Privacy statement

Version of 28 October 2026

• Who we are
• What we collect and why
• Cookies
• Who else sees it
• How long we keep it
• How we protect it
• Your rights
• Websites we host for you
• Changes

Who we are

Backend Lab makes and hosts websites for small businesses. We are responsible ("controller") for the personal data described here. For the personal data in the websites we host, our customer is responsible and we work for them (see Websites we host for you). You can reach us at info [at] backendlab.com.

What we collect and why

When you ask for a free website audit

• What: the website address, your name, your e-mail address, the time you gave permission, and your IP address. To check your e-mail address we send you a 6-digit code; we only store a scrambled version of it (a cryptographic hash), never the code itself.
• Why: to confirm your e-mail address, run the audit, send you the results and, as you allowed us when you asked, contact you about them — for example with a proposal for a new website. We send the report as a private link that works for 90 days, and note when and how often it is opened, so we know it reached you. We also use your IP address to stop misuse of the form (limits on how often audits can be asked for) and to see roughly where a request comes from (the country or region) when we prepare a proposal.
• Automated classification: we use automated tools, including AI, to classify the type of business from its public website. That decides which checks apply (for example the rules for healthcare providers), whether the link to your report is e-mailed to you as soon as it is ready or the report is looked at by us first, and whether we follow up with a proposal; the proposal itself is always a person's decision. The classification uses only the public website, never your name or e-mail address.
• On what basis: you asked for the audit (a step you take before a possible agreement), you gave permission to be contacted about it, and our legitimate interest in preventing misuse and preparing a fitting proposal.

The audit itself

The audit looks only at what anyone can see on the website from the outside. Its results are about the website, not about you. Sometimes they include names that are public on the website itself (for example a user name the site shows). We keep the results so we can compare later audits of the same website.

When you send a message through the contact form

• What: your name, your e-mail address, your website (optional), your message, and your IP address.
• Why: to answer you, and to stop the form being misused.
• On what basis: our legitimate interest in answering questions about our services, or a step you take before a possible agreement.

When you ask us to tell you about a new feature

• What: your e-mail address, the feature you're interested in (for now: e-mail hosting), when you asked, and your IP address.
• Why: to see how much interest there is, to e-mail you once if we launch that feature, and to stop the form being misused. We don't use your address for anything else.
• On what basis: your consent. You can withdraw it at any time by e-mailing us, and we'll remove your address.

When you accept a proposal

After an audit we may design a new website for your business and send you a private preview of it. If you don't like it, you pay nothing and owe us nothing. To make the design, we use the texts, photos and other details on your current website. If you don't accept, we delete the proposal 30 days after you decline it or it expires.

• What: what you fill in on the onboarding form — your name and e-mail address, your business's name, address and billing details, your domain name and the people who may use your panel — and the fact that you accepted our terms and conditions, this privacy statement and our processing agreement, with the time and the versions you accepted.
• Payment: you pay for the first year, and later for each yearly renewal, through our payment provider, a payment company licensed in the EU, which also handles your payment details under its own privacy statement. From it we receive only whether a payment succeeded, the type of payment method and a reference to the mandate for the yearly renewal. We never see your full card number.
• Why: to set up your website and your subscription, take payment, send invoices, and renew the subscription each year until you cancel.
• On what basis: our agreement with you, and the law, which requires us to keep invoices and accounting records.

When you sign in to your panel

• What: your e-mail address. To sign in, we e-mail you a one-time code; we only store a scrambled version of it, never the code itself. When someone signs in to your account from a new device, we e-mail a notice. If a business gives you access to its panel, we get your e-mail address from that business, which also decides whether you may publish changes.
• Why: to let you, and only you, into your panel, and to warn you when someone else might be using your account.
• On what basis: our agreement with the customer whose panel it is, and our legitimate interest in keeping the panel secure.

When you send us a change request

• What: your message and any photos you add, who sent it and when, what our AI assistant made of it (its answer, the change itself and a log of its steps), and what the request cost in AI. When you click Publish, we note who clicked and when, the network you clicked from (your IP address with its last part removed) and your browser.
• Why: to carry out the change, show you a preview before anything goes live, let you restore an earlier version, show you what each request cost and keep use fair, and be able to show who accepted which change. Clicking Publish is how you accept a change.
• How we use AI: changes are prepared by Mistral AI's models, through Mistral's servers in the EU, and checked by automated rules before you see them. We use your requests only to make the changes you ask for, never to train AI models: training is switched off. Mistral may keep requests and its answers for up to 30 days to detect abuse; we have asked it not to keep them at all. AI can make mistakes, which is why nothing goes live until you have checked the preview and clicked Publish.
• People in what you send: names and photos of people in your request become part of your website. For those, you are responsible and we work for you, as described under Websites we host for you; make sure you have their permission.
• On what basis: our agreement with you, and our legitimate interest in being able to show who accepted which change, and in preventing misuse.

Giving us these details is up to you; without them we can't run the audit, answer your message or provide your website. We don't use your data for anything else, and we never sell it.

