Privacy Policy

This Privacy Policy describes Back Alley Development's practices for the OpinForge website and hosted application.

When we process personal data on behalf of your organization (for example contact lists, invite profiles, or survey responses stored in your workspace), we act as a service provider / processor and your organization is the controller. A DPA may supplement this policy for enterprise accounts.

Depending on how you use the Service, we may process:

• Account data: name, email, phone, organization details, authentication events.
• Workspace content: surveys, logic, themes, contact lists, distribution settings, and exports you create.
• Respondent data: answers, timestamps, quality signals, consent records, and tracking parameters you configure.
• Usage & technical data: logs, device/browser metadata, IP address, error reports, and security audit events.
• Communications: support messages, managed-services briefs, and email delivery metadata.

We use information to:

• Provide, secure, and troubleshoot the hosted Service.
• Authenticate users, enforce workspace access, and maintain audit trails.
• Send transactional email (invites, password reset, notifications).
• Improve reliability and develop features (using aggregated or de-identified data where feasible).
• Comply with law and respond to lawful requests.

We use infrastructure and service providers that process data on our behalf under contractual safeguards. Current categories include:

We do not sell personal information. We may disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition with appropriate notice where required.

• Hosting & deployment (e.g. Vercel) — application delivery and serverless functions.
• Database (e.g. Supabase / Postgres) — persistent storage for workspace and respondent data.
• Email delivery (e.g. Resend) — transactional messages you trigger or we send for account security.
• Error monitoring (e.g. Sentry) — crash and performance diagnostics with configurable data scrubbing.

We retain account and workspace data while your organization maintains an active relationship with us and as needed for backups, security, and legal obligations.

Retention of respondent and contact-list data is primarily controlled by your workspace administrators through exports, deletion, and study lifecycle.

Platform administrators may maintain separate PII vault indexes for support and compliance; access is restricted and audited.

We use industry-standard measures including encryption in transit, role-based access, organization scoping, and audit logging for sensitive operations.

No method of transmission or storage is completely secure. Report suspected incidents to us promptly.

Workspace administrators can manage team membership, exports, and much of the data in their organization.

Depending on your location, you may have rights to access, correct, delete, or restrict certain processing. Contact us or your organization administrator to exercise rights related to workspace content.

Privacy requests for account data: legal@backalleydev.com.

The Service is operated from the United States. If you access the Service from other regions, you consent to transfer and processing in the U.S. and subprocessors' regions unless a DPA specifies alternate arrangements.

The Service is not directed to children under 16. Do not field surveys directed to minors without appropriate parental consent and legal review.

We may update this policy. Material changes will be posted on this page with an updated effective date. Continued use after changes constitutes acceptance where permitted by law.

Back Alley Development — privacy inquiries: legal@backalleydev.com.