Privacy notice

Last updated: 10 October 2026

Who is responsible

The controller of the personal data described here is Passback, operated by a sole trader (trabalhador independente) with NIF and VAT number PT311924093. Passback is the service offered at passback.dev.

For questions or requests about personal data write to legal@passback.dev. For everything else write to support@passback.dev. We have not appointed a data protection officer because the law does not require one for us.

What this notice covers

This notice covers the data of people who visit passback.dev, create a Passback account, pay for it, or write to us.

It does not cover the feedback data your customers or testers send through the Passback widget on your site. For that data you are the controller and we are your processor; the terms for it are in the data processing agreement at https://passback.dev/legal/dpa/.

The data we use and why

Account data: your email address, your name and the identifier of your sign-in. We use it to create and run your account, to sign you in and to contact you about the service. Legal basis: the contract with you (GDPR Article 6(1)(b)).
Sign-in data: if you sign in with Google or GitHub we receive from that provider your name, email address and account identifier, and nothing else. Legal basis: the contract with you.
Site settings: the names and allowed addresses of your sites, the plan of each site and the connection to your issue tracker, including the access token you give us for it. We use it to deliver the comments your site collects. Legal basis: the contract with you.
Billing data: your plan, billing country, VAT number if you give one, invoices and payment status. Your card number goes only to Stripe and never reaches us. Legal basis: the contract with you and, for invoices, our legal duty to keep accounting records (Article 6(1)(c)).
Messages: what you write to us by email, and our replies. Legal basis: our legitimate interest in answering you (Article 6(1)(f)), or the contract with you if you are a customer.
Technical data: when you use the website, the dashboard or the API our servers log the time, the address requested, the IP address, the browser name and the result. We use it to keep the service running, to find faults and to block abuse. Legal basis: our legitimate interest in the security and reliability of the service (Article 6(1)(f)).
Usage data: on the website and in the dashboard we count page views and a few actions, namely a click on the install or sign-up button, a sign-in and the creation of a site. We use PostHog for this, in its EU cloud. It sets no cookie and stores nothing on your device, it uses a random identifier that lasts only until you leave or reload the page so we cannot recognise you again, and it sends nothing if your browser asks not to be tracked. We do not measure the widget or your customers' sites. Legal basis: our legitimate interest in knowing how the service is used and in improving it (Article 6(1)(f)).

Feedback data we handle for our customers

When a site that uses Passback sends a comment, we receive what the reporter wrote, the address of the page, the element they pointed at, its place in the code, basic browser information and, on plans with screenshots, a picture of the visible screen with private fields blacked out. We pass it to the issue tracker the site owner chose. We do not use it for our own purposes, we do not sell it and we do not send it to an artificial intelligence provider. The site owner is the controller of this data; to exercise your rights over it, contact the site owner.

Who receives your data

We use a small number of providers to run the service. They act on our instructions and are bound by data processing agreements. The current list, with the data each one handles and where, is at https://passback.dev/legal/subprocessors/.

We also pass data where the law requires it, for example to tax authorities.

We do not sell personal data and we do not use it for advertising.

Transfers outside the EU

Our own servers and our file storage are in the European Union. Some providers are companies based in the United States. Where data goes to them we rely on the European Commission's standard contractual clauses or on the provider's certification under the EU-US Data Privacy Framework, as listed on the subprocessors page. You can ask for a copy of the safeguards at legal@passback.dev.

How long we keep data

Account data and site settings: for as long as your account exists, and deleted within 30 days after you close it.
Screenshots: 90 days after they are taken. When you delete a site, we delete its screenshots at once; a screenshot already attached to an item in your tracker stays there, under your control.
Comments waiting for delivery: until they are delivered to your tracker, and removed when you delete the site. Comments already in your tracker stay there, under your control.
Invoices and accounting records: 10 years, as Portuguese law requires.
Server logs: up to 30 days.
Email correspondence: up to 3 years after the last message.

Your rights

You have the right to access your data, to have it corrected, to have it erased, to restrict its use, to receive it in a portable format, and to object to uses based on our legitimate interest. Where we use your data because you agreed, you can withdraw that agreement at any time; this does not affect what we did before.

Write to legal@passback.dev. We answer within one month. We may ask you to confirm who you are.

You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at https://www.cnpd.pt, or to the authority of the EU country where you live or work.

Cookies

The website and the dashboard use only the cookies and browser storage that are needed to sign you in and keep your session. Our analytics, described under usage data above, sets no cookie and stores nothing on your device. We do not use advertising cookies, so there is no cookie banner.

Security

Connections to Passback are encrypted. Backups are encrypted before they leave our server. Access to production systems is limited to the people who need it. The widget blacks out password fields and fields you mark as private before a screenshot is taken.

Changes to this notice

If we change this notice in a way that matters to you we will tell account holders by email before the change takes effect. The date at the top shows the latest version.