BackerBasePrivacy Policy
Last updated: 21 September 2026
This policy explains how BackerBase LLC processes personal data when you visit backerbasehq.com, chat with us or email us, and which rights you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and the ePrivacy rules on cookies.
Fundraising platforms that we build and run for organizations have their own privacy notices. Where you use one of those platforms, its notice tells you who is responsible for your data there.
1. Who is responsible
BackerBase LLC
1621 Central Avenue, Cheyenne, WY 82001, USA
Email: privacy@backerbasehq.com
We have not appointed a data protection officer, because the law does not require one for our processing. Please send any privacy question or request to the address above.
2. What we process, why, and on what legal basis
Visiting the website
When you load a page, our servers and our content delivery network receive technical data that every web request carries: your IP address, browser and device type, the page requested, the referring page, the date and time, and the response status. We use it to deliver the site, keep it secure and find faults. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Server access logs are deleted automatically after 14 days.
Basic, cookie-free reach measurement
We count page views, visits, referring sites, approximate country, and device and browser type with PostHog, on PostHog's EU cloud in Frankfurt, Germany. Before you make a choice in the cookie banner, the analytics code keeps everything in the browser's working memory: nothing is stored on or read from your device, and the identifier it uses disappears when you leave the page. Our PostHog project is set to discard IP addresses, so they are not stored with the events. Legal basis: our legitimate interest in understanding, in a data-minimal way, how the website is used (Art. 6(1)(f) GDPR). You can object at any time (section 7), and choosing Decline in the banner turns this measurement off.
Analytics with cookies, only if you accept
If you choose Accept, PostHog also stores an identifier in a cookie and in your browser's local storage, so we can recognise return visits and understand how people move through the site over time. Legal basis: your consent (Art. 6(1)(a) GDPR, together with Art. 5(3) of the ePrivacy Directive and national laws implementing it, such as § 25(1) TDDDG in Germany). We do not record sessions, and we do not use advertising or marketing trackers.
Chat
If you use the chat, we process your messages, the email address you give us so we can reply, the page you wrote from and the time. We use them to answer you and, if you ask, to prepare a proposal. Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Please do not send payment details or sensitive personal data through the chat.
If you email us, we process your address, your message and anything you attach, to reply and handle your enquiry. Legal basis: Art. 6(1)(b) GDPR where it relates to a possible or existing contract, otherwise Art. 6(1)(f) GDPR.
3. Cookies and device storage
We store something on your device only when it is strictly necessary for something you asked for, or when you have consented.
| Name | What it does | Type | Kept for |
|---|---|---|---|
| bb_consent | Remembers whether you chose Accept or Decline, so we do not ask again | Cookie, strictly necessary | 12 months |
| ccchat:backerbase | Keeps your chat conversation available when you move between pages, and remembers if you answered or closed the chat's short feedback question. Created only when you do one of those things | Local storage, strictly necessary | Until you clear your browser data |
| ph_<project>_posthog | PostHog identifier for recognising return visits. Only after you choose Accept | Cookie and local storage, consent | Up to 12 months |
| __ph_opt_in_out_<project> | Records your analytics choice so PostHog respects it | Local storage, strictly necessary | Until you clear your browser data |
You can change your choice at any time: open cookie settings. Withdrawing consent does not affect processing that happened before.
4. Service providers who process data for us
We use the following providers. Each processes personal data only as needed to provide its service to us.
- Hetzner Online GmbH, Germany: server hosting. The server is in Helsinki, Finland.
- Cloudflare, Inc., USA: content delivery, DNS and protection against attacks. Every request passes through Cloudflare.
- PostHog Inc., USA, using PostHog's EU cloud in Frankfurt, Germany: website analytics.
- Supabase, Inc., USA, hosted on Amazon Web Services in London, United Kingdom: stores chat conversations.
- Resend, USA: sends us an email notification when a chat message arrives while no one is online.
- ImprovMX: forwards email sent to our backerbasehq.com addresses to our mailbox.
- Google LLC, USA: hosts the mailbox in which we receive and answer email and chat notifications.
We do not sell personal data, and we do not share it for advertising.
5. Transfers outside the EU and UK
Some providers are based in the United States, and BackerBase LLC is itself a US company. Where personal data is transferred to the US, we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK extension) where it exists, and otherwise on the European Commission's Standard Contractual Clauses. The United Kingdom benefits from an EU adequacy decision. You can ask us for more information on these safeguards at privacy@backerbasehq.com.
6. How long we keep data
- Server access logs: deleted automatically after 14 days.
- Analytics events: kept as long as they are useful for understanding long-term use of the website, and deleted when no longer needed. They contain no IP address.
- Chat conversations and emails: kept as long as needed to handle your enquiry and any business relationship that follows it, then deleted, unless we are legally required to keep them longer (for example for tax records).
7. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected, to have it deleted, to restrict how it is processed, to receive it in a portable format, and to withdraw consent at any time with effect for the future.
Right to object. Where we process data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. For the cookie-free reach measurement, choosing Decline in the cookie banner is the quickest way to object.
To exercise any right, email privacy@backerbasehq.com. We answer within one month. You also have the right to complain to a data protection supervisory authority, in particular in the EU or EEA country where you live or work, or where you believe an infringement took place.
If you live in a US state with its own privacy law, you can use the same address to ask what we hold about you or to have it deleted. We do not sell personal information or share it for cross-context behavioural advertising.
8. No automated decisions
We do not make decisions about you based solely on automated processing, and we do not build profiles for advertising.
9. Children
This website is meant for organizations and adults. It is not directed at children under 16, and we do not knowingly collect their data.
10. Security
All connections to this website are encrypted with TLS. Pages load scripts only from this domain and from our chat service, and access to stored data is restricted to the people who need it to answer you.
11. Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version.