BackendX Privacy Policy

Effective Date: October 15th, 2026 Last Updated: October 15th, 2026

BackendX Inc. (주식회사 백엔드엑스) ("Company") complies with the Personal Information Protection Act of the Republic of Korea ("PIPA") and other applicable laws.

BackendX is a software-as-a-service (SaaS) platform that enables users to generate, deploy, and manage backend services online. This Privacy Policy describes how the Company collects, uses, and protects personal information of users of the BackendX Service ("Service") and of other data subjects.

This Policy applies to users located both inside and outside the Republic of Korea.

---

Scope of This Policy and Processing Roles

The Company processes personal information in four distinct roles. This Policy applies in full only to the first.

1. Platform data — the Company as controller. Personal information of Users themselves — account and billing data, user-submitted requirements and interview conversations, deployment-questionnaire and acceptance records, and usage data (Section 1) — and information of data subjects who are not Users, such as persons who contact the Company about the Service, website visitors, and persons whose registration was declined (Section 1). The Company determines the purposes and means of this processing, and this Policy governs it.
2. End-User Personal Data — the Company as processor. Personal data of the end-users of a generated service deployed through the Company (Managed Hosting or Customer-Cloud (Company-Operated)) and of end-users' files stored in the Company file storage (Terms of Use Section 8.8), regardless of the deployment option, is controlled by the User who operates that service; the Company processes it only on the User's behalf under the Data Processing Agreement (the "DPA"; see Section 12 of the Terms of Use). The DPA — not this Policy — governs that processing, including its sub-processors, international transfers, retention, deletion, and breach notification. End-users should direct privacy inquiries and rights requests to the operator of the service they use; requests received by the Company are routed to that operator under the DPA. The specific scope of processing, personal-data categories, retention periods, sub-processors, and cross-border transfers are governed by the DPA between the User and the Company and by the deployment questionnaire for each project.
3. Independent-controller exception. Solely for the security, abuse-prevention, and legal-compliance processing described in Sections 10 and 8.8 of the Terms of Use (including reactive inspection, automated inspection of files stored in the Company file storage and quarantine and reporting of violating files, and responses to lawful demands), the Company acts as an independent controller to the narrow extent required, subject to the safeguards described there and in Section 8 of the DPA. Inspection results are kept as security and abuse-detection results under Section 1, and quarantined files are kept encrypted and separated for 90 days from quarantine and are then destroyed (files that human review finds need no report or preservation of evidence are destroyed earlier, and files are kept until the end of any pending appeal or request from the competent authorities, or any retention required by law).
4. Sign-in account data (Sign in with BackendX) — the Company as controller. Where a User connects "Sign in with BackendX" to a generated service, the Company is the controller of the information in the sign-in accounts that the end-users of that service create (email address, authentication information, records of acceptance of terms and age-of-majority attestation, records of consent to connect each service, and access records); the Company determines the purposes and means of that processing. The Company provides a connected service only with an identifier generated specifically for that service, and does not provide the email address or any other account information. That processing is governed not by this Policy but by the BackendX Privacy Policy for Sign-in Users presented when a sign-in account is created. End-user personal data that a connected service itself stores together with that identifier is processed under item 2.

Where an item described below (such as the encrypted error-event captures in Section 1.A) contains End-User Personal Data, the Company holds that data as processor under the DPA; the descriptions in this Policy are provided for transparency.

---

1. Purposes of Processing, Categories of Personal Information, and Retention Periods

The Company collects and uses personal information only to the minimum extent necessary to provide the Service.

A. Personal Information Processed Without the Data Subject's Consent

The Company processes the following personal information without the data subject's consent, on the legal bases stated below.

B. Personal Information Processed With the Data Subject's Consent

The Company processes the following personal information with the data subject's consent. Consent is optional, and declining to consent does not restrict use of the Service. However, consent on the web inquiry form is necessary to receive and answer the inquiry; without it, the inquiry form cannot be used. Users may withdraw consent at any time (Section 7) without affecting the lawfulness of processing carried out before withdrawal.

