Backer Hub Privacy Policy

Last Updated: June 19, 2026

Thank you for choosing Backer Hub ("we," "us," or "our"), an AI-powered automated communication platform for real estate agents and businesses. When you use Backer Hub, you're trusting us with your information, and we take that responsibility seriously. This Privacy Policy explains what information we collect through our Site and Services and how we use, share, and protect it. It also covers the rights and choices you have over your personal information. Please review it carefully before using our Services, and contact us if you have any questions.

This Privacy Policy is referenced by our Terms of Service, which is also available on our Site, backerhub.ai. By accessing or using our Site or Services, you acknowledge that you have read and agree to it. If you do not agree to this Privacy Policy, please do not access the Site or otherwise use the Services.

Per our Terms of Service, the following definitions apply in this Privacy Policy:

Account(s): The account on the Service you register and open in order to access and use the Service.

AI Model(s): Any artificial intelligence or machine learning model, algorithm, or system, including large language models, neural networks, and generative AI systems, used by or incorporated into the Services, whether developed by Backer Hub or licensed from Third-Party Services including but not limited to OpenAI, Anthropic, Google, and others.

Customer: You, and any company or other entity on whose behalf you use the Services, together referred to as "you" or "Customer."

Sensitive Personal Data: (i) patient, medical, or other protected health information, including those regulated by the Health Insurance Portability and Accountability Act (as amended and supplemented) ("HIPAA"); (ii) credit, debit, bank account or other financial account numbers; (iii) social security numbers, driver's license numbers, or other government ID numbers; and (iv) special categories of personal data enumerated in the European Union General Data Protection Regulation ("GDPR").

Service(s): Backer Hub's proprietary AI-driven automation platform, products, and applications of AI solutions and integrations into business workflows, offered on a SaaS basis, with the support and inclusion of AI Models, autonomous AI agents (including automated response agents, intake and classification agents, workflow automation agents, document processing agents, and integration agents), dashboards, integrations with Third-Party Services, APIs, automation workflows, AI-generated content, tools, analytics, and all related software, services, updates, upgrades, modified versions, extensions, improvements, and derivative works of the foregoing technologies (collectively, the "Service" or "Services").

Site: Backer Hub's website at backerhub.ai, including all subdomains and related digital properties operated by Backer Hub.

Third-Party Service(s): Any web-based, mobile, or other third-party service, connection, site, platform, application, software, or integration created, hosted, or operated by third parties that Customer makes available to Backer Hub that interacts with, automates actions on, extracts data from, or interoperates with the Services.

1. Data and Personal Information We Collect

When you use Backer Hub, we collect the following kinds of information:

