Privacy Policy

Introduction

At Backrow ("we," "our," or "us"), we're committed to protecting your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI powered educational platform, including intelligent note taking, real time transcription, and automated study tools.

Who we are (data controller)

The controller responsible for your personal data is:

Representatives in the EU and UK (Article 27)

We have not designated a representative in the European Union under Article 27 GDPR. Requests and complaints from the EU are handled directly by our data protection contact at the address above, in English, on a 30 day response commitment — the same route, and the same deadline, a representative would have given you. We have likewise not designated a UK GDPR Article 27 representative; UK requests are handled at the same address on the same basis.

None of this affects your rights. You can exercise every right in Section 4 by writing to privacy@backrow.ai, and you can complain to your own supervisory authority — in your own country, in your own language — without coming to us first. See Section 11 for how.

Is providing your data mandatory? Creating an account requires an email address and a password; without them we cannot give you an account. Everything else — uploading materials, recording audio, connecting Google or Microsoft, providing a writing sample — is optional, and declining only disables that specific feature. We never condition access to the Service as a whole on consent to recording, analytics, or marketing.

1. Information We Collect

1.1 Information you provide

• Account information: name, email address, institution, major, academic year
• Educational content: notes, transcripts, flashcards, quizzes, summaries, mind maps, and other study materials you create or upload
• Uploaded course materials: PDFs, slide decks, lecture notes, problem sets, and other documents you choose to import into Backrow
• Writing samples: samples of your own writing that you optionally provide so our writing tools can match your style
• Prompts and outputs: the text you submit to our AI tools and the output generated in response
• Profile data: profile picture, preferences, settings
• Communication: messages, support requests, feedback

1.2 Voice and biometric data

When you use the recording or transcription features, we collect:

• Audio recordings: the audio captured by your device
• Voice characteristics: features extracted from your audio by our transcription providers for the purpose of producing accurate transcripts

Voice data is classified as a biometric identifier under several US state laws (Illinois BIPA, Texas CUBI, Washington HB 1071) and as a special category of personal data under GDPR Article 9. We collect and process it only with your explicit consent and only for the purposes described in Section 3c.

1.3 Automatically collected information

• Usage data: pages visited, features used, time spent, interactions
• Device information: browser type, OS, device type, IP address
• Cookies & tracking: session cookies, analytics cookies, preference cookies (see Section 8)
• Performance data: error logs, crash reports, API usage
• Device identifier (browser fingerprint): collected to detect and prevent fraud and abuse, including duplicate account creation. Legal basis: legitimate interest.

1.4 Information from third parties

• Authentication providers: Google, Microsoft (if you sign in with them)
• Payment processors: Stripe (payment information, subscription status)
• Integration services: data from connected services you authorise (Google Calendar / Drive / Gmail, Outlook Calendar, Canvas, YouTube, etc.). See Section 3a to 3b for how we handle data from each.

2. How We Use Your Information

• Provide services: transcription, AI study tools, note organization
• AI processing: route your prompts and source content to the AI and transcription providers listed in Section 3 (and on our Subprocessors page) to generate text, explanations, study materials, and transcripts
• Improve the platform: analyze usage patterns, fix bugs, enhance features
• Personalization: customize your experience, recommendations, study schedules
• Communication: send service updates, feature announcements, support responses
• Security: detect fraud, prevent abuse, enforce the Terms of Service
• Legal compliance: comply with legal obligations and respond to legal requests
• Analytics: understand how students use the platform to improve educational outcomes
• Advertising (consent only): if you accept the advertising cookie category, show you Backrow ads on Meta and TikTok and measure whether they worked. Never using your educational content, notes, uploads, prompts, or voice data — only the fact of your visit and the key actions you took

2a. Legal Bases for Processing

Where the GDPR or UK GDPR applies to you, we must have a lawful basis for each purpose. This is ours:

Where we rely on consent you may withdraw it at any time, and where we rely on legitimate interests you may object — see Section 4. Withdrawing consent does not affect processing already carried out, and it does not affect the parts of the Service that run on the contract basis.