C. California Notice at Collection

For California residents, this section serves as the notice required by the California Consumer Privacy Act (Cal. Civ. Code §1798.100(a)). The Company collects the categories of personal information listed in Sections 1.A and 1.B from the sources described in those sections, for the purposes and retention periods stated for each item. The Company does not sell or share personal information as those terms are defined by the CCPA/CPRA and does not use sensitive personal information for purposes other than those permitted under Cal. Civ. Code §1798.121 without providing the right to limit. California residents may exercise the rights described in Section 7 at any time.

---

2. Automated Analysis and Use of AI Tools

1. To prevent illegal activities, abuse, and violations of the Terms, the Company may analyze user-submitted requirements and configurations using automated methods.
2. For this purpose, the Company may use third-party AI tools solely as auxiliary means to assess potential illegality.
3. Only the minimum information necessary for analysis is used. Third-party AI providers engaged for this purpose are contracted and configured to prohibit use of transmitted content to train external AI models, subject to the providers' configuration options and constraints selected by the Company to minimize such use.
4. Automated analysis results are used as supporting indicators only and do not constitute final legal determinations.
5. Automated decision-making disclosure (GDPR Art. 13(2)(f) / 22). The logic of automated analysis uses a combination of rule-based checks and third-party AI classification to flag potential Acceptable Use Policy violations. The analysis produces indicators of likely-violating activity, not final decisions. Any decision that produces legal or similarly significant effects for the User — including suspension, restriction, or termination of access to the Service — will include human review before enforcement, and the User may contest such a decision by contacting the Chief Privacy Officer at privacy@backendx.ai. The envisaged consequence of an adverse decision is restriction or termination of Service access and, where relevant, notification to competent authorities as required by law.
6. No training of the Company's own models. The Company does not operate or train its own generative AI models. The Company does not use Requirements, interview conversations, configurations, or other customer content to train any AI model (whether the Company's own model or any third-party model), except where specific additional consent has been obtained from the User.
7. Classification of inquiries and draft replies. The Company may use third-party AI providers to classify inquiries and prepare draft replies; every draft reply prepared by AI is reviewed by Company staff before it is sent. This processing is not an automated decision producing legal or similarly significant effects. The contents of the inquiry and the sender's contact details are sent to the AI providers and, where the sender is identified as a User, the related account, project, payment, and support records needed for the reply (including error events of projects in which the sender is authorized to view error events) may also be sent. The contents of inquiries are not used to train AI models. Inquiries from persons who are not Users (including former Users) are handled in the same way; in that case only the contents of the inquiry and the information given in it (such as name, email address, and, for Enterprise inquiries, company name, team size, country, and telephone number) are sent to the AI providers.

---

3. Procedures and Methods for Destruction of Personal Information

Upon account or project deletion, personal information is deleted without undue delay, unless a retention period set out in Section 1 (including a statutory retention period) has not yet expired or retention is necessary to resolve an active dispute, and subject to the recovery grace period described below. The same applies where the Company deletes an unused free-tier project under Section 2.5 of the Terms of Use.

The procedures and methods for destroying personal information are as follows.

• Destruction procedure: the Company selects the personal information for which grounds for destruction have arisen and destroys it with the approval of the Company's Chief Privacy Officer.
• Destruction method: deletion is performed in stages. Access is deactivated immediately, and associated artifacts (secrets entries, delivery repositories and mirrors, and deployed instances) are purged through asynchronous cleanup processes. Source repositories and per-project databases are kept for a grace period of 30 days after deletion, so that a project the User deleted by mistake can be recovered, and are then deleted. During the grace period a per-project database is removed from the operating environment and remains only as an archived copy in encrypted storage, which the Company does not access except to handle a recovery request. Encrypted error-event records are rendered permanently unreadable by destroying the project's encryption key after the grace period, and residual copies in backup media are deleted within the Company's backup-rotation cycle, not exceeding 90 days. When an account is deleted, account information such as the email address is deleted. However, records for which Section 1 sets a separate retention period (such as payment records, verification records of deleted accounts and projects, and records of use restrictions) are kept for that period, and in those records the email address and sign-in identifier remain only as one-way hashes. Where the Company has terminated the Account under Section 14 of the Terms of Use, account information is deleted after a grace period of 30 days allowed for objection and restoration.

