Privacy Policy

1. Who we are (Data Controller)

Product Space AB is the data controller responsible for your personal data.

• Company: Product Space AB
• Address: Tegnérgatan 37, 111 61 Stockholm, Sweden
• Privacy contact: [email protected]

2. How the Service is used

Backbone is a business-to-business tool used by organisations to manage projects, allocations, time reporting, expenses, leave, and related operations. In most cases your employer or the organisation that invited you decides which of your data is entered into the Service and acts as the controller of that data, while we process it on their behalf. This policy describes the data we handle in our role and the choices available to you.

3. Personal data we collect

We collect the following categories of personal data:

• Account & identity data: your name and email address, used to create and authenticate your account.
• Profile data (optional): date of birth, personal email, personal phone number, and postal address (street, city, postal code, country).
• Emergency contact data: the name, relationship, and phone number of a person you choose to provide. Please ensure that person is aware before sharing their details with us.
• Payroll & financial data: bank account details (IBAN, BIC) and tax identification number, where your organisation uses Backbone for payroll-related administration.
• Preference data: shirt size, dietary requirements, and information about dependents that you choose to provide.
• Contacts you create: the first name, last name, email, and phone number of external business contacts you add.
• Technical data: a session cookie required to keep you signed in, and limited server-side telemetry (such as request traces) used to operate and secure the Service.

Sensitive data. Some optional fields — for example dietary requirements — may reveal special categories of data under Article 9 GDPR (such as religious beliefs or health). We process these only where you have voluntarily provided them and on the basis of your explicit consent or your organisation’s legal obligations. You are never required to provide them.

4. Sign in with Google

You can sign in using your Google account. When you do, Google shares your verified email address and basic profile information (such as your name) with us so we can authenticate you and, where applicable, connect you to your organisation. We do not receive your Google password. Your use of Google sign-in is also subject to Google’s own privacy policy.

5. How we use your data and our legal bases

We process personal data for the following purposes:

• To provide the Service — create your account, authenticate you, and deliver core features. Legal basis: performance of a contract (Art. 6(1)(b)) and our legitimate interest in operating the Service (Art. 6(1)(f)).
• To send transactional emails — such as invitations, account notifications, and security messages. Legal basis: performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).
• To administer payroll and financial information where your organisation requires it. Legal basis: legal obligation (Art. 6(1)(c)) and the controller’s legitimate interest.
• To secure and maintain the Service — monitoring, troubleshooting, and preventing abuse. Legal basis: legitimate interest (Art. 6(1)(f)).
• To handle optional and sensitive fields you choose to provide. Legal basis: consent (Art. 6(1)(a) and, where relevant, Art. 9(2)(a)).

We do not use your data for advertising, and we do not sell your personal data or use it for remarketing.

6. Demo environment

When we give you sign-in details for a Backbone demo environment after a sales conversation, we record how the demo is used. This applies only to the demo environment, not to organisations that use the Service.

• What we record: which pages you open and how long they are visible, clicks on buttons and tabs, filter changes, forms submitted, and files downloaded, together with the demo login and the time. We do not record what you type into fields.
• Why: to understand which parts of the product are of interest to your organisation, so we can tailor our follow-up, and to improve the product and our demos. An AI model (see section 7) helps us summarise the usage.
• Legal basis: legitimate interest (Art. 6(1)(f)). The data is used only by us and is not shared for advertising.
• How long: each recorded event is deleted 90 days after it happened.
• Your choice: you can object at any time by emailing [email protected]. We then stop recording usage for your demo and delete what we have recorded.

7. Who we share data with

We do not sell personal data. We share it only with service providers (processors) who help us run the Service under appropriate data protection agreements:

• Hosting: our infrastructure is hosted with Hetzner in Finland (EU). Your data is stored within the European Union.
• Authentication: Google, where you choose to sign in with Google.
• AI features: Google (Gemini API), which processes the content sent to AI features: receipts you ask us to read, questions you ask the AI assistant together with the organisation data it looks up to answer them (limited to what you can access yourself), and the demo usage summaries described in section 6.

We may also disclose data where required by law or to protect our legal rights. Because our hosting is located within the EU, your data is not subject to international transfers outside the EU/EEA in the normal course of operating the Service. Content sent to AI features may be processed by Google outside the EU/EEA, under the EU standard contractual clauses or the EU-US Data Privacy Framework.

8. How long we keep your data

We keep personal data only as long as necessary for the purposes described above:

• Account and profile data — for as long as your account is active. After your account or your organisation’s account is closed, we delete or anonymise it within 90 days, unless a longer period is required.
• Payroll, financial, and tax records — retained for the statutory period required by applicable accounting and tax law (in Sweden, generally up to 7 years).
• Technical logs and telemetry — retained for a short period (typically up to 90 days) for security and troubleshooting.
• Demo usage data — 90 days from when it was recorded (see section 6).

9. Your rights under the GDPR

You have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability — receive your data in a structured, machine-readable format;
• withdraw consent at any time, where processing is based on consent (without affecting prior processing).

To exercise any of these rights, contact us at [email protected]. If your data was entered by your employer or organisation, we may direct your request to them as the relevant controller. You also have the right to lodge a complaint with your local supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se).

10. Cookies

We use a strictly necessary session cookie to keep you signed in. We do not use advertising or third-party tracking cookies. In the demo environment only, our own usage measurement (section 6) keeps a session identifier in your browser’s session storage and may set a short-lived first-party cookie; both are gone when you close the tab or within a minute. Nothing is shared with third parties for tracking.

11. Data security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and tenant isolation between organisations. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.

12. Children

Backbone is a workplace tool intended for use by businesses and their staff. It is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16. (Fields relating to dependents are about your family members for administrative purposes and are not accounts for those individuals.)

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service.

14. Contact us

For any questions about this Privacy Policy or your personal data, contact us by email at [email protected], or by post at Product Space AB, Tegnérgatan 37, 111 61 Stockholm, Sweden.