We do not use your content to train our own AI models, and the AI providers in Section 3 receive your content under API terms that exclude it from general model training.

3. Third Party Services & Data Sharing

We use the third party services listed below to operate our platform. Your data may be processed by these services in the course of providing features you use. For the complete, dated list of all our subprocessors, see our Subprocessors page.

3a. Google User Data: Limited Use Disclosure

Backrow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you connect a Google account at backrow.ai/connections, we request the minimum set of scopes needed for each feature, listed below.

Scopes we request and how each is used

• Sign in with Google: openid, userinfo.email, userinfo.profile: read your account email, name, and profile picture so we can identify you when you sign in. Nonsensitive.
• Google Drive: drive.file: read only the specific files you open through the Backrow file picker, never your full Drive. Used so the Rowly AI assistant can summarise a PDF or Doc you've explicitly opened. We never list, search, or access any file you haven't picked.
• Google Calendar: calendar.readonly: read your upcoming events so the AI study planner can suggest study blocks that respect your existing schedule, and so the Rowly assistant can answer questions like "what's on my calendar tomorrow?". Read only. Backrow never creates, modifies, or deletes calendar events.
• Google Classroom: classroom.courses.readonly, classroom.coursework.me.readonly, classroom.student-submissions.me.readonly: read the names of the courses you're enrolled in, the assignments those courses have set you, and the submission status of each (turned in, returned, late) so Backrow's Tasks/Assignments card on the Home dashboard shows your real upcoming coursework and the AI tutor can answer questions like "what assignments do I have due this week?". Read only. Backrow never creates, modifies, submits, grades, or deletes any Classroom data. We never touch other students' data: the .me scopes restrict access to the signed in student only.
• Gmail: gmail.readonly: read your recent messages so the Rowly assistant can answer questions about course announcements and instructor emails, and so Backrow can surface deadlines mentioned in your inbox. Read only. Backrow never sends, drafts, modifies, labels, or deletes mail. Message content is only read at the moment you ask a question that needs it; we do not bulk index or continuously sync your mailbox, and message bodies are not stored after the answer is produced.

Two different ways to connect email. The gmail.readonly scope above is the OAuth route, and it reads messages only in response to a question you ask; nothing is written to our database. Separately, you can connect any mailbox (Gmail, iCloud, Yahoo, Outlook, other IMAP providers) using an app password. That IMAP route does synchronise message headers and bodies into our database so they can be searched offline, where they are protected by row level security and deleted when you disconnect the mailbox or close your account. Connect whichever route you prefer; you are not required to use either.

How Google user data is handled

• No ML training. We do not use Google user data to develop, improve, or train generalized AI / ML models. When the Rowly assistant references a specific calendar event, course, or assignment in a response, only the items needed for that one answer are sent to the AI provider serving that turn, and they are not retained for model training.
• No third party transfers. We do not transfer Google user data to third parties except: (a) as needed to provide or improve user facing features (e.g. sending the specific calendar event you asked about to the AI provider answering that one question); (b) to a service provider acting on our behalf under sufficient confidentiality and security obligations; (c) for security, legal compliance, or to respond to a lawful request.
• No selling. We never sell Google user data.
• Storage. Any Google data we cache (for example, a calendar event you asked the AI tutor about) is stored in our database under row level security so only you can read it. OAuth access and refresh tokens are encrypted at rest using AES-256-GCM with a per user key.
• Disconnect. You can disconnect at backrow.ai/connections. On disconnect we mark the integration as inactive and immediately stop using the tokens; the encrypted token record is retained in an inactive state and is not used by the Service.
• Deletion. To fully delete the underlying token records and any cached Google data we hold for you, email privacy@backrow.ai and we will action the request within 30 days. When you delete your Backrow account, all Google user data we hold (including tokens and any cached records) is deleted within 30 days as part of standard account deletion cleanup.
• Human access. Backrow staff do not read your Google user data. Aggregated, anonymized usage metrics (e.g. "X% of users have Calendar connected") may be used internally to prioritise features.

