Privacy Policy

This Privacy Policy explains how Untitled Spreadsheet Pty Ltd (ACN 671 105 258), trading as Backbone (Backbone, we, us or our), collects, uses, stores and discloses personal information when you visit our website, use the Backbone platform and services, or connect a third-party service such as Gmail.

1. Information we collect

We may collect:

• account and contact information, such as your name, email address, business details and information you submit through forms
• customer, supplier, job, quoting, scheduling, invoice, payment and other business records that you or your authorised users enter, upload or generate through Backbone
• communications data, including emails, email attachments, call details, call recordings, voicemail transcripts and SMS messages, where you choose to connect or use those features
• technical and usage information, such as device, browser, log, diagnostic and service-interaction data
• website analytics data, including anonymous visitor and session identifiers used to understand traffic, engagement and performance

2. How we use information

We use personal information to:

• provide, operate, secure and support Backbone
• perform the actions you request, including processing communications, creating or updating business records, and assisting with jobs, quotes, invoices and scheduling
• respond to enquiries and communicate with you
• detect, investigate and prevent fraud, misuse, security incidents and technical problems
• monitor, maintain and improve the performance and reliability of our services
• comply with legal obligations and enforce our agreements

We do not sell personal information.

3. Gmail access and use

Connecting Gmail is optional and requires your express authorisation through Google’s OAuth consent flow.

When you connect Gmail, Backbone uses Gmail read and send access. We may access more than message headers: we read the full body of relevant emails and download relevant email attachments, including PDFs such as supplier invoices and work orders. We use this data to provide the email, inbox, document-reading, bill-processing and workflow features you request—for example, allowing Backbone to read a supplier invoice, extract relevant information and create or suggest a record in Backbone.

Backbone may also compose and send emails from your connected Gmail account when you or an authorised user instructs Backbone to do so, or when you enable a workflow that clearly authorises an email to be sent. This includes sending new messages and replies for customer, supplier, job and other business communications. Backbone does not use its Gmail access to label, move, alter or delete existing messages in your mailbox.

We do not use Gmail data for advertising, marketing profiles, or sale to third parties.

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Disconnecting Gmail and deleting Gmail data

You can disconnect Gmail at any time through Backbone’s connection settings. Disconnecting revokes Backbone’s ongoing access, stops further retrieval of Gmail data and prevents Backbone from sending further emails through the connected account.

You can also delete the Gmail data that Backbone has imported or generated from your connected mailbox. You may do this using the available account deletion or data deletion controls, or by contacting us through your Backbone account. On a valid deletion request, we delete the connected Gmail account data held for your account, including imported email bodies, downloaded attachments and derived records, except where we must retain limited information to comply with law, resolve disputes, prevent fraud or enforce agreements. Residual encrypted backup copies are removed in accordance with our backup-retention cycle and are not used for other purposes.

Deleting data from Backbone does not delete the original emails or attachments from Gmail.

4. Calls, voicemail, SMS and other communications

When you or your organisation uses Backbone’s communications features, we may collect, process and store:

• recordings of inbound and outbound telephone calls
• call details such as phone numbers, participants, date, time, duration and call outcome
• voicemail audio and generated voicemail transcripts
• SMS and MMS conversations, including message content and attachments
• emails, including sender and recipient details, subject lines, full message bodies and downloaded attachments
• summaries, transcripts, extracted information and other records generated from these communications

We use this information to provide communication history, answer and route calls, take messages, transcribe voicemail, send and receive messages, link communications to customers and jobs, prepare summaries and action items, create or update business records, and enable Backbone features to perform requested workflows.

Calls may be recorded and transcribed automatically when the call-recording feature is enabled. A recording or message may contain personal information about employees, customers, suppliers and other people who communicate with your organisation. Your organisation is responsible for providing any notice and obtaining any consent required by applicable law before recording or processing communications through Backbone.

Authorised users within your organisation may be able to access these recordings, transcripts, messages, emails and related records according to their account permissions. You may request deletion of this communications data, subject to the retention exceptions described in this policy.

5. AI processing and sub-processors

To provide Backbone’s features, we use service providers that process information on our behalf. Email bodies, attachments, call recordings, voicemail audio and transcripts, SMS conversations and other communications may be stored or sent to these providers when necessary to deliver the features you request. In particular, when a document such as a supplier invoice is retrieved from Gmail:

• Vercel provides application hosting, AI Gateway routing and file storage. Documents and communications may pass through Vercel’s infrastructure, and PDFs, other attachments, audio files and related data may be stored using Vercel infrastructure.
• Anthropic provides the AI models used by Backbone to read, transcribe, summarise and extract information from email bodies, attachments, call and voicemail content, SMS conversations and other communications.
• InstantDB provides application database and synchronisation infrastructure used to store and process account, communications, workflow and related application data.

These providers handle data only to deliver services to Backbone and are subject to contractual and security obligations. They may process data in countries outside Australia, including the United States. Where required, we use appropriate safeguards for cross-border processing.

We may also use other service providers for communications, analytics, scheduling, payments, security, professional services and support. We require providers to process personal information only for the services they provide to us and in accordance with applicable law.

6. Disclosure of information

We may disclose personal information:

• to the service providers described above and other providers necessary to operate Backbone
• within your organisation and to authorised users, according to your account permissions
• to professional advisers, insurers, auditors and prospective transaction counterparties where reasonably necessary
• where required or authorised by law, regulation, court order or a government authority
• to protect the rights, safety, security or property of Backbone, our users or others

We do not allow third parties to use connected Gmail data for their own advertising or unrelated purposes.

7. Data retention

We retain personal information only for as long as reasonably necessary to provide the services, meet our contractual and legal obligations, resolve disputes and maintain appropriate business records. Retention depends on the nature of the information and why it is held.

When you disconnect an integration, close your account or request deletion, we delete or de-identify affected information—including imported emails and attachments, call recordings, voicemail audio and transcripts, SMS conversations and derived communications records—in accordance with the controls and exceptions described in this policy.

8. Security

We use reasonable technical and organisational safeguards designed to protect personal information against loss, misuse and unauthorised access, disclosure, alteration or destruction. These safeguards include access controls and protections for credentials and data in transit and at rest where appropriate.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your choices and rights

Depending on applicable law, you may have rights to access, correct, export or delete your personal information, restrict or object to certain processing, or make a complaint. You may also:

• disconnect third-party integrations, including Gmail
• request deletion of information imported from an integration, including email bodies and attachments
• request deletion of call recordings, voicemail audio and transcripts, SMS conversations and other communications data
• update account information and communication preferences
• unsubscribe from marketing communications

To exercise these rights, contact us through your Backbone account or the contact details on our website. We may need to verify your identity before completing a request.

10. Cookies and analytics

Our website and services may use cookies, local storage and similar technologies for authentication, preferences, security, analytics and performance. We do not use connected Gmail data for website analytics or advertising.

11. Third-party services

Backbone may link to or integrate with third-party services. Your use of those services may also be governed by the third party’s terms and privacy policy. This policy applies to Backbone’s handling of information and does not control a third party’s independent practices.

12. Children

Backbone is intended for businesses and is not directed to children. We do not knowingly collect personal information directly from children through account registration.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will publish the updated version and revise the “Last updated” date. Where required by law, we will provide additional notice of material changes.

14. Contact us

If you have questions, wish to exercise a privacy right, want to disconnect a service or request deletion of your data, contact us through your Backbone account or using the contact details published on the Backbone website.

You may also lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.