Retained records are segregated and access-controlled. Resources provisioned in a User's own cloud account under Customer-Cloud deployment are not deleted by the Company automatically (see Section 11 of the Terms of Use).

Where personal information must continue to be preserved under other laws even though the retention period consented to by the data subject has expired or the purpose of processing has been achieved, the Company moves that personal information to a separate database (DB) or stores it in a separate location.

---

4. Disclosure to Third Parties

1. The Company processes personal information only within the scope of the purposes stated in this Policy and does not disclose personal information to third parties except (a) where the User has given prior consent, (b) where disclosure is required by applicable law, court order, or lawful request from a competent authority, (c) where material suspected to be child sexual abuse material, such as an image whose hash matches known child sexual abuse material, is detected and reported to law enforcement or other competent authorities as permitted by applicable law (limited to the minimum information necessary for the report), or (d) in connection with a corporate transaction (merger, acquisition, asset transfer), subject to prior notice to affected Users where required by law.
2. As those terms are defined by the California Consumer Privacy Act (CCPA/CPRA), the Company does not "sell" or "share" personal information for cross-context behavioral advertising.

---

5. Outsourcing of Processing (Consignment under PIPA Article 26)

The Company outsources ("consigns") certain processing activities. In accordance with PIPA Article 26, the current consignees and consigned tasks are:

The current list of consignees is maintained on the Service and updated when changes occur. The Company requires each consignee to implement appropriate technical and organizational safeguards, restricts processing to the consigned purpose, prohibits sub-consignment without approval, and supervises compliance in accordance with PIPA Article 26.

---

6. Cross-Border Transfer of Personal Information

1. The Company may consign the processing of, or store, personal information of data subjects with consignees located outside the Republic of Korea for the purpose of providing the Service. Platform data processed by the Company is primarily stored in the AWS Asia Pacific (Seoul) region (ap-northeast-2). Personal information may be transferred to and processed in countries outside the Republic of Korea (principally the United States) where the consignees listed in Section 5 operate — for example, when third-party AI providers, payment processors, source-code hosts, email-delivery providers, or advertising platforms process data in their respective regions.
2. Data subjects may refuse cross-border transfers, and the way to do so depends on the legal basis of the transfer. Transfers in the table below that are based on PIPA Art. 28-8(1)1 (consent of the data subject) may be refused or withdrawn by refusing or withdrawing consent to the analytics or advertising category in the cookie-preferences control under Section 15, or by using the unsubscribe link in advertising email. The cookieless Google Analytics 4 signals sent while the User has not consented to the analytics category are not sent where the browser sends a Global Privacy Control signal (Section 15). Usage analytics of the MCP server distributed by the Company can be stopped by setting the environment variable described in Section 15.6. Other transfers are necessary to provide the Service; a data subject who wishes to refuse them may contact privacy@backendx.ai, stop using the relevant feature, or delete the account, in which case some or all of the Service may be unavailable.
3. In accordance with PIPA Article 28-8(2), the Company provides the following information on cross-border transfers.

4. Transfer mechanism (GDPR / UK GDPR): where personal data of data subjects in the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, the Company relies on the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, together with supplementary technical and organizational measures (encryption in transit and at rest, access controls, minimization) as documented in a transfer impact assessment available on request.
5. Transfer mechanism (PIPA): the Company provides the disclosures required by PIPA Article 28-8 and, where legally required, obtains separate consent.
6. Contact details of recipients. Amazon Web Services, Inc. — aws-korea-privacy@amazon.com; GitHub, Inc. — privacy@github.com; OpenAI OpCo, LLC — privacy@openai.com; Google LLC — googlekrsupport@google.com; Anthropic, PBC — privacy@anthropic.com; BackendX US, Inc. — privacy@backendx.ai; Stripe, LLC — privacy@stripe.com; Meta Platforms, Inc. — korealocalagent@support.facebook.com (Meta's designated domestic agent in the Republic of Korea), or by mail: Meta Platforms, Inc., ATTN: Privacy Operations, 1601 Willow Road, Menlo Park, CA 94025, USA; ActiveCampaign, LLC (Postmark) — privacy@activecampaign.com; Slack Technologies, LLC — privacy@slack.com; Microsoft Corporation — https://aka.ms/privacyresponse.

