Privacy Policy

1. Introduction

Backbone Solutions ("Backbone," "we," "us," or "our") is a venture of Horizon Digital Marketing LLC (Milwaukee, Wisconsin, USA), which operates the Backbone IMS platform at app.backbonesolutions.ai and the website at backbonesolutions.ai. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to operators ("you") who use Backbone to run their inventory, storefront, order fulfillment, and social media posting.

Backbone is a multi-tenant SaaS — your business's data is logically isolated from every other Backbone tenant via row-level security in our database, and we do not aggregate, anonymize, or train on tenant data without explicit consent.

2. Information We Collect

Account information

When you create a Backbone account we collect your name, email address, password (stored hashed via Supabase Auth), business name, business address, and your role within the business.

Inventory and catalog data

Product names, variants, SKUs, barcodes, costs, prices, attribute schemas, images you upload, categories, vendors, brands, and stock levels at each of your locations. This is the data you put into Backbone — we hold it on your behalf so you can run your operations.

Sales and order data

When a customer buys one of your products through a Backbone-powered storefront, we receive the line items (variant ID + qty), the customer's shipping address (when provided for fulfillment), and the external transaction ID from your payment processor. We do not receive or store the customer's payment card details — those flow directly to Stripe.

Integration credentials

When you connect Clover POS, we store the OAuth access token Clover issues. When you connect Printify or Printful, we store the API token you provide. These credentials are scoped to your business and protected by the integration’s authorization controls. TikTok Shop credentials are handled server-side as described below.

Usage data

We log which pages you visit, which features you use, and approximate timestamps so we can debug issues, measure feature adoption, and detect abuse. We do not use third-party analytics or behavioral advertising trackers.

What we do not collect

We do not collect biometric data, government-issued IDs, payment card numbers, social security numbers, health records, or any data unrelated to running your business.

3. How We Use Your Information

We use the information we collect to:

• Operate the Backbone platform — show you your inventory, accept orders, route fulfillment, sync sales channels, send transactional emails
• Forward orders for fulfillment — when a customer buys a print-on-demand variant, we send the order to your connected Printify or Printful account using the credentials you provided
• Send service notifications — billing, security alerts, account changes, scheduled maintenance
• Detect and respond to abuse, fraud, or unauthorized access
• Improve the product — feature usage tells us where to invest engineering time

We do not sell your data. We do not share your data with advertisers. We do not train AI models on your inventory or customer data without explicit, opt-in consent surfaced in-product.

4. Third-Party Services We Use

To deliver Backbone, we use these hosting, payment, and email providers and optional integrations. Each has its own privacy policy; the information shared depends on the features and connections you authorize.

• Supabase — database + authentication hosting (all Backbone data, encrypted at rest, accessed via row-level security)
• Render — application hosting (request processing and operational logs)
• Stripe — subscription billing for your Backbone subscription, and optionally checkout for your customers
• Groq — AI assistant processing (messages and business information needed for authorized requests)
• Anthropic (Claude API) — invoice parsing and, when configured, assistant processing (uploaded invoice content and information needed for authorized requests)
• Resend — transactional email delivery
• Twilio — SMS delivery for enabled messaging features (recipient phone numbers and message content)
• Sentry — application error monitoring (diagnostic events, with configured filtering of secrets and personal information)
• Microsoft 365, supplied through GoDaddy — business support and security mailboxes (email addresses, messages and attachments)
• Google Gmail — forwarded copies of business support and security email monitored by the owner, including message content and attachments
• Cloudflare — DNS and hosting-provider edge delivery, including connection metadata and content handled to deliver the service
• Clover (Fiserv) — Clover POS integration via OAuth 2.0
• Printify — print-on-demand fulfillment (your token, your customers' shipping addresses for orders you forward)
• Printful — alternative print-on-demand fulfillment
• Meta Platforms (Facebook / Instagram) — when you connect an Instagram Business/Creator account, content publishing + Page/IG-account listing via the Facebook Graph API
• X (Twitter) — when you connect an X account, posting tweets + media upload via the X API
• LinkedIn — when you connect a LinkedIn account, sharing posts on your behalf via the LinkedIn API
• TikTok — optional, separate connections for publishing videos through the Content Posting API and managing authorized shop data through TikTok Shop APIs; see the dedicated sections below
• Google (YouTube) — when you connect a YouTube channel, uploading videos via the YouTube Data API
• Pinterest — when you connect a Pinterest account, creating pins + reading your board list via the Pinterest API

Adding a new subprocessor is a meaningful change. We update this list before bringing one online.

