Privacy Policy

Version 1.0 · Effective 21 August 2026

backinasec ("backinasec", "we", "us") provides a missed-call text-back service to local service businesses. This policy explains what personal information we collect, why, who we give it to, and what you can do about it.

Two different groups of people appear here, and the difference matters:

• A Customer is a business that subscribes to backinasec.
• A Caller is a member of the public who telephones that business and does not reach them.

For information about Customers, backinasec is the controller.

For information about Callers, backinasec acts in two capacities. When we play the greeting, record the voicemail, send the text the Customer configured, and show the lead in the Customer's inbox, we act as that Customer's service provider, on their instructions, and the Customer's own privacy policy applies too. We are an independent controller for the parts of the service a Customer cannot instruct or switch off: our opt-out and suppression records, our message and delivery audit trail, our retention periods, the sending window and the message cap, and security. Where we act as controller, this policy is the notice for that processing.

1. Who we are and how to reach us

2. What we collect

2.1 From Customers

• Account information — name, email address, business name, business mobile number, time zone, industry, and the booking link you choose to send to your callers.
• Verification information — your Employer Identification Number (EIN), where you have one. If you register as a sole proprietor rather than a company, the registration is in your own name instead: we collect your name, mobile number and email address. We do not collect your Social Security Number. Either way, we submit those details, together with a sample of your message wording, to The Campaign Registry and the mobile carriers, because no business may text consumers in the United States until it is registered. We do not keep your EIN once it has been submitted — we retain only its last four digits, so you can recognise which number was filed, and it is never written to our application logs.
• Payment information — handled by Stripe. We store a Stripe customer identifier and your subscription status. We do not receive or store your full card number.
• Service records — greeting text or recording, message template, settings changes, registration status, and support correspondence.

We also send text messages to your mobile number from a backinasec number: alerts when a caller replies to you, and account notices. The one-time passcode used in carrier registration is sent to you by the registry, not by us. See section 3.1 of our Terms of Service.

2.2 From Callers

When someone calls a Customer's business and the call is not answered, the call is forwarded to a telephone number we operate on that Customer's behalf. From that point we process:

• The caller's telephone number, and the time and duration of the call.
• A voicemail recording, if the caller leaves one, up to two minutes long.
• The content of text messages exchanged between the Customer and the caller through the service, including the caller's replies.
• Delivery metadata — whether a message was delivered, queued or failed, and any carrier error code.
• Opt-out records — if a caller asks not to be texted again, the request, the wording used, and the time it was received.

We do not ask a caller for their name, email address, location or payment details, and we never look up, buy or append further information about a caller from any outside source. A caller may of course tell the business their name or other details in a voicemail or a reply, and the business may record a name against their lead — a voicemail contains whatever the caller chooses to say, and we neither control nor review its contents.

2.3 From website visitors

Our website sets a strictly necessary cookie to keep you signed in. We use no advertising cookies, no tracking pixels, and no third-party analytics that profile you across sites.

If you join the waiting list. Before we open to the public you can leave your email address on our home page and, if you like, a few words about your trade. We keep both for a single purpose: to write to you once, by hand, on the day the service opens. There is no sequence, no newsletter, and we do not sell, rent or share the address. We also count submissions against the network address the form was sent from, and keep that count for about a day, so that one machine cannot flood the form; the count is not linked to your address and is deleted automatically. Ask us at support@backinasec.com and we will remove your entry — there is nothing to keep once you say so.

3. Why we process it

4. The text messages: what they are and how to stop them

Programme. When you telephone a business that uses backinasec and it cannot answer, you receive a text from that business, sent through backinasec, at the number you called from. It identifies the business, offers help, and carries a link to book.

How you are enrolled. Only by telephoning the business. We never add numbers from any list, purchase or third party, and Customers are contractually forbidden from uploading numbers.

It is not advertising. The message answers the call you just made. You are not enrolled in a marketing programme, and the only reason you received it is that you rang and nobody picked up. Every message we send is checked automatically for promotional wording and refused if any is found, and our terms forbid businesses from sending promotional content through the service.

Frequency. If you do not reply, you will receive at most two messages about any one call: the reply itself, and a single follow-up the next morning. If you do reply, you are in a conversation with the business, and it may answer you and continue that conversation until it ends or you ask us to stop — that is the point of the service. Confirmations of STOP, and answers to HELP, do not count towards the two.

Cost. Message and data rates may apply. Neither the business nor backinasec charges you for these messages. Mobile carriers are not liable for delayed or undelivered messages.

Timing. Messages are sent only between 08:00 and 20:00 in the time zone of the person receiving them, worked out from the number they called from; where we cannot work it out we use the business's own time zone. A call outside that window produces a message held until the later of the next 08:00 where you are and the next 08:00 where the business is. There are two exceptions. If you ask us to stop outside those hours, we send the single confirmation straight away rather than making you wait for it. And if you have texted the business within the last 24 hours, a person there can answer you at the time they write it — that is a human replying to you, never an automatic message.

Stopping messages. Reply STOP — or STOPALL, QUIT, END, CANCEL, UNSUBSCRIBE, REVOKE, OPTOUT, OPT OUT — to any message. You may also tell us in your own words: "wrong number", "remove me", "don't text me", or anything else that reasonably says you want them to stop. You may also stop them by telling the business directly, by telephone, in a voicemail, in person or by email, or by emailing support@backinasec.com with the number concerned. We do not require any particular word, method or format. Requests made by reply text take effect immediately; requests made any other way take effect as soon as we or the business record them, and in every case within ten business days. Stopping messages also cancels anything already queued for you. You will get one short confirmation and nothing further.