---

7. Rights of Data Subjects (PIPA, GDPR, UK GDPR, CCPA/CPRA)

Subject to applicable law, data subjects have the following rights:

• Access — obtain confirmation of, and a copy of, personal information processed about them.
• Rectification / correction — request correction of inaccurate or incomplete data.
• Erasure / deletion ("right to be forgotten") — request deletion subject to legal retention obligations.
• Restriction of processing — request that processing be limited in certain circumstances.
• Objection — object to processing based on legitimate interests, including profiling and direct marketing.
• Data portability — receive personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Withdrawal of consent — where processing is based on consent, withdraw consent at any time without affecting prior lawfulness.
• Right not to be subject to automated decision-making (GDPR Art. 22) — the Company's automated illegality-detection outputs are supporting indicators only; any decision that produces legal or similarly significant effects for the User (such as suspension or termination) will include human review, and the User may contest the decision by contacting the Company.
• Lodge a complaint — data subjects in the EEA/UK may lodge a complaint with their local supervisory authority; Korean data subjects may contact the Personal Information Protection Commission (privacy.go.kr) or the Korea Internet & Security Agency (privacy.kisa.or.kr); California residents may contact the California Privacy Protection Agency or Attorney General.
• California-specific rights (CCPA/CPRA): right to know categories/specific pieces of PI collected, sources, purposes, and third parties; right to delete; right to correct; right to opt out of sale/sharing (the Company does not sell or share); right to limit use of sensitive PI; right to non-discrimination for exercising these rights. Authorized-agent requests are accepted with verification.

Requests may be submitted to privacy@backendx.ai; rights requests sent to team@email.backendx.ai are also handled. The Company will verify the requestor's identity and respond within the statutory timeframe (one month under GDPR, extendable by two further months depending on the complexity and number of requests, with notice of any extension within the first month; 45 days under CCPA, extendable by 45 days; 10 days for initial response under PIPA).

---

8. Security Measures

The Company implements technical and organizational measures to protect personal information, proportionate to the nature, scope, context, and purposes of processing and the risks to individuals.

Current measures include:

• Access control and authentication — role-based access with least-privilege defaults; multi-factor authentication on administrative accounts.
• Encryption in transit — TLS 1.2 or higher on all external interfaces and on connections to third-party processors (cloud providers, AI providers, payment processors, source-code hosts).
• Encryption at rest — storage-level encryption on databases and backups; additional application-level (column-level) encryption using an envelope pattern with key-management-service (KMS) keys for higher-sensitivity stores, including user-submitted Requirements and interview conversations. Decryption operations on higher-sensitivity stores are logged.
• Per-project tenant isolation (Managed Hosting) — each deployed project runs in its own isolated container network and uses a dedicated database and database role on shared database infrastructure, with per-project database credentials derived through a KMS-backed mechanism rather than stored; error-event captures from deployed services are encrypted with a per-project key before leaving the service, and decryption is confined to (i) serving the project's own operations dashboard, (ii) analysis of the cause of errors and generation of proposed fixes (including processing by third-party AI providers), (iii) customer support by the Company to resolve the User's incidents (including the preparation of draft replies using third-party AI providers), and (iv) the reactive inspections described in Section 10 of the Terms of Use. Access by Company personnel is recorded together with the person accessing, the project concerned, and the scope of the query, and transmission to AI providers for the preparation of draft replies is also recorded together with the project concerned and the scope of the query.
• Secret scrubbing before external AI processing — where user-submitted content is sent to third-party AI providers for automated analysis (see Section 2), and where error events are sent for analysis of the cause of errors or for the preparation of draft replies to inquiries, the Company applies deterministic redaction to remove obvious secrets (such as cloud access keys, bearer tokens, and payment-instrument patterns) before transmission. Third-party AI providers are engaged under contracts that prohibit use of transmitted content to train external models, subject to provider constraints.
• Logging and monitoring — access and activity logs retained per Section 1, with anomaly alerting for privileged access and decryption events.
• Incident response — procedures for detection, containment, investigation, and notification, aligned with the data-breach notification requirements in Section 13.
• Vendor due diligence — the Company enters into Data Processing Agreements (or PIPA-equivalent consignment agreements) with consignees listed in Section 5 and reviews their security posture when onboarding them.