5. Connected Social Media Accounts

Backbone's social-posting feature lets you connect your own accounts on X, LinkedIn, Instagram, Facebook, TikTok, YouTube, and Pinterest so Backbone can publish content you create, or product posts you approve, to those accounts on your behalf.

How connecting works

You authorize each account through that platform's own official OAuth consent screen. You never give Backbone your social-media password — the platform hands us a token after you approve.

What we store

For each connection we store the access token (and a refresh token where the platform issues one), the minimum account identifier needed to post (e.g., your Instagram Business account ID and Facebook Page token, your Pinterest board ID, your LinkedIn member URN), and the label you choose for the connection. These tokens are encrypted at rest and are never exposed to your browser or to any other tenant.

What we access, and why

We request only the permissions needed to post:

• Instagram / Facebook — instagram_content_publish to publish, and instagram_basic / pages_show_list / pages_read_engagement to list the Facebook Pages and linked Instagram Business accounts you administer so you can choose which to post to. We do not read your direct messages, comments, follower lists, or ads data.
• X — permission to post and to upload media.
• LinkedIn — w_member_social to share posts as you.
• TikTok — video.publish / video.upload to publish videos.
• YouTube — youtube.upload to upload videos to your channel.
• Pinterest — pins:write to create pins and boards:read to list your boards.

What we do not do

We do not read your private messages, we do not post without your action (Creator mode) or your configured approval (auto-ad mode), we do not sell or share this data, and we do not build advertising or behavioral profiles from it.

Disconnecting

You can disconnect any social account at any time from the Backbone dashboard, which deletes the stored token immediately. You can also revoke Backbone's access from the platform directly (Instagram → Settings → Apps and Websites; Google → myaccount.google.com/permissions; X → Settings → Connected apps). Tokens are also deleted when you close your Backbone account.

Platform compliance

• Backbone's use and transfer of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.
• Backbone's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Backbone's use of the TikTok and Pinterest APIs adheres to each platform's respective Developer Terms and Platform Policies.

6. TikTok Shop

TikTok Shop is a separate, optional sales-channel integration from the TikTok Content Posting connection described above. When available and enabled for your business, you authorize it through TikTok Shop’s consent process. Access is limited to the permissions granted for the supported shop workflows.

Information and purposes

We may receive shop and seller identifiers; authorization tokens; product, listing, and SKU identifiers; and orders, line items, quantities, amounts, status, and timestamps. Order responses and event notifications may contain customer names, contact details, and delivery addresses where TikTok supplies them under your authorization. We may retain the corresponding API responses and webhook payloads for processing and troubleshooting; they are subject to the same access and deletion requirements as the underlying data.

We use this information to connect the correct shop, associate channel listings with your inventory, import orders, reconcile sales and inventory records, and investigate integration errors. We do not use TikTok Shop customer data for advertising, customer profiling, or AI model training. Optional future workflows that need additional data or permissions require a review and an updated disclosure before being enabled.

Access, disconnection, and deletion

Shop credentials are stored server-side and are not returned to the merchant’s browser. Merchant access to shop records is restricted to the authorized business through membership checks, roles, and database row-level security. Operational access is limited to authorized personnel who need it to provide the service.

Disconnecting removes stored authorization tokens and stops future synchronization. It does not automatically delete historical orders, mappings, or event records. At the end of the relationship, or on an authorized request, we use a separate erasure process to remove or sanitize customer data, raw order data, and event payloads from active records. Minimum accounting and provenance records, such as ledger references and receipt identifiers, and a pseudonymous shop marker may remain for reconciliation and to prevent erased data from being imported again. These records exclude customer contact details, remain restricted, and are reviewed for continued necessity; pseudonymous data is not treated as anonymous. You may also revoke access in TikTok Shop directly. Requests from merchants, individuals, or TikTok Shop can be sent to the privacy contact in this policy.

7. Customer Personal Data

If your customer buys a product on a storefront powered by Backbone, we may receive their name, shipping address, email address, and phone number when supplied for fulfillment. Authorized connected shops may also supply associated account and order identifiers, as described in the TikTok Shop section above.