Your request applies to the business you called. If you later ring a different business that also uses backinasec and it misses your call, you will hear from that business — you can stop that one the same way.

Reply HELP to any message, or email support@backinasec.com, for identifying information and help.

5. Who we give it to

We share personal information only with the recipients below, only so far as each needs it, and only under contracts requiring them to protect it.

5.1 Mobile information and text messaging consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories of information described above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

The providers named above receive mobile information only in order to deliver the service on our behalf, under contracts that forbid them from using it for their own purposes.

We do not sell personal information and never have. We do not share it with anyone for their own marketing.

We also disclose information where the law requires it, where necessary to establish or defend legal claims, and — if backinasec is ever sold or merged — to the acquiring party, who remains bound by this policy including this section 5.1.

6. How long we keep it

We keep call and message records for four years because that is the limitation period for claims under the Telephone Consumer Protection Act, and those records are the only way either the business or we can show that a caller telephoned first and that a message was properly sent. Where a claim, dispute or investigation is pending or reasonably anticipated, we suspend deletion of the records concerned until it is resolved.

If you ask us to stop texting you, we keep a record of that request for as long as the business you called uses backinasec, and afterwards, because the obligation not to message you again does not expire. We rely on the exception that lets us keep information needed to comply with a legal obligation and to honour your own request. The record holds only your telephone number, the words you used and the date. We use it for one purpose — to stop messages reaching you — and for no other purpose. If you ask us to delete everything we hold about you, we delete the rest and keep this, and we tell you that we have.

7. Your rights

You may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, to opt out of its sale or sharing (we do neither), and not to be treated differently for exercising any of these rights.

Callers. Email support@backinasec.com from any address, giving the telephone number concerned, or reply to any message from us. We then send one text to that number containing a short code; replying with the code confirms the request is yours. We will not act on a request we cannot confirm this way. If you have already asked us to stop texting you, we will not text you to verify — we will answer by email. We will never ask you for identity documents.

Customers. Most information is editable in your settings. For anything else, email support@backinasec.com.

We confirm we have your request within ten business days and tell you how we will handle it. We respond within 45 days; if we need longer we tell you why within those first 45 days and take no more than a further 45. When we delete information at your request we also instruct our providers, including Twilio, to delete their copies. There is no charge. If you ask us to delete something we must keep — an opt-out record, or a billing record we need for tax — we tell you plainly what we kept and why.

Appeals. If we deny a request you may appeal by replying to our decision. We respond within 45 days, in writing, with our reasons. If we still deny it, we give you a link to your state Attorney General's complaint form.

California. The categories of personal information we collect are identifiers (telephone number, name, email address), commercial information (subscription and billing records), internet or network activity (delivery and error records), and audio information (voicemail recordings). We collect them from three sources only: from Customers directly, from Callers when they telephone a Customer or reply to a message, and from our providers in the course of delivering messages. We disclose them only to the recipients in section 5, and only for a business purpose. We do not sell or share personal information as the CCPA defines those terms.

We do collect information California treats as sensitive — the contents of your voicemail and your messages, which are meant for the business you called, not for us. We use it only to deliver it to that business, to keep the service working, and to keep the records in section 6. We do not use it to infer anything about you, and we do not disclose it for any purpose that would give you a right to limit its use.

Oregon. You may also ask us for a list of the specific third parties we have disclosed your information to, and we will give you the actual names.

Other states. Residents of Texas, Virginia, Colorado, Connecticut, Utah, Montana, Nebraska and other states with comprehensive privacy laws have broadly equivalent rights, exercisable the same way.

8. Call recording

Callers are told, in the greeting, that a message will be recorded, and recording begins only after that. A caller who does not want to be recorded can hang up. We add that notice ourselves, immediately before recording starts, and a business cannot remove or edit it. We keep a record of exactly what each caller was told.

No live conversation is ever recorded, because none takes place — nothing and nobody answers on the business's behalf. Recordings are made and stored by Twilio for us, and deleted after 90 days.

9. Security

Data is encrypted in transit. The two most sensitive things we handle are not kept at all, which is a stronger protection than storing them safely: your EIN is submitted to The Campaign Registry and dropped, and the credentials for the telephony account that carries your number are never written to our database. Access to production systems is limited to those who need it. Message bodies are not written to our normal logs; they appear only in debug logging, which we turn on deliberately and briefly to diagnose a fault. No system is perfectly secure and we do not claim otherwise. If a breach affects your information we will tell you, and the authorities in your state, as quickly as the law requires and in any event without unreasonable delay.

10. Where your information is held

backinasec operates in the United States and information is stored there. We do not offer the service outside the United States and do not target it at people in the European Economic Area or the United Kingdom.

11. Children

The service is sold to businesses and to self-employed people, and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child's information has reached us, email support@backinasec.com and we will delete it.

12. Changes

If we change this policy we will update the version and date at the top and email Customers at least 14 days beforehand. If a change would apply to information we have already collected in a way you would not have expected, we will not apply it to that information without asking you first.

13. Contact

support@backinasec.com — 5900 Balcones Drive, Suite 100, Austin, TX 78731, USA