Legal / Privacy
What we need, what we record, and why.
This covers the Conversational Coding website, shop, customer accounts, persona licensing, downloads, and consulting enquiries.
Who’s responsible?
Backstory Group Limited is controller for the information described here. We’re registered in Scotland under company number SC875878. Registered office: 48 West George Street, 48 West George Street, Glasgow, Scotland, G2 1BP. Contact privacy@backstorygroup.co.uk.
Information we collect
- Accounts and orders: name, email, username, password record, billing address, country, order, product, price, tax, status, and transaction references.
- Payments: Stripe receives payment-card details directly. We receive payment status, identifiers, amounts, and receipt links rather than full card numbers.
- Persona entitlements: product, subscription status, owner email, organisation, named seat assignees, invitation and claim status, licence-verification records, download grants, and audit events.
- Machine activation: a machine name supplied by the device, installation identifier, activation token or verifier, activation, last-seen and revocation times, and limited diagnostic information needed to enforce the three-machine limit.
- Consulting enquiries: contact and organisation details, role, team size, assessment interest, current AI use, concerns, timeline, and anything entered in free text.
- Support and communications: messages, evidence you choose to provide, and actions taken to resolve a request.
- Website and security: IP address, browser, device, pages, consent choices, authentication, diagnostic, and security activity.
Why we use it
| Purpose | Main lawful basis |
|---|---|
| Take orders, deliver downloads, create accounts, operate subscriptions, and provide receipts | Contract and requested steps before contract |
| Issue and verify licences, allocate team seats, enforce machine limits, deliver updates, and prevent sharing or misuse | Contract and legitimate interests |
| Answer consulting and support enquiries | Requested pre-contract steps, contract, and legitimate interests |
| Keep tax, accounting, legal, and transaction records | Legal obligation and legitimate interests |
| Secure accounts and investigate fraud or incidents | Legitimate interests and legal obligation where applicable |
| Optional analytics or marketing | Consent where required |
We don’t sell personal information.
Team invitations
A team purchaser or administrator supplies a colleague’s name and email so we can allocate a seat and send an invitation. The administrator must be authorised to do that and should tell the colleague why their details are being provided. We also have our own responsibility to tell invitees how we use their information. An invitation identifies the seat offer and links to this notice. We use the supplied details to administer the purchased team service and our legitimate interests in delivering and securing access, not to enrol invitees in marketing. Invitees can contact us without claiming a seat.
Who receives information
Our website hosting stores site and account information. WordPress and Easy Digital Downloads are software running on that hosting; using them does not itself mean the software vendors receive your order data. Stripe processes payments, billing, fraud prevention, and receipts. Email providers deliver service messages and invitations. Google Analytics receives optional measurement information only where consent permits it. Our licence service processes the entitlement, seat, machine, and download information described above. Professional advisers and authorities may receive information where necessary and lawful.
International transfers
Some suppliers may process information outside the UK. Before a restricted transfer takes place, we must establish the appropriate lawful arrangement for that recipient and processing, and assess the safeguards where required. You can ask privacy@backstorygroup.co.uk which countries and transfer arrangements apply to your information and request a copy of the relevant safeguards, with confidential information redacted where necessary.
How long we keep it
- Operational order and purchase information: five years from the purchase, except for information needed to honour a continuing contractual right or meet a legal requirement.
- Accounting and tax records: at least six years from the end of the last company financial year they relate to, and longer where UK law requires. This includes order and purchase information needed for those records.
- Accounts and licences: we keep the information needed to provide an active account and honour the applicable licence. An individual persona licence may allow continued use of the last legitimately downloaded version after updates end. We don’t treat subscription expiry or the five-year purchase-record period as cancelling that right. Machine, invitation and verification records are reviewed when no longer needed for access or security.
- Invitation and download links: unused invitation tokens and short-lived download links expire automatically. Expiry of a link is separate from deletion of the associated account or security record.
- Support tickets: twelve months after resolution.
- Contact and consulting enquiries: twelve months after the last substantive contact about the enquiry. Records of an agreed engagement are handled under its terms and any applicable legal requirements.
- Error logs: 30 days from creation.
- Security logs: three to twelve months from creation, depending on their content and security purpose.
- Backups: a rolling 30-day cycle. Deleted information may remain in backups for up to 30 days after live deletion, beyond ordinary use until expiry. Deletion instructions must be reapplied before restored information returns to ordinary use.
- Optional analytics and marketing: analytics follows its configured retention period; marketing continues until consent is withdrawn or the purpose ends, with a minimal suppression record where needed.
Specific records needed for a legal obligation, an active dispute or an incident investigation may be kept longer. We restrict access, record the reason and review retention when that need ends. We do not retain an entire account or support history indefinitely just because one record needs to be preserved.
Information you need to provide
We need an email address and the required checkout and billing details to take and deliver an order. Persona access also needs the relevant seat and device details to verify the licence. If those details are not provided, the purchase or activation cannot be completed. Extra enquiry detail, optional marketing and analytics are not required to buy or use the product.
Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing. You can withdraw consent. Legal limits may apply, including records we must retain.
Email privacy@backstorygroup.co.uk. You can complain to the Information Commissioner’s Office.
Automated licence checks and changes
Automated checks compare your subscription, seat, key and registered machines with the licence rules. A failed check may prevent activation or a new download; an expired team entitlement can end access to its managed premium library. These checks do not assess your professional ability or suitability. If a result is wrong, contact hello@backstorygroup.co.uk for a person to review it and correct the relevant records. We’ll update this notice when processing changes materially.
Privacy questions and complaints
Email privacy@backstorygroup.co.uk with a description of your concern and enough information for us to find the relevant records. You can also contact our data-protection contact at dpo@backstorygroup.co.uk, or write to our registered office. Please don’t send passwords or unnecessary sensitive information.
We’ll acknowledge a data-protection complaint within 30 days of receiving it, investigate without undue delay, keep you informed and explain the outcome and any action we take. Rights requests have a separate timetable: we normally respond within one month, and will explain any lawful extension. You can complain to the Information Commissioner’s Office; our complaints process does not prevent you from contacting it.