---

9. Legal Bases for Processing (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, the Company processes personal data on the following legal bases:

Users must not submit special-category personal data (GDPR Art. 9; PIPA Art. 23) in Requirements or interview conversations. Where such data is nonetheless submitted, the Company will process it only under a lawful basis permitting such processing (such as explicit consent under Art. 9(2)(a) or an applicable Art. 9(2) / PIPA Art. 23 exception) or will delete it upon identification. The Company does not knowingly process special-category data for purposes beyond operating the Service and complying with legal obligations.

---

10. Chief Privacy Officer (PIPA Article 31)

In accordance with PIPA Article 31, the Company designates a Chief Privacy Officer (개인정보보호책임자) responsible for overall management of personal information and handling of User requests and complaints.

• Chief Privacy Officer: DK Moon, Representative Director, BackendX Inc. (주식회사 백엔드엑스)
• Email: privacy@backendx.ai
• Postal address: Unit 9, 4th Floor, Business Building, 43 Changeop-ro, Sujeong-gu, Seongnam-si, Gyeonggi-do 13449, Republic of Korea

Users may contact the CPO for any privacy-related inquiry, request, or complaint. The CPO will respond within the statutory timeframe and will endeavor to resolve issues promptly.

---

11. EU / UK / Swiss Representative (GDPR Art. 27 / UK GDPR Art. 27 / Swiss FADP Art. 14)

In accordance with GDPR Article 27, UK GDPR Article 27, and Article 14 of the Swiss Federal Act on Data Protection (FADP), the Company has appointed Data Protection Representative Limited (trading as DataRep) as its representative in the European Union and European Economic Area, the United Kingdom, and Switzerland, with effect from 15 September 2026. Data subjects in the European Economic Area, the United Kingdom, or Switzerland may, in addition to contacting the Company directly (Section 14), contact the representative to raise an inquiry or exercise their rights by:

• Email: datarequest@datarep.com, quoting "BackendX Inc." in the subject line
• Online form: www.datarep.com/data-request
• Post: the most convenient of the addresses below

When writing by post, it is essential that the letter be addressed to "DataRep" and not to "BackendX"; otherwise the inquiry may not be received. Please refer clearly to BackendX Inc. in the body of the correspondence. On receiving a request, the Company may ask for evidence of identity, to ensure that personal data is not provided to anyone other than the data subject.

---

12. Children's Privacy

Registration for the Service requires the User to have reached the age of majority under the law of the User's nationality (and in any case to be at least 18 years of age — e.g., 19 for nationals of the Republic of Korea); the User confirms this at registration, and the confirmation is recorded with the document version and timestamp. Accordingly, the Service is not directed to children under 13 (under the U.S. Children's Online Privacy Protection Act, "COPPA"), under 14 (under PIPA), or under 16 (under GDPR, subject to EU member-state variation). The Company does not accept registrations from minors under any circumstances — including with the consent of a legal guardian — and does not knowingly collect or process personal data of children below those ages. Because the Company does not process children's personal information at all, it operates no guardian-consent mechanism (such as the consent procedure contemplated by PIPA Article 22-2 for controllers that do process under-14 data). If the Company learns that a minor has registered or that a child's personal information has been collected, it will delete the account and the associated personal information. If you believe a child has provided personal information, please contact privacy@backendx.ai for prompt deletion.

---

13. Data-Breach Notification

In the event of a personal-data breach, the Company will notify affected Users and report to the competent supervisory authorities in accordance with applicable law. Under PIPA Article 34, data subjects are notified within 72 hours of awareness regardless of the size of the breach, and where a statutory reporting trigger exists (a breach concerning 1,000 or more data subjects, a breach of sensitive or unique identification information, or a breach caused by unlawful external access, among others) the Company reports to the Personal Information Protection Commission or the Korea Internet & Security Agency within the same period. Where GDPR Articles 33/34 apply, the Company reports to the supervisory authority within 72 hours of awareness and notifies data subjects where high risk is likely, and the Company also follows the requirements of other applicable laws such as U.S. state breach-notification statutes.

