Privacy Policy

1. Information We Collect

We collect information in the following categories.

Account and organization information

When you create or use an account, we collect information such as your name, email address, organization name, role, authentication information, account settings, invitations, team membership, and support communications.

Integration metadata

When your organization connects source control, project management, communication, AI-tool, or other business systems, Backlight processes metadata from those systems to provide analytics and reporting. Depending on the integrations you enable, this may include:

• Repository identifiers, repository names, branches, commit identifiers, commit messages, author identity, timestamps, line-count and file-count statistics, pull request titles, states, labels, review activity, deployment metadata, and similar source-control metadata.
• Issue, ticket, project, status, priority, assignee, title, description, body, and workflow metadata from issue-tracking and project-management systems.
• AI-tool usage, seat, activity, model, request, interaction, acceptance, active-day, and billing or license utilization metrics from vendor administrative or usage APIs.
• Notification configuration and delivery metadata for integrations such as Slack or email.

Backlight is designed to measure engineering activity using metadata, not repository content. We do not clone repositories or store customer source code, diffs, file contents, patches, AI prompts, AI completions, or generated code. When connected provider APIs return code or patch content, our systems discard that content and persist only the metadata needed to provide the Service. We do not send source code, diffs, file contents, patches, AI prompts, AI completions, or generated code to AI providers.

Some customer-authored metadata fields, such as commit messages, pull request titles, issue titles, issue descriptions, issue bodies, labels, or review activity, may contain text entered by your users. You are responsible for ensuring that your users do not place source code, secrets, or regulated data in metadata fields that you authorize Backlight to ingest. Backlight applies minimization, sanitization, retention, and deletion controls to this metadata as described in this policy.

Billing information

If your organization starts a paid subscription or trial, we collect subscription, invoice, payment status, tax, billing address, billing contact, metering, and active-engineer count information. Payment card details are collected and processed by Stripe. We do not store full payment card numbers on our servers.

Product usage, device, and security information

We collect information about how users interact with Backlight, such as pages viewed, features used, session events, approximate location derived from IP address, browser and device information, log data, authentication events, security events, and audit events. We may also use analytics providers to understand product usage and improve the Service. When you are signed in, analytics events may include a pseudonymous identifier that helps us understand account-level usage without sending your name or email to the analytics provider.

Communications

If you contact us, subscribe to updates, respond to surveys, or interact with support, we collect the information you provide and metadata about those communications.

2. How We Use Information

We use information to:

• Provide, maintain, secure, and improve Backlight.
• Connect and operate integrations authorized by your organization.
• Generate engineering, productivity, AI utilization, license waste, quality, ROI, benchmark, and reporting analytics.
• Attribute engineering activity to users, teams, repositories, vendors, and time periods.
• Classify signals that may indicate AI-assisted work, subject to your organization's data-sharing settings.
• Process payments, calculate taxes, manage subscriptions, meter active engineers, and maintain billing records.
• Send transactional messages, alerts, digest emails, security notices, billing notices, and support communications.
• Detect, prevent, investigate, and respond to fraud, abuse, security incidents, service errors, and legal or policy violations.
• Comply with legal obligations and enforce our agreements.
• Create aggregated or de-identified analytics that do not identify a customer, organization, repository, user, or other individual.

3. AI Classification and External AI Processing

Backlight uses automated systems to help classify engineering activity and provide AI-related analytics. By default, when Backlight uses an external AI classification provider, it sends metadata only, such as issue titles, priority, status, line counts, timestamps, review counts, file counts, and derived author or activity categories. By default, no source code, diffs, file contents, patches, AI prompts, AI completions, generated code, commit messages, pull request titles, or issue descriptions are sent to external AI providers for classification.

Your organization may choose a different setting that disables external AI classification entirely or opts into sending additional sanitized text, such as scrubbed commit messages, pull request titles, or issue descriptions, to improve classification quality. Sensitive patterns are redacted and text is capped before transit. Organization owners can manage these settings in Backlight where available.

Backlight currently uses Anthropic as an AI classification provider for certain classification features.

4. How We Share Information

We share information only as needed to operate, secure, support, and improve the Service; as directed by your organization; or as required by law.

Customer-enabled integrations

When your organization connects a third-party service, Backlight exchanges information with that service as needed to authenticate, read authorized metadata, send notifications, or operate the integration. Those third-party services are governed by their own terms and privacy policies.

Service providers and subprocessors

We use service providers and subprocessors for hosting, infrastructure, payment processing, tax calculation, analytics, email delivery, support, security, logging, and AI classification. These providers may include, as applicable, Fly.io for hosting, Stripe for payment processing and tax calculation, Anthropic for AI classification, Google Analytics for product analytics, and email, support, security, and operational tooling providers.

Enterprise and custom-contract customers may request our then-current subprocessor register and Data Processing Addendum by contacting us. If your intended use requires a data processing agreement or other privacy terms not included in your plan, contact us so we can discuss the appropriate plan or written agreement.