To revoke Backrow's access to your Google account, you can either disconnect inside Backrow at backrow.ai/connections, or visit myaccount.google.com/permissions and remove Backrow from the list of connected apps.

3b. Microsoft User Data: Limited Use

If you connect a Microsoft account (for Outlook Calendar), Backrow's use of data received from Microsoft Graph follows the same Limited Use principles described above for Google. We request the minimum scopes required for the feature you connect, do not transfer Microsoft user data to third parties except as needed to provide the user facing feature you requested, do not use Microsoft user data to train AI/ML models, and do not sell Microsoft user data.

Scopes we request

• Outlook Calendar: Calendars.Read: read your upcoming events so the AI study planner can suggest study blocks that respect your schedule. Read only. Backrow never creates, modifies, or deletes calendar events.

To revoke Backrow's access to your Microsoft account, disconnect inside Backrow at backrow.ai/connections, or visit myapps.microsoft.com and remove Backrow.

3c. Voice & Biometric Data

When you use Backrow's recording or transcription features, your audio is sent to one of our transcription providers (AssemblyAI or ElevenLabs) which produces a text transcript. The transcription process involves extracting features from your audio that may qualify as biometric identifiers under US state laws including Illinois BIPA, Texas CUBI, and Washington HB 1071, and as special category data under GDPR Article 9.

How we handle voice data

• Consent: we collect explicit consent the first time you use a recording or transcription feature. You can withdraw consent at any time by stopping use of those features and deleting your recordings.
• Purpose limitation: voice data is used solely to produce transcripts and the downstream study materials you generate from those transcripts. We do not use your voice data to train AI/ML models, to identify you across services, or for advertising.
• Provider handling: our transcription providers retain audio under their own retention policies. Under the standard API terms we use with these providers, customer audio submitted via the API is not used for general model training. We have not negotiated additional restrictions beyond those default terms.
• Retention: recordings you save in Backrow are kept until you delete them or delete your account, subject to the audio replay periods below. If you do not interact with a recording or the account holding it for three (3) years, we automatically delete that voice data and any features derived from it (enforced by a scheduled database job).
• Deletion: deleting a recording in Backrow removes the audio from our storage. Once submitted to a transcription provider, the audio is governed by that provider's own retention policy on their servers; we do not currently call provider side delete APIs as part of the recording delete flow. Backups containing the deleted recording are purged on our hosting provider's standard backup rotation.

Recording audio kept for replay

• Why we keep it: we store the audio of your recordings so you can play them back next to your transcript and notes.
• How long: it depends on your plan — 30 days on Free, 1 year on Starter, and for as long as your account is active on Scholar, Pro and Max. When the period ends we delete only the audio; your transcript and everything made from it stay. We email you 7 days before audio is removed, and moving to a smaller plan never removes audio sooner than 30 days after the change.
• Your control: you can turn off “Keep audio for replay” at any time (Settings → Data & Privacy, or the recording settings) and new recordings will keep the transcript only. You can delete all kept audio at any time from the same place, or delete a single recording.
• Account deletion: all stored audio is deleted when you delete your account.
• Never used for training: kept audio is used only to let you replay it and to produce your transcripts and study materials. We never use it to train AI models.

4. Your Rights & Choices

4.1 GDPR rights (EU users)

• Access: request a copy of your personal data
• Rectification: correct inaccurate information
• Erasure: request deletion of your data ("Right to be Forgotten")
• Portability: export your data in machine readable format
• Restriction: limit how we process your data
• Objection: object to certain types of processing
• Withdraw consent: revoke consent at any time

4.2 CCPA / CPRA rights (California users)

• Know: what personal information we collect, the sources, the purposes, the categories we disclose or share, and to whom — see the table below
• Delete: request deletion of your personal information
• Correct: have inaccurate personal information corrected (Cal. Civ. Code § 1798.106). Most fields are editable in your account settings; anything else, email us
• Opt out of sale or sharing: we do not sell personal information for money, but the advertising pixels described in our Cookie Policy do constitute sharing for cross context behavioural advertising. See 4.5
• Limit the use of sensitive personal information (§ 1798.121): your voice recordings and the voice characteristics extracted from them are biometric information and therefore sensitive personal information. We already limit them to producing your transcripts and the study materials you generate from them — we never use them to infer characteristics about you, and never for advertising — so no further limitation is available to request. You can stop the processing entirely by not using the recording features, and delete what exists via Section 3c
• Nondiscrimination: equal service and pricing regardless of the privacy choices you make. We run no financial incentive programme tied to your data

