Privacy Notice

BackflowPass is owned and operated by Aaron Whitfield, trading as BackflowPass. Aaron Whitfield is the data controller for the personal data described in this notice, which means we decide what data is collected and how it is used. You can contact us about privacy at [email protected].

You can use the core test workflow without an account. In that mode your test data stays in your browser's local storage on your device and is not sent to us.

• Account data (name, email address, login credentials handled by our authentication provider) — to create and secure your account. Legal basis: performance of our contract with you.
• Tester and company profile data (tester name, certification number and expiry, company name, licence number, business address, phone, email, company logo) — so it can appear on the reports you generate. Legal basis: contract.
• Test record content you enter (facility and customer name and address, contact name, phone and email, water purveyor, meter/account number, assembly details, gauge readings, repair notes, signatures) — to produce, store and re-generate your test reports. Legal basis: contract. Where this includes another person's details, you are responsible for having a lawful basis to enter them.
• Workspace data (organisation name, member invitations and roles) — to run shared Fleet workspaces. Legal basis: contract.
• Support and feedback messages — to answer you and improve the product. Legal basis: contract and our legitimate interests.
• Technical and usage data (IP address, device and browser information, pages and features used, error reports, timestamps) — for security, fraud and abuse prevention, diagnosing faults and improving the product. Legal basis: our legitimate interests.
• Email delivery data (whether a report or reminder email was sent, delivered, bounced or unsubscribed) — to operate reminders and honour opt-outs. Legal basis: contract and legal obligation.
• Marketing emails, if you opt in — legal basis: your consent, withdrawable at any time.

We do not collect or store your card details. Payment data is collected and processed by Paddle as Merchant of Record.

• Service providers and subprocessors that host and operate the product — application hosting, database and file storage, authentication, email delivery, and error/usage diagnostics. They process data on our instructions only.
• Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, invoicing, tax compliance and fraud checks. See the Paddle privacy notice.
• Other members of your workspace, where you are part of a Fleet organisation — shared customers, assemblies, presets and test records are visible to that workspace's members and admins.
• Recipients you choose — for example a water purveyor or facility contact you email a report to.
• Professional advisers (legal, accounting) where necessary.
• Authorities or third parties where required by law, or to establish, exercise or defend legal claims.

We do not sell your personal data.

Our providers may process data in countries other than your own, including the United States. Where data is transferred out of the UK or EEA, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

We keep account, profile and test record data for as long as your account is active, because backflow test records typically need to be retained for multi-year compliance history. If you delete a record it is removed from our systems; if you close your account we delete or anonymise your data within a reasonable period afterwards, except where we must keep limited billing and tax records to meet legal obligations. Diagnostic and security logs are kept for a short period only.

Subject to the law that applies to you, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, a portable copy, and you may object to processing based on our legitimate interests or withdraw consent for marketing at any time. Email [email protected] and we will respond within one month. If you are in the UK or EEA you also have the right to complain to your data protection supervisory authority. If you are in a US state with privacy legislation, you may exercise the equivalent rights that state provides, and we will not discriminate against you for doing so.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, encryption at rest with our hosting providers, row-level access controls so one account or workspace cannot read another's records, and least-privilege access for administrative operations. No system is completely secure, so please use a strong, unique password.

We use only essential cookies and browser storage: to keep you signed in, to remember your preferences, and to store your drafts and offline test history on your device so the app keeps working without a signal. We do not use advertising cookies. You can clear cookies and site data at any time in your browser settings, but doing so will sign you out and remove any locally stored drafts and reports that have not been synced to your account.

BackflowPass is a professional tool and is not intended for anyone under 16. We do not knowingly collect data from children.

If we make material changes to this notice we will update the date at the top of this page and, where appropriate, notify you by email.