Legal, safety, and business transfers

We may disclose information if we believe it is reasonably necessary to comply with law, enforce our agreements, protect rights or safety, investigate abuse or security issues, or complete a merger, acquisition, financing, reorganization, or sale of assets.

Aggregated or de-identified information

We may use and share aggregated, anonymized, or de-identified information for analytics, benchmarking, research, product improvement, industry reports, and business purposes, provided it does not identify a customer, organization, repository, user, or other individual and is not reasonably linkable to them. We maintain de-identified information in de-identified form and do not attempt to re-identify it except to test or validate de-identification controls.

5. Cookies and Similar Technologies

Backlight uses cookies and similar technologies to:

• Keep users signed in and secure accounts.
• Remember preferences.
• Measure website and product usage.
• Improve the Service and understand customer adoption.

Essential cookies are required for authentication, session management, security, and service operation. Analytics cookies and similar technologies help us understand usage patterns. You can manage cookies through your browser settings, but disabling certain cookies may prevent parts of the Service from working.

6. Data Retention

We retain information for as long as needed to provide the Service, meet legal and accounting obligations, resolve disputes, enforce agreements, maintain security, and preserve auditability.

Our current retention practices include:

• Processed webhook events: 7 days.
• Unprocessed webhook events: 30 days.
• Per-user AI metrics: approximately 548 days.
• Aggregate organization metrics that do not identify individuals: 5 years.
• Audit events: 2 years.
• Alert evaluations: 90 days.
• Data export archives: automatically expire after a limited period.

Deletion from the live Service may not immediately remove information from encrypted backups or point-in-time recovery snapshots. Backup copies are retained for a limited period, currently approximately 7 days, and then expire through normal backup rotation.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information processed by Backlight. These safeguards include TLS for data in transit, secure session handling, application-level encryption for integration tokens and vendor keys, access controls, audit logging, tenant isolation controls, parameter and log filtering, and operational monitoring.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and customers remain responsible for securing their own accounts, devices, identity providers, and connected systems.

8. Customer Controls, Export, and Deletion

Organization owners may request an export of organization data where the feature is available. Exports are generated in a machine-readable format, redact secrets and credentials, and expire after a limited period.

Organization owners may request deletion of an organization. Deletion is generally a two-phase process: Backlight first disables access, disconnects integrations, and revokes relevant credentials; after a grace period, Backlight permanently deletes organization-scoped records from the live Service, subject to legal, billing, security, audit, and backup-retention requirements.

Backlight's current self-service export and deletion flows operate at the organization level and are initiated by an authorized organization owner. Individual employees should generally direct requests about employer-controlled workspace data to their organization. We will assist the organization as required by applicable law. If you want to exercise rights regarding your own Backlight account information, website activity, or direct communications with Accent Labs, contact us using the information below.

9. California Privacy Notice

This Section supplements the rest of this Privacy Policy for California residents.

We collect the categories of personal information described in Section 1, including identifiers, professional or employment-related information, internet or electronic network activity, commercial and billing information, inferences or analytics derived from use of the Service, and other information you or your organization provide or authorize us to process.

We collect this information from you, your organization, your users, connected integrations, service providers, payment processors, analytics tools, and your interactions with Backlight.

We use and disclose these categories for the business and commercial purposes described in Sections 2 and 4, including providing and securing the Service, operating integrations, processing billing, performing analytics, communicating with users, complying with law, and improving Backlight.

We do not sell personal information for money. We do not use customer workspace data for cross-context behavioral advertising. We may use analytics cookies or similar technologies on our website or in the Service; to the extent those activities are considered a "sale" or "sharing" under California privacy law, you may opt out by using browser or device controls where available or by contacting email hidden — enable JavaScript to view.

We do not knowingly sell or share personal information of individuals under 16.

We retain personal information as described in Section 6.

10. International Data Transfers

Backlight is operated from the United States, and our infrastructure is currently located in the United States. If you access the Service from outside the United States, your information may be processed in the United States and other jurisdictions where our service providers operate. Enterprise and custom-contract customers may request data-processing terms that address international transfer requirements.

11. Your Privacy Rights

Depending on your location and relationship to Backlight, you may have rights to request access, correction, deletion, portability, restriction, or objection regarding certain personal information. You may also have the right to withdraw consent where processing is based on consent.

To exercise rights, contact us at email hidden — enable JavaScript to view. We may need to verify your identity and your authority to act for a customer organization before fulfilling a request. Some information may be retained where permitted or required for security, legal, billing, audit, or legitimate business purposes.

12. Children's Privacy

Backlight is a business service and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to Backlight, contact us so we can take appropriate action.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by updating the "Last updated" date and, where appropriate, by email, in-app notice, or another reasonable method. The updated Privacy Policy applies when posted unless the notice states otherwise.

14. Contact Us

Questions about this Privacy Policy or Backlight's data practices can be sent to:

email hidden — enable JavaScript to view

Accent Labs Inc.