When you authorize fulfillment, we pass the necessary data to your connected provider (Printify, Printful, etc.). We do not market to your customers or build advertising profiles of them. Data is shared only as needed for the authorized service, with the providers described above, or as required by law. As the merchant and data controller, you are responsible for telling customers how their data is processed; your customer-facing privacy policy should disclose Backbone as a processor acting on your documented instructions.

8. Data Security

Backbone uses merchant membership and role checks, database row-level security, and HTTPS connections to protect access to business data. Privileged service credentials are restricted to server-side use. Our Security & Privacy Program sets requirements for access review, encryption, endpoint protection, development, incident response, and data handling. It is a policy statement, not an independent certification.

If we discover a security incident affecting your data, we will notify affected parties without undue delay and within the applicable contractual and legal deadlines. We will provide the known impact, mitigation steps, and a contact for updates.

9. Data Retention

• Active account data is retained only for the authorized service and its necessary operational purposes while your account is active.
• After account closure or an authorized deletion request, active personal data is deleted or sanitized within 30 days, or sooner when required by law or applicable platform terms.
• For TikTok Shop offboarding, this includes customer fields and personal data in raw order records and webhook payloads. Disconnecting alone removes tokens; the separate erasure process handles historical data. Minimum accounting and provenance records without customer contact details, and a pseudonymous marker used to prevent reimport, may remain for those purposes. These records remain restricted and are reviewed for continued necessity.
• Disaster-recovery backups are kept isolated from ordinary business processing and are allowed to expire on our hosting provider's backup schedule rather than being kept indefinitely. If a backup is ever restored, pending deletions are reapplied before the data returns to use.
• Security and audit logs are kept only as long as they are needed for security and operations, and must exclude customer payloads and unnecessary personal identifiers.
• If a law requires specific records to be retained longer, we restrict and isolate those records for that purpose and period. We explain the exception and duration to the requester unless the law prohibits notice.

We record completion of authorized deletion requests and provide confirmation on request, including any remaining backup expiry period or legal exception. The same requirements apply to service providers handling the affected data on our behalf.

10. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a machine-readable format
• Object to or restrict certain processing
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email support@backbonesolutions.ai with “Privacy” in the subject. We verify your identity or authority and respond within 30 days, or sooner when required by applicable law or platform terms. We explain any restriction or legally permitted extension. Customers of a merchant may also contact that merchant directly; we assist the merchant or TikTok Shop with authorized access, correction, export, and deletion requests.

You can disconnect any third-party integration (Clover, Printify, Printful) at any time from Settings → Connections. Disconnecting removes stored credentials; it is separate from deleting historical records. You can also revoke access at the connected provider.

11. International Transfers

Backbone is operated from the United States. Our subprocessors may store and process data in other regions. Processing locations depend on the providers and features used, including their logs and backups. Contact us for information about the relevant processing locations. Where applicable law requires safeguards for an international transfer, those safeguards must be in place before the transfer.

12. Children's Privacy

Backbone is a business-to-business service. It is not directed at individuals under 18 and we do not knowingly collect personal information from children.

13. Cookies and Tracking

The Backbone web application uses cookies for authentication and storing your interface preferences (sidebar state, view mode, density). We do not use advertising cookies, third-party trackers, or fingerprinting.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes (new subprocessors, expanded data collection, changed retention periods) are communicated via in-product banners and email at least 30 days before they take effect. Minor updates (clarifications, typo fixes) are posted here with the "Last updated" date refreshed.

15. Mobile Information and SMS

This section applies to consumers who contact a business operating on Backbone, including shoppers who submit a vehicle-inquiry form to Masari Motors at masarimotors.com. If you enter your mobile number and check the SMS consent box, we use that number only to reply to your inquiry and to confirm or update an appointment you booked with us. Message frequency varies. Message and data rates may apply. Reply HELP for help, or STOP to opt out at any time.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of personal data may be shared as described elsewhere in this policy, but text-messaging originator opt-in data and consent are not shared with any third parties.

The full program terms are in section 17 of our Terms of Service, and every way a customer can opt in is documented at backbonesolutions.ai/sms-opt-in.

16. Contact Us

Privacy requests and general support: support@backbonesolutions.ai. Use “Privacy” in the subject so the request reaches the program owner.
Security incidents and vulnerability reports: security@backbonesolutions.ai.

Do not send passwords, access tokens, payment details, or unnecessary customer data by email.

Backbone — a venture of Horizon Digital Marketing LLC
Milwaukee, Wisconsin, USA