Account Information. We collect the registration and Account details you provide when you create, administer, or maintain your Account or use the Services, so we can set up and run your Account for you. This includes your name, profile picture, username, password, email address, subscription status (including any free trial), and billing information. Some of these details may come from a third-party provider if you create your Account by signing in through one.
Customer Content. Any documents, content, data, or materials you upload, submit, or make available to Backer Hub through the Site or Services, which we need in order to provide the Services to you. This content reaches us primarily through the Third-Party Services you connect, specifically Google's Gmail API and Follow Up Boss' API. Your raw content is not retained by us. It flows through only to provide the Services.
Google Data. With your authorization, we access your Gmail to provide the Services. We collect your Google profile information, including your name and profile picture. From your Gmail messages we keep the headers and metadata, but not the message contents. Your original Gmail messages only flow through our systems to provide the Services and are not retained. We request only Gmail's read and compose permissions, which let us read your messages and create and send replies. These are Google's restricted scopes and the minimum we need to run the Services; we do not request the broader full-access permission. We also store a hashed version of your Gmail address, used only to keep your Account connected and running, not for any tracking; we do not store your actual address. Our access, use, storage, and sharing of Google Data follow Google's Limited Use requirements. Backer Hub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Follow Up Boss Data. We connect with your Follow Up Boss account. As your CRM, it holds the deal and business-operation data our Services depend on, and through it we receive the records you keep there.
[STRIPE PLACEHOLDER] if Stripe handles your billing and you don't store full card numbers, that's worth stating in your Security or sub-processor section.
Derived Data. We generate and collect structured metadata, logs, and other information from your Customer Content and from how you use the Services, including data we extract from or create in connection with the Third-Party Services you connect, such as Gmail and Follow Up Boss. This Derived Data powers and personalizes your features, so your assistant understands your contacts, deals, and history and can draft more accurate replies. We use it only to personalize your own experience; it stays specific to your Account and is never combined with other users' data. We protect it with strong, industry-standard encryption.
Derived Outputs. This is our AI Model's work product, derived from your Customer Content and produced as replies. We collect them only to improve your experience and the accuracy of your responses. Your generated replies stay encrypted at rest and locked to your Account, protected by strict access controls.
Feedback and Support. When you send us Feedback or reach out for help through our Help Center, we collect what you share, including your comments, ideas, proposals, recommendations, suggestions, and enhancement requests, or any other information you give us to improve our features, functionality, or operation, along with the context around it, whether it concerns the Site, the Services, a beta release, or any other Backer Hub product or service. We use feedback to improve the Services, and your support messages to assist you and resolve your support requests. We store this in our database, tied to your Account and protected with the same safeguards we apply to your other data.
Authentication and Security Data. When you set up multi-factor authentication or mark a device as trusted, we collect what we need to secure your Account and recognize that device. This includes the authentication methods you enroll and, for each trusted device, a device identifier, the dates it was added, last used, and set to expire, and a simple label like "Mac · Chrome" that we generate from your browser so you can recognize it. We use this to protect your Account, run multi-factor authentication, let you skip it on devices you trust for ninety days, and power the security dashboard where you can review and remove your devices. For recognizing your trusted devices, we don't store your IP address, raw browser details, or any device fingerprint. This data is held with our authentication provider and tied to your Account.
Technical and Log Data. When you use the Site and Services, our systems and the infrastructure providers we rely on automatically generate technical and log data, such as log records, connection details like your IP address, and error reports, which we use to keep the Services running, diagnose and fix problems, and protect against security threats.
Cookies. We use a small number of cookies that are strictly necessary to operate and secure the Site. These keep you signed in, recognize devices you've marked as trusted so you can skip multi-factor authentication, and carry your setup and consent choices through Account creation. Because they're essential to how the Site works, disabling them may break parts of it. We don't use cookies for advertising, analytics, or cross-site tracking, and no third party uses cookies to track you through our Site.
Information about non-users. Your Customer Content may include information about people who don't use Backer Hub, such as the leads, clients, and others who appear in the emails, deals, and other records you bring into Backer Hub. We receive this information through your Customer Content and handle it on your behalf, only to provide the Services to you. We don't use it to advertise or market to those individuals, and we don't sell it.

2. How We Use Your Data and Personal Information

We use the information we collect strictly to operate our Site and Services, including to provide or improve the user-facing features that are visible and prominent within Backer Hub. Specifically, we use it to:

Provide and operate the Services. Read and analyze the emails you authorize us to access, automatically generate replies, check those replies for safety, and send them on your behalf. Each reply we send tells the recipient it was generated by AI and lets them flag it, so you can step in to review it or respond as a human. We also use the deal and contact information from the CRM you connect to give your replies the right context, and to run your dashboard.
Personalize your experience. Learn from your own contacts, deals, and past messages so your assistant understands your business and can draft more precise replies for you. You choose whether to enable this, and can turn it on or off anytime in your Account settings. This personalization is specific to your Account and is never combined with other users' data.
Keep your Account secure. Run multi-factor authentication, recognize the devices you trust, power your security dashboard, and detect and prevent fraud, abuse, and unauthorized access.
Maintain and protect the Services. Use technical and log data to operate and maintain the Site and Services, diagnose and fix problems and outages, and protect our systems against security threats.
Improve the Services. We're continually developing new ways to make Backer Hub smarter, faster, and more helpful, and imagining new products and features worth building.
Support you and communicate with you. Respond to your questions and support requests, and send you Account, security, and service messages, such as verification codes and important notices about the Services.
Measure how the Services are working for you. Show you metrics like how many emails were handled and the time you've saved. These are calculated on demand from data already in your Account, not collected or stored as a separate record of your activity.
Meet our legal and business obligations. Comply with applicable law, enforce our Terms of Service, and process payments for your subscription. [STRIPE PLACEHOLDER — verify before publish]

3. How We Share and Disclose Your Data and Personal Information

We disclose the information described above in the following circumstances:

Service providers and sub-processors. We share information with the companies that help us run the Services, including providers for hosting, data storage, authentication, email delivery, and real-time infrastructure, and the AI providers that generate and safety-check your replies. They may use your information only to do their work for us, under contracts that require them to protect it, and our AI providers don't use your content to train their own models. You can find the current list at Backer Hub's Subprocessors List. [STRIPE PLACEHOLDER — add payments processor once live]
The Third-Party Services you connect. When you connect a Third-Party Service like Gmail or Follow Up Boss, we send and receive data through it to do what you've asked, such as sending replies on your behalf through your email. The Third-Party Services that you use are governed by their own privacy policies and terms.
Legal, regulatory, and safety reasons. We may disclose information when we believe in good faith it's necessary to comply with the law, legal process, or an enforceable government request; to enforce our Terms of Service; or to protect the rights, property, or safety of Backer Hub, our users, or others, including to detect, prevent, or address fraud, abuse, or security threats.
Business transfers. If Backer Hub is involved in a merger, acquisition, financing, or sale of assets, your information may be part of that transaction. Any successor will stay bound by this Privacy Policy, and we'll honor the choices you've already made. If the transaction would involve transferring your Google Data, we'll ask for your consent first.

4. AI and Automated Processing

Because your Customer Content runs through AI and is handled automatically, we want to be clear about how it works and how you stay in control.

How your replies are generated. When a new email comes in, our AI reads the conversation, pulls in the relevant context from your CRM, like who the contact is, the deal they're tied to, and where things stand, and uses it to write a reply. Your email and that CRM information are handled by the AI providers that power Backer Hub, only to create your reply and provide the features.
Personalization. Your assistant learns from your own profile, contacts, deals, and past messages so it can tailor replies to your business. This personalization is specific to your Account and is never combined with other users' data. You can turn it on or off at any time in your Account settings.
Every reply is safety-checked before it's sent. Before any reply goes out, an automated safety review examines it. Based on that review, the reply is sent, held for you to review before sending, or withheld and reported to us for a closer look. If the safety review can't be completed, the reply is not sent. A reply is only ever sent after it passes this check.
Automatic sending, and staying in control. Once you connect your Gmail and your CRM, replies are generated and sent automatically, that automation is the core of the Service. Every reply we send tells the recipient it was generated by Backer Hub AI and gives them a link to flag it for a human. You can review any reply our safety system or a recipient flags, step in and respond yourself, turn off personalization, disconnect Gmail or your CRM at any time to stop processing, or delete your Account. Because the AI works automatically from the information available to it, it can make mistakes, and these controls are how you stay in the loop. You remain responsible for the replies sent from your Account, as set out in our Terms of Service.
Protecting against manipulation. Incoming emails can hide instructions that try to manipulate an AI assistant. We treat all incoming email content as untrusted, clean and contain it before our AI uses it, and structure the safety review so that instructions buried in an email can't cause an unsafe reply to be sent. We describe these safeguards further in the Security section.
No profiling or decisions about people. Our AI reads your emails and drafts and sends replies. It does not score, rank, rate, or profile you or the people you correspond with, and it does not make automated decisions that produce legal or similarly significant effects about anyone.

5. Google User Data and Limited Use

Backer Hub's access to your Google Data is governed by the Google API Services User Data Policy, including its Limited Use requirements. This means:

We use your Google Data only to provide and improve the user-facing features that are visible and prominent within Backer Hub.
We don't sell your Google Data, and we never use it for advertising.
We don't transfer your Google Data to others, except as needed to provide the Services, to comply with applicable law, or in connection with a merger or acquisition where we have your consent.
We don't let humans read your Google Data, except where you've given consent or where it's necessary for security or to comply with the law.

Backer Hub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Retention and Deletion of your Data

We keep your personal information only for as long as we need it to provide the Services to you, which generally means while your Account is active. The original content of your emails is never stored; it passes through our systems to generate your replies and isn't retained.

You can delete your Account at any time from your Account settings. When you do, we delete the personal information and data we hold on your behalf. A few things outlast that deletion: a hashed record of your acceptance of our Terms of Service, which we keep for legal recordkeeping; secure, isolated backups that aren't used for anything else and age out over time; and any information we need to keep to comply with the law, resolve disputes, or enforce our Terms of Service.

7. Your Rights and Choices

The personalization feature that learns from your own contacts, deals, and past messages and tailors your assistant to your own business operations can be turned off anytime in your Account settings. Within your security dashboard, we also offer you controls to review or remove trusted devices and manage your other multi-factor authentication settings. You also have the right and full control to disconnect Gmail or your CRM to stop us from processing data from that service, or to delete your Account and remove the personal information we hold on your behalf. Depending on where you live, you may have additional rights under privacy laws to access, correct, or delete your personal information, as well as other rights, as outlined in the next section.