For End-User Personal Data processed under the DPA, notifying affected end-users and competent authorities is the responsibility of the User as controller. The Company notifies the User without undue delay (and in any case within 72 hours of awareness) and assists the User's notification obligations as set out in the DPA, and notifies end-users directly only where necessary to comply with a direct legal duty or where the User is unresponsive.

---

14. Contact

For privacy-related inquiries, rights requests, or complaints, please contact:

• Chief Privacy Officer: DK Moon
• Privacy Email: privacy@backendx.ai
• General Email: team@email.backendx.ai
• EU/UK/Swiss Representative: DataRep — datarequest@datarep.com (see Section 11)
• Abuse reports: abuse-reports@backendx.ai

---

15. Cookies and Similar Technologies

The Company distinguishes between the in-product Service (app.backendx.ai or equivalent) and the marketing website (backendx.ai). Cookies fall into the categories below; for every category other than strictly necessary cookies (analytics and advertising), the User may grant or withdraw consent per category through the cookie banner or the cookie-preferences control.

1. Strictly necessary cookies. The in-product Service and the marketing website use strictly necessary cookies and similar technologies for authentication, session management, security, and service operation. These are essential to providing the Service and do not require consent under applicable law.
2. Analytics (GA4). The Service — the marketing website and the in-product Service alike — uses Google Analytics 4 ("GA4") for traffic measurement, analysis of conversion across signup steps, and product improvement. GA4 sets cookies (including _ga, _ga_<id>) that are classified as non-essential analytics cookies. Regardless of the User's location, no analytics cookies are set until the User consents to the analytics category through the cookie banner (Google Consent Mode defaults to denied). The Google tag loads before consent (the advanced mode of Google Consent Mode); in that case it neither sets nor reads cookies. Even before consent, however, signals that contain no cookies and no user identifiers are transmitted to Google. These signals include the page-visit timestamp, the address of the page visited (with sensitive parameters such as invitation tokens and payment sessions removed), browser type, referrer, consent status, whether an ad was clicked, and the names of Service usage events; they do not include transaction identifiers or other values that could be linked to a payment or an account. The IP address is conveyed to Google in the course of transmission. Google uses these signals solely for statistical modeling of traffic and conversions. These signals are not intended to identify or track individual Users but to aggregate access statistics, and they are sent in the same form after the User has refused the analytics category in the cookie banner or withdrawn consent. The basis for and the items of this processing are set out in the item "Website access statistics (Google Analytics 4)" in the table in Section 1.A. The User may refuse the transmission of these signals by using the browser's Global Privacy Control setting (paragraph 5 of this Section), in which case the Google tag is not loaded. Where the User is determined to be accessing the Service from the European Economic Area, the United Kingdom, or Switzerland, the Google tag is not loaded, and the signals above are not transmitted, while the User has not consented to the analytics category (before consent, after refusal, and after withdrawal). The region of access is determined from the IP address (supplemented by the browser's time-zone setting where it cannot be determined), and the IP address used for that determination is not stored. The User may withdraw consent at any time through the cookie-preferences control. GA4 data is transferred to Google LLC in the United States under Google's standard contractual clauses and within its Consent Mode framework. For signed-in Users, the Company may send to GA4 an internal account identifier (User-ID) that contains no direct identifiers such as an email address, in order to analyze Service usage at the account level. This transmission occurs only where the User has consented to the analytics category and stops when consent is withdrawn. In addition, only for Users who have consented to the analytics category, certain usage events such as completion of signup are sent to GA4 from the Company's servers where they cannot be sent from the browser, for example because of an ad blocker (in order to accurately count events that would otherwise be lost). The items sent are the internal account identifier, the GA4 client identifier and session identifier, and the name and time of the event; for this purpose the Company keeps the User's analytics-consent status and GA4 client identifier in association with the account.