Categories we collect, disclose, and share

We have not sold personal information in the preceding 12 months. We have shared internet-activity and identifier data for cross context behavioural advertising, but only for visitors who accepted the advertising category. We do not knowingly sell or share the personal information of anyone under 16.

4.3 Student rights we voluntarily honor

Although Backrow is not a FERPA covered entity (see Introduction), we voluntarily provide the following practical equivalents for educational content you upload or generate:

• Reasonable requests to inspect and review the educational content you have stored with us
• Correction of inaccurate account information
• Deletion of educational content on request

4.4 Automated decision making (GDPR Article 22)

You have the right to request human review of any automated decision that produces legal or similarly significant effects on you. See Section 9 for the categories of automated processing we perform.

4.5 California: Do Not Sell or Share My Personal Information

Backrow does not sell personal information for money. We do share personal information for cross context behavioural advertising within the meaning of CPRA § 1798.140(ah): when you allow the advertising category, the Meta Pixel reports your visit and key actions to Meta so we can retarget you with Backrow ads. Product analytics (PostHog, Google Analytics) may also qualify. Nothing in either category runs unless you opt in.

There are three ways to opt out, and all three work without creating an account:

• Visit backrow.ai/data-privacy and use the Do Not Sell or Share control. This page is reachable while signed out
• Use the Cookie Settings button at the top of our Cookie Policy and switch off Advertising (and Analytics, if you want). The same button appears on the Data Privacy page
• Send the Global Privacy Control signal (Sec-GPC: 1) or Do Not Track (DNT: 1) from your browser. We detect both and treat them as a standing opt-out that overrides any stored consent — you do not need to do anything else, and you do not need to repeat it per device beyond enabling it in that browser

We do not require you to create an account, verify your identity, or take more than one step to opt out (§ 1798.135). An authorised agent may submit a request on your behalf by emailing privacy@backrow.ai with written permission signed by you.

4a. UAE Personal Data Protection Law

Backrow is established in the United Arab Emirates, so UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations apply to our processing, alongside any other law that applies to you where you live.

Under the PDPL you have the right to:

• Request information about how your personal data is processed, and obtain a copy of it
• Request that inaccurate personal data be corrected
• Request erasure of your personal data, subject to the retention exceptions in Section 5
• Restrict or object to processing in the circumstances the PDPL provides for
• Request your data in a structured, machine readable format and have it transferred
• Object to automated processing that produces legal consequences for you (see Section 9)
• Withdraw consent at any time, where our processing relies on your consent

You can exercise all of these the same way as the rights in Section 4 — by emailing privacy@backrow.ai or using the Export data and Delete account controls on your Data Privacy page. We respond within 30 days.

If you believe we have not handled your personal data lawfully, you may complain to the UAE Data Office. This does not affect any right you have to complain to a data protection authority in your own country.

5. Data Security & Retention

Security measures

• Encryption in transit (TLS) and at rest, applied by our hosting and storage providers
• Row level security (RLS) on user data tables in our database
• Limited, role scoped administrative access for Backrow personnel
• Automated daily backups managed by our hosting provider
• Sign in via established identity providers (Supabase Auth, Google, Microsoft) so that additional protections those providers offer (such as their own two factor and anomaly detection) apply to your sign in

We have not yet completed a formal third party security audit or penetration test. We intend to do so as the platform grows and will update this section when that work is complete.