Cookies

This website sets a small, necessary cookie (csrftoken) that protects our forms against misuse. When you sign in to your panel, it also sets a login cookie and a cookie that recognises your device, so we can warn you about sign-ins from new devices. We don't use analytics, advertising or tracking cookies, so there is no cookie banner. Our team's admin area uses a login cookie, but only for us. This website's pages load nothing from other companies' servers — not even fonts — so opening them shares your IP address with no one else.

We add no cookies or tracking scripts to the websites we host. If a customer asks us to add another company's code to their website (a widget or a tracking code, for example), that is their choice and their website's privacy statement covers it.

Who else sees it

We use a few services to run this website, the audit and the websites we host. They may only use the data for us; our payment provider also has duties of its own under the law on payments.

Some of these companies are based in the United States, and Amazon serves the websites we host from the location nearest to each visitor, one of more than 750 worldwide. Where data leaves the European Economic Area, the EU's standard contractual clauses or the EU–US Data Privacy Framework protect it. Your name, e-mail address and account details are stored and processed in the EU; the services outside the EU only receive information about websites, and copies of the websites we host. Beyond these services, we only share data with others when the law requires it.

How long we keep it

The audit and your messages

• Verification codes (your e-mail address, the scrambled code and your IP address): 7 days after they were sent, also when the audit was never requested.
• Audit requests and their results: as long as we may follow up on them or compare later audits of the website. The IP address is removed after 30 days. The link to your report stops working after 90 days.
• Contact messages: as long as needed to answer you and follow up. The IP address is removed after 30 days.
• Feature interest (your e-mail address and the feature): until we've let you know we launched the feature, and at most 2 years. The IP address is removed after 30 days.

Proposals and onboarding

• Proposals you decline or that expire, and onboarding forms you don't finish: 30 days after they close.
• Previews of a new website or of a change: until they are published, rejected or expire, and never longer than 35 days.
• The onboarding form: when you pay, its details move into your customer record; the form itself is deleted 90 days after your website goes live.

When you're a customer

• Your customer record: for as long as we work together, and invoices and other records for 7 years afterwards, as Dutch tax law requires.
• Panel sign-ins: sign-in codes 7 days after they were sent; remembered devices until that person's access to the panel ends.
• Change requests: your messages, and the details of a request (the AI's answer, the change and the log of its steps), 90 days after the request closes; your original photos 30 days after it closes. Photos used on your website stay there as part of it.
• The record of each request and what it cost: as long as your subscription runs, plus 12 months.
• The network and browser of a Publish click: removed after 30 days. Who clicked and when stays with the record of the request.
• Logs of the systems that carry out requests, which hold only references to requests: 30 days.

The websites we host

We keep these on our customer's behalf, as described in our processing agreement:

• Published versions of a website: 100 days after they were published, so any version from the last three months can be restored; the live version for as long as it is live. Versions that were never published: 30 days. All of them are deleted when the website leaves us.
• Raw access logs of visits to a website: 35 days.

Copies in our backups disappear as the backups are replaced, within 90 days. We look at what we keep at least once a year and delete what we no longer need. You can ask us to delete your data at any time (see below).

How we protect it

All traffic to this website and to the websites we host is encrypted (HTTPS). The audit's verification codes are stored only in scrambled form. The panel has no passwords to steal: you sign in with a one-time code we e-mail you, we e-mail a notice when someone signs in from a new device, and the customer decides who may publish changes. Our admin area is open to our team only and protected against password guessing. The websites we host are plain files, with no database or login page to break into. Our own data is stored in a data centre in the EU, with encrypted backups at a second provider, also in the EU.

Your rights

You may ask us to see, correct or delete your personal data, to limit how we use it, or to give you a copy in a common format. You may object to the use we base on our legitimate interest, and withdraw your permission to be contacted at any time; that doesn't affect what happened before. We can't delete what the law requires us to keep, such as invoices. E-mail info [at] backendlab.com; we answer within one month.

Is your question about personal data in a website we host, for example your photo on a business's website? Then please ask the business whose website it is. It decides what happens to that data; we carry out its instructions and help it answer you.

Not happy with how we handle your data? Tell us, so we can fix it. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Websites we host for you

When we host a website for you, the personal data in it is yours: the names, photos and texts on its pages, what you send us to change it (including the people shown in it), and the logs of its visitors. We process it only on your instructions, as your processor; our terms and conditions and our processing agreement cover this, including the full list of companies we use for it. Your website needs its own privacy statement; we're happy to help.

Visiting a website we host? We add no cookies or tracking scripts to it. Its pages are stored in Amazon's data centres in the EU and served from the Amazon location nearest to you, one of more than 750 worldwide. Like any web server, it logs each visit (your IP address, the page, your browser and the time); we turn these logs into visitor statistics for the website's owner and delete the raw logs after 35 days. The business that owns the website decides about this data: if you have a question about it or want it deleted, please contact them.

Changes

We may update this statement when our website or services change. The date at the top shows the current version.