3. Advertising (conversion measurement). The Service uses the conversion-tracking features of the advertising platforms below to measure the conversion performance of advertising traffic and to attribute conversions to ad clicks. The Company uses cookies and data in this category solely to measure advertising effectiveness; it does not use them for personalized advertising to the User (remarketing or behavior-based advertising) and does not permit the advertising platforms to do so (the ad_personalization signal of Google Consent Mode is always set to denied, and no custom audiences are built from Meta Pixel data). No advertising cookies are set until the User consents to the advertising category in the cookie banner, the User may withdraw consent at any time by deselecting the advertising category in the cookie-preferences control, and after withdrawal those cookies are no longer set or transmitted.
   • Google Ads (Google LLC, United States). Where the User has consented to the advertising category, cookies that store the Google ad-click identifier and browser identifier (including _gcl_aw and _gcl_au, retained for approximately 90 days) are set, and conversion events such as signup are sent to Google Ads. Data is transferred to Google LLC in the United States on the basis of consent to the advertising category (Section 6).
   • Naver Search Ads conversion tracking (Naver Corporation, Republic of Korea). Where the User has consented to the advertising category, the Naver Search Ads conversion-tracking script is loaded, cookies and identifiers for conversion tracking are set, and conversion events are sent to Naver's advertising system. This processing takes place within the Republic of Korea and does not constitute a cross-border transfer.
   • Meta Pixel (Meta Platforms, Inc., United States). Where the User has consented to the advertising category, the Meta Pixel is loaded, cookies that store a browser identifier and the ad-click identifier (_fbp and _fbc, retained for approximately 90 days) are set, and page-view events and conversion events such as signup are sent to Meta's advertising system. The Company uses this data solely for conversion measurement and does not build audiences for retargeting or other custom-audience advertising. Data is transferred to Meta Platforms, Inc. in the United States, and the Company relies on Meta's data-processing terms and standard contractual clauses.
4. Next.js framework. The Service is built using the Next.js framework. Next.js does not set tracking cookies by default; any Next.js-generated cookies used by the Service are strictly necessary and scoped to session management and security.
5. Do Not Track and Global Privacy Control. The Service honors browser-level Global Privacy Control ("GPC") signals where technically feasible, treating them as declined consent for the analytics and advertising categories. Where a GPC signal is received, the analytics and advertising tags are not loaded.
6. Non-browser clients (MCP server). The MCP server that the Company distributes as an npm package (@backendx/mcp) is a client that lets AI agents use the Service from the User's local environment. It runs without a browser, sets no cookies, and the cookie banner described above does not apply to it. Instead, the following communications take place, as also disclosed in the license document bundled with the package. Retention periods are as stated in the table in Section 1.A.
   • Version check. Each time it starts, the MCP server sends its own package version to the Company's server to confirm that the version is supported. Tools may not operate if the version is no longer supported or the check cannot be completed.
   • Usage analytics. The MCP server sends the name of each tool invoked, whether the invocation succeeded or failed and any error code, the package version, and a client ID and session ID randomly generated per process to Google LLC in the United States via the Google Analytics 4 Measurement Protocol. It does not send prompts, Requirements, generated code, authentication tokens, environment-variable values, tool arguments or results, or account identifiers such as email addresses. Usage analytics are enabled by default; the User may stop them at any time by setting the environment variable DO_NOT_TRACK=1 or BACKENDX_TELEMETRY_DISABLED=1, and doing so does not affect the MCP server's functionality.
7. First-party visit statistics and signup-source analysis. Separately from the third-party tools above, the Company counts website visits on its own servers. These statistics use no cookies or other information stored on the User's device and process only the information stated in the "Website visit statistics" row of the table in Section 1.A. The cookies (bx_first_touch, bx_first_visitor) and the browser-storage entry (bx_attribution) used for signup-source analysis are set only after the User has consented to the analytics category, and are retained for 90 days.

---

16. Changes to This Policy

This Privacy Policy may be amended due to changes in laws or Service operations. This Policy is managed by version number, and earlier versions remain available on the Service. Any changes will be announced through the Service or by other reasonable means. Material changes will be notified at least 7 days before they take effect (or, where applicable law requires a longer period, at least that period before), and the "Last Updated" date at the top of this Policy will reflect the most recent revision.