Data retention

• Account data (profile, settings, email): kept while your account is active; deleted within 30 days of account closure.
• Educational content (notes, transcripts, generated study materials, uploaded course materials): kept until you delete it or close your account, then removed within 30 days.
• Voice recordings and biometric features: see Section 3c. Recording audio kept for replay is deleted at the end of your plan’s replay period (30 days Free, 1 year Starter, while your account is active on Scholar and up), on request, on account closure, or after 3 years of account inactivity, whichever is sooner.
• AI prompts and outputs: stored alongside the conversation or note they belong to; removed when you delete the conversation or note.
• Writing samples you provide for our writing voice tools: stored under your account; removed when you delete the sample or close your account.
• Payment data: Stripe holds card information directly. Backrow stores only the subscription state and the last four digits of the card. Retained for the period required by tax and accounting law (typically 7 years).
• Log data (access logs, error logs, request metadata): typically 30 to 90 days.
• Backups: our hosting provider takes an automated daily backup of the database and retains the last 7 days. We do not currently run point in time recovery. Deleted content is purged from backups as those daily snapshots age out, so it can persist in a backup for up to 7 days after you delete it.
• Legal holds: data subject to a lawful preservation request will be retained for the duration required.
• Records we anonymise instead of deleting: when you close your account we erase your content outright, but a small set of records is kept with your identity stripped out (the link to you is severed, so the row can no longer be traced back to you). These are: sign in history and security alerts, data access and audit logs, our record that you gave or withdrew consent, our record that we carried out your deletion request, and payment, promotion, and affiliate entries we are required to keep for tax and anti fraud purposes. We keep these because we are legally required to, or to defend legal claims — not to build a profile of you.

Breach notification

If we confirm a personal data breach affecting your information, we will notify the affected users and applicable regulators within 72 hours, where required by law. Notifications will describe the categories of data affected, the likely consequences, and the steps we are taking in response.

6. Children's & Minors' Privacy

Backrow is available from age 13. We ask for your date of birth when you create an account and we use it to decide what we are allowed to do with your data.

6.1 Under 13

Accounts are not permitted. We do not knowingly collect personal information from children under 13, and we do not offer a parental consent route that would allow it. If we learn that an account belongs to a child under 13 we delete the account and its content promptly, without waiting for a request.

6.2 Between 13 and 18

You may create an account and use the whole Service, including audio recording, without a parent or guardian needing to do anything. We do not ask for a guardian's email address and we do not send one a consent request.

You should know what that includes: transcription analyses the characteristics of your voice, and those characteristics can be biometric data (GDPR Art. 9; Illinois BIPA, Texas CUBI and Washington HB 1071 all treat voiceprints as biometric identifiers). By recording, you are consenting to that yourself.

Two things stay off for accounts under 18, and you cannot switch them on:

• Analytics and session replay
• Marketing email — the account is excluded from marketing audiences entirely

If you are under 18 and a parent or guardian wants your account closed and its content deleted, they can write to privacy@backrow.ai and we will do it, including any recordings.

6.3 Where local law sets a higher age

Article 8 GDPR lets each EU member state set the digital age of consent anywhere between 13 and 16, and several set it at 16. Below that age a child cannot give their own consent for information society services. If you are under your country's digital age of consent and you have used consent based features, a parent or guardian may object, and you or they can write to privacy@backrow.ai to have the processing stopped and the data deleted.

6.4 Schools

Backrow is sold to individuals, not to schools, and no school administers these accounts. If a school wants to deploy Backrow to students it must contact us first, because school-administered use raises obligations (including FERPA and state student privacy laws) that our consumer terms do not cover.

7. International Data Transfers

Where we are. The controller, Elesaad Industries LLC, is established in the United Arab Emirates. The European Commission has not issued an adequacy decision for the UAE. So if you are in the EEA, the UK, or Switzerland, using Backrow necessarily involves your personal data being accessible to us in the UAE — for example when our team answers a support ticket, investigates a bug you reported, or acts on a deletion request. We name this explicitly because GDPR Art. 13(1)(f) requires us to identify the third country and the safeguard relied on, and a policy that mentions only its vendors' transfers does not do that.

