This policy explains what information Backoffice Builder handles when you explore the site, configure a system, request an estimate, or contact us. We aim to collect only what is needed to provide the service and to give you meaningful control over your data.
1. Who we are
Backoffice Builder is a back-office system planning and implementation service operated from Bangkok, Thailand. It helps growing teams configure an initial system scope, receive a planning estimate, and arrange a discovery call. Privacy enquiries can be sent to privacy@backofficebuilder.co.
Backoffice Builder’s complete registered legal-entity name and service address have not yet been published on this MVP site. They will be added before a public commercial launch. Until then, you may request the current service address through the privacy email above.
2. What data we collect
When you use the builder, subscribe to Operations Insider, register for a webinar, or submit a saved proposal, we may collect your name, work email, optional phone number, company name, industry, employee and vendor counts, selected modules and features, customisation categories, delivery preference, calculated estimate, newsletter source, webinar registration status, and the date of submission. If you write a custom requirement, that text is stored with the estimate.
Our hosting and security providers may process technical information such as IP address, browser type, request time, and referring page to deliver the site, prevent abuse, diagnose failures, and apply rate limits. We do not add your IP address to the lead or estimate record.
3. Why we collect it
We use submitted information to calculate and save your estimate, create a shareable proposal, deliver requested newsletter or webinar messages, send a short sequence of relevant follow-ups, respond to questions, and prepare for a discovery call. Newsletter and automated follow-up emails include a simple unsubscribe option. We also use aggregated, consented product analytics to understand where visitors encounter friction and to improve the builder. We do not sell personal data or use it for third-party advertising.
4. How and where we store it
Depending on the deployment, lead and estimate records are stored either in Supabase or in Cloudflare D1 through our current hosting platform. A Supabase project may be hosted in Singapore or the United States according to the region selected for that project. These services use encryption in transit, encryption at rest where supported, access controls, and restricted administrative credentials. Access to identifiable lead records is limited to people who need it to operate and support the service.
5. How long we keep it
Lead and contact data is retained for up to two years from the most recent meaningful interaction, or until a valid deletion request is completed, unless a longer period is required to establish or defend legal claims. Estimate and scope records may be retained for up to five years so that a saved proposal can be referenced and so we can maintain commercial and operational records. Backups may take a limited additional period to expire.
6. Service providers and international transfers
We share data only with providers needed to run the service: Supabase or Cloudflare for data storage; Resend for transactional email delivery; OpenAI Sites and Cloudflare for current hosting; Vercel when the site is deployed there, including its aggregate analytics and performance tools; and PostHog for consented product analytics and session replay hosted in the European Union. These providers process data under their own security and privacy terms and may process it outside Thailand.
PostHog autocapture is disabled. Form input values are masked in session recordings, and our manual analytics events exclude names, email addresses, phone numbers, company names, and custom-requirement text.
7. Your rights under Thailand’s PDPA
Subject to applicable exceptions, you may ask to access a copy of your personal data, correct inaccurate data, delete or restrict data, object to certain processing, withdraw consent, or receive data in a portable format where technically applicable. Withdrawing consent does not affect processing that was lawful before withdrawal.
Send a request to privacy@backofficebuilder.co. We may ask for reasonable information to verify your identity before acting on a request. You may also lodge a complaint with Thailand’s Personal Data Protection Committee if you believe your rights have not been respected.
8. Cookies and browser storage
The builder uses session storage to keep your in-progress selections available during the current browser session. This is essential local storage, not an advertising tracker. We store your analytics-consent choice in local storage so the banner does not appear on every page.
PostHog analytics and session replay remain opted out until you accept analytics in the consent banner. If you decline, PostHog event capture stays disabled. PostHog is configured to respect the browser’s Do Not Track signal. Vercel may process aggregate, cookieless page and performance measurements when the site is hosted on Vercel.
9. Changes to this policy
We may update this policy when the service, providers, or legal requirements change. The latest revision date appears at the top of this page. If a change materially affects how already-submitted personal data is used, we will provide a prominent notice and, where practical and required, notify affected contacts by email.
10. Contact
For questions, requests, or complaints about personal data, email privacy@backofficebuilder.co. We aim to acknowledge requests promptly and provide a substantive response within 30 days, or explain if additional time is permitted and required.