8. US State Privacy Laws

A number of US states have enacted privacy laws that give their residents certain rights over their personal information and require specific disclosures (we refer to these as "State Privacy Laws"). If you reside in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, or in another state governed by a State Privacy Law, then subject to that law and any applicable exceptions, you have the right to confirm whether we are processing your personal information and to access it; to correct inaccurate personal information; to delete your personal information; and to obtain a copy of it in a portable and readily usable format, to the extent technically feasible.

Several State Privacy Laws also grant the right to opt out of the sale of personal information, targeted advertising, and certain profiling. None of these apply to how we operate: we do not sell your personal information, we do not share it for targeted advertising, and we do not use it to profile you in ways that produce legal or similarly significant effects. For the same reason, opt-out preference signals such as Global Privacy Control have nothing to act on.

To exercise any of these rights, contact us at [privacy@backerhub.ai]. We will respond within the period your state's law allows, generally within 45 days. We may ask you to verify your identity before we act on your request, and you may use an authorized agent to submit a request on your behalf. If we decline a request, you have the right to appeal, and you will never be denied service, charged a different price, or given a lesser level of service for exercising any of these rights.

Certain information we process, including the contents of your Gmail messages, may be treated as Sensitive Personal Data under some State Privacy Laws. Regardless of which laws apply to you, we use it only for the purposes the law permits and to provide the Services to you, we do not use it to infer characteristics about you, and we do not sell it.

Finally, some of the information within Backer Hub relates to people who are not our users, the leads, clients, and others who appear in the emails and records you bring into the Services. We process that information on behalf of the Customer who provided it: that Customer controls the information and is responsible for having the right to share it with us and to contact those individuals, including obtaining any consent the law requires. If one of these individuals asks us to access, correct, or delete the information we hold about them, we will direct the request to the Customer who controls it, as they are the party able to act on it.

9. Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will work to delete it.

10. International Users

The Services are based in the United States, and we store and process your information here. If you access the Services from outside the United States, you consent to your information being transferred to and processed in the United States. The Services are intended only for US users. We do not offer them to, or target or market them to, individuals in the European Union or the United Kingdom.

11. Security

We work to keep the Services and your information secure, but no security is absolute, and you use the Services at your own risk. To protect your information, we maintain administrative, technical, and organizational safeguards built on a few core principles: we grant access on a least-privilege basis, encrypt your data in transit using TLS, and encrypt sensitive credentials, such as the tokens for the accounts you connect, at rest using AES-256. Access is limited to the personnel and service providers who need it, and they are bound by confidentiality and the same obligations described in this Privacy Policy. [PLACEHOLDER — at-rest encryption of Derived Data and Derived Outputs in MongoDB; pending build design + compliance review.]

To help keep your Account secure, we offer multi-factor authentication, recognize the devices you trust, and give you a security dashboard to manage both. Our authentication provider also applies protections against suspicious sign-ins and repeated failed login attempts. [PLACEHOLDER — general monitoring / fraud detection + rate limiting; build to-do.]

Because the Services read and act on email sent to you by others, we defend against prompt injection, attempts to hijack the assistant with hidden instructions buried in a message, by first passing incoming email through a sanitization layer that strips hidden and malicious content, and by treating that content as untrusted data, never as commands. Every reply we generate passes through a multi-layer safety review before it can be sent, including an independent end-gate model that evaluates the drafted reply without ever reading your raw email and can hold a reply back for your review rather than send it. We keep a record of these security events to monitor for abuse and strengthen our defenses.

To meet Google's requirements for the sensitive scopes we use, we undergo regular third-party security assessment (CASA). [PLACEHOLDER — network protection / firewall.]

Still, no method of transmission or storage is ever completely secure. We are not responsible for the circumvention of any security measures, and the Third-Party Services you connect are governed by their own security and privacy practices. A breach of one of those services is outside our control and remains their responsibility, not ours. If you believe your Account is no longer secure, please contact us immediately. If a breach affecting your personal information occurs, we will notify you and any regulators as required by applicable law.

12. Changes

We may update this Privacy Policy from time to time. When we do, we will post the revised version here and update the "Last Updated" date at the top. At our discretion we may provide additional notice to you, such as posting a notice on our Site or directly contacting you.

If we add a feature that requires access to additional Google Data, or use your Google Data for a purpose this Privacy Policy does not already describe, we will update this Privacy Policy and obtain your consent first.

Your continued use of the Services after any changes become effective means you accept the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, email us at privacy@backerhub.ai.