The basis for that transfer. We rely on Art. 49(1)(b) GDPR — the transfer is necessary for the performance of the contract between you and us. Backrow is a direct to consumer service operated from the UAE; there is no way to deliver the account you signed up for without our own team being able to reach the data. This derogation applies to the transfers that are genuinely necessary for that purpose. Where you have given explicit consent for a specific optional feature after being informed of the risk, Art. 49(1)(a) also applies.

What that means for you, plainly. UAE law does not give you the same enforcement route an EU court would, and we are not going to pretend otherwise. What you keep regardless: every right in Section 4 (access, correction, deletion, portability, objection, withdrawal of consent), the ability to complain to your own supervisory authority under Section 11, and our commitment to answer data subject requests within 30 days from the UAE exactly as we would from anywhere else.

Our subprocessors' transfers are a separate question, and they are covered contractually rather than by derogation. The providers listed in Section 3 and on our Subprocessors page operate under their own published data processing agreements incorporating the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum. By using each provider through their standard terms, Backrow inherits these safeguards rather than negotiating bespoke contracts. Your data is stored primarily in our database provider's Asia-Pacific (Singapore) region, and AI, transcription, and rendering providers process it in the United States and the EU. To request a copy of the transfer safeguards a given provider relies on, email privacy@backrow.ai and we will point you to it.

We aim to handle your personal data in a manner consistent with the GDPR, UK GDPR, Swiss FADP, Brazilian LGPD, Quebec Law 25, and India DPDP 2023 where they apply to you. We do not represent that we have completed formal certification or registration under each of these regimes; if a specific requirement applies to you and is not addressed here, please contact us at privacy@backrow.ai.

8. Cookies & Tracking Technologies

We use cookies and similar tracking technologies. See our Cookie Policy for details.

Types of cookies we use

• Essential: required for the service to function — sign-in session, security, the consent record itself, and work you authored on your device. Cannot be switched off
• Functional: remembers your preferences and settings (theme, language, accessibility). Optional, with its own switch
• Analytics: helps us understand how you use the platform, and records which campaign link first brought you here. Optional
• Performance: monitors performance and captures crash diagnostics. Optional
• Advertising: the Meta Pixel (and TikTok Pixel once active) for cross context behavioural advertising. Optional, never bundled with analytics, and the subject of the "Do Not Sell or Share" right in Section 4.5

All four optional categories default to off. Each has a real switch that takes effect immediately and deletes what it had already stored. Your answer is honoured for 12 months, after which we stop relying on it and ask again. A Global Privacy Control or Do Not Track signal from your browser overrides stored consent and keeps analytics, performance, and advertising off.

Device fingerprinting. Separately from cookies, we compute a device identifier from signals your browser exposes, used solely to detect duplicate accounts created to farm free credits (see Section 1.3 and the Cookie Policy). Legal basis: legitimate interests.

9. Automated Decision Making & AI Processing

Backrow uses automated processing (including AI models) in several places:

• Content generation: drafting essays, summaries, study materials, and answers from your prompts and source content.
• Content classification: tagging support messages and inbound DMs to route them to the right team.
• Study recommendations: suggesting study blocks, flashcard reviews, and personalised content based on your activity.
• Credit and subscription decisions: calculating credit usage, balances, and renewal dates.
• Abuse and fraud detection: identifying patterns that suggest abuse of the Service.

None of these processes produce final, fully automated decisions about you that have legal or similarly significant effects. Decisions that materially affect your account (account suspension, refund disputes, complaint resolution) are reviewed by a human before being applied.

If you receive an automated decision that affects you and you would like human review, email privacy@backrow.ai. We will respond within 30 days.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new policy on this page
• Updating the "last updated" date
• Sending you an email (for significant changes)
• Displaying an in app notification

Your continued use after changes constitutes acceptance of the updated policy.

11. Contact Us

Questions about this Privacy Policy or your rights? Reach out:

• Privacy & data protection requests: privacy@backrow.ai
• Support: support@backrow.ai

Backrow has not formally designated a Data Protection Officer; privacy and data protection requests are handled by the team via the address above.

This Privacy Policy is effective as of October 6, 2026 and applies to all users of Backrow.