a contract or may be based on our legitimate interests in operating and communicating about our business. Operating and protecting Backspace Where necessary, we may process limited information for legitimate business purposes such as maintaining the security of our services, preventing misuse, resolving disputes and protecting our legal rights. Where we rely on legitimate interests, we consider whether those interests are proportionate and whether your rights and interests override them. Legal and regulatory obligations We may process or retain information where necessary to comply with applicable legal, tax, accounting or regulatory obligations. Marketing Where required, we rely on your consent to send marketing emails. You can withdraw your consent or unsubscribe from marketing at any time using the unsubscribe option provided in our emails. Unsubscribing from marketing does not affect service-related communications that are necessary to fulfil an existing purchase. 4. Data minimisation Backspace follows a data-minimisation approach. We ask you not to provide information that is unnecessary for the service you have requested. For Personal Exposure Audits, you may choose to provide additional identifiers where you specifically want us to assess whether those identifiers can be connected with your online presence. Providing unnecessary additional information is not required. 5. Publicly available information As part of a Personal Exposure Audit, Backspace may research information that is publicly accessible online and assess whether information or accounts can be connected to you. This may include information appearing on social media platforms, websites, search engines and other publicly accessible online sources. We use this information only insofar as it is relevant to performing the exposure assessment you requested. 6. Who has access to audit and plan information Access to information collected specifically for the performance of a Backspace audit is restricted to the person conducting the audit. We do not sell your audit information or provide it to third parties for their own advertising or marketing purposes. However, companies that provide the technical infrastructure used to operate Backspace may process personal information on our behalf or in connection with providing their services. These may include: Microsoft, for email communications and document-processing services; GoDaddy, in connection with website hosting and related website infrastructure; Stan, in connection with the purchase and administration of products or services; Stripe, for payment processing; and other technical providers where necessary to operate our website or services. These providers process information according to their respective roles, contractual terms and privacy arrangements. We may also disclose information where required by law or where reasonably necessary to establish, exercise or defend legal rights. 7. Payment information Payments may be processed using Stan and Stripe. Payment providers may collect and process information required to complete your transaction. Their handling of that information is governed by their own applicable privacy terms. Backspace does not directly store your full payment-card details. 8. How long we keep your information We aim to retain personal information only for as long as it is necessary for the purpose for which it was collected. Audit information Questionnaire information, audit working materials, relevant attachments and our retained copy of your completed audit report are normally deleted within seven days after the completed audit has been delivered to you. This short retention period provides a limited window in which delivery or file issues can be resolved while minimising unnecessary retention of potentially sensitive audit information. Where reasonably practicable, you may request earlier deletion after delivery. Correspondence Audit-specific correspondence containing information used to perform your audit will normally be deleted as part of the audit deletion process where it is no longer required. We may retain limited correspondence where reasonably necessary to maintain business records, resolve a dispute, establish what service was requested or provided, or comply with a legal obligation. Transaction and business records Information relating to purchases, payments, accounting and other business records may need to be retained for longer where required for legal, tax, accounting, fraud-prevention or dispute-resolution purposes. This means that deletion of an audit does not necessarily result in deletion of every record relating to your purchase. Marketing information If you join our marketing list, we retain the information necessary to manage your subscription until you unsubscribe or we otherwise determine that it is no longer necessary. If you unsubscribe, we may retain limited information necessary to record and respect your opt-out. 9. International processing Some service providers used by Backspace may process or store personal information outside the United Kingdom. Where personal information is subject to an international transfer, the relevant provider may rely on applicable legal transfer mechanisms and safeguards required by data protection law. You may contact us if you would like further information about international processing relevant to your personal information. 10. Security We take reasonable steps designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. We also minimise the amount of audit information retained and limit access to information used to perform an audit. However, no electronic communication or storage system can be guaranteed to be completely secure. 11. Your data protection rights Depending on the circumstances and applicable law, you may have rights concerning your personal information, including the right to: request access to personal information we hold about you; request correction of inaccurate or incomplete information; request deletion of your personal information in certain circumstances; request restriction of processing in certain circumstances; object to certain processing; receive certain information you provided to us in a portable format where the right to data portability applies; and withdraw consent at any time where processing is based on your consent. These rights are not absolute and may depend on the circumstances and lawful basis for processing. To exercise a data protection right, contact: contact@thebackspacehq.com We may need to request limited information to verify that a request relates to the correct person. 12. Your right to object You have the right to object to certain processing of your personal information where we rely on legitimate interests. You also have the right to object to the use of your personal information for direct marketing at any time. To object, contact contact@thebackspacehq.com. You can also unsubscribe from marketing emails using the unsubscribe option provided in those emails. 13. Deletion requests You may contact us at contact@thebackspacehq.com to request deletion of personal information relating to you. Where the right to erasure applies, we will process the request in accordance with applicable data protection law. Some information may need to be retained where we have a lawful reason or legal obligation to retain it. If we cannot delete information you have requested us to erase, we will explain the applicable reason where required. 14. Complaints If you have concerns about how Backspace has handled your personal information, please contact us first at: contact@thebackspacehq.com You also have the right to make a complaint to the UK Information Commissioner’s Office (ICO). Information about raising a data-protection complaint is available from the Information Commissioner’s Office. 15. Children Backspace services are not intended for children, and we do not knowingly offer our audit services to children. If you believe a child has provided personal information to us, please contact us. 16. Changes to this Privacy Policy We may update this Privacy Policy where our services, technology, business practices or legal obligations change. The latest version will be published on our website and the “Last updated” date at the top of this policy will be revised accordingly.