Privacy Policy

01Who controls your information

backk.me is run by XPO8 Limited, a company incorporated in Hong Kong, of 1603, The L. Plaza, 367–375 Queen’s Road Central, Sheung Wan, Hong Kong. XPO8 is the data user under Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486), and the controller where laws such as the EU or UK General Data Protection Regulation apply.

Contact us about privacy at contact@bacck.me. Read this policy with our terms.

02What this policy covers

This policy covers the backk.me website and the emails we send. It applies to visitors, sponsors and athletes.

Stripe handles card payments, identity checks and payouts on its own pages and under its own privacy policy. Other XPO8 companies have their own policies. Common ownership doesn’t let us share your information between them.

03Information we collect

• Account: your email address and password (stored only in hashed form by our sign-in provider), the version and time of the terms you accepted, and your sign-in sessions.
• Age check: your date of birth and your confirmation that you’re 18 or over. We never show your date of birth.
• Athlete profile: name, sport, country, public address, kit colour and outfit, social profile links, self-reported follower counts, and your events and their dates.
• Photos and models: the four photos you upload, the results of our automated photo checks, your 3D models and images made from them, and whether you approved them.
• Offers and sponsorships: spaces, minimum bids, bids, winning payments, acceptance decisions, proof photos and video, issues raised and our decisions.
• Sponsor details: the brand name and logo you upload, and your bids.
• Payments: references from Stripe for your customer record, saved card, payments, refunds, card disputes, subscription and payout account, with their amounts, fees and status. We never receive your full card number. Stripe collects athletes’ identity documents directly.
• Messages: emails we send you and whether they were delivered, and anything you send us.
• Technical: IP address, browser and device details and request logs. We also measure how fast pages load, recorded against the type of page rather than against you.

04Photos and sensitive information

• Your photos show your body. We use them only to check they’re usable, build your 3D model and show the model you approve.
• Original photos stay private. Only a model you approve is published.
• We don’t use your photos for facial recognition or to identify you.
• We don’t ask for health information, ethnic origin, or religious or political beliefs. Please leave them out of your profile and proof.

05Where information comes from

• You, when you sign up, build a profile, bid, sell or contact us.
• Other users: sponsors’ brand names and logos, athletes’ decisions and proof, and issues raised about your sponsorships.
• Stripe: payment, refund, card dispute, subscription and payout status, and your payout account’s country.
• Automated tools that check photos and build 3D models.

06How we use information

• Run accounts, profiles, offers and auctions, and show winning logos on 3D models.
• Check you’re 18 or over.
• Check photos and build 3D models.
• Charge winning bids and subscriptions, refund sponsors and pay athletes.
• Review proof, and settle issues and card disputes.
• Send service emails about your account, bids, payments, deadlines, proof, refunds and payouts.
• Keep backk.me secure and prevent fraud and abuse.
• Promote backk.me with public athlete profiles, models and sponsorship history. Athletes can opt out.
• Meet legal, tax and accounting duties, and handle legal claims.
• Understand how backk.me is used overall, and improve it.

Automated decisions. Some steps happen automatically. The age check blocks anyone under 18. Photo checks can ask you to retake a photo. Auctions close at the set time and the highest valid bid wins. A paid offer that an athlete doesn’t answer within 48 hours is declined. You can ask for a person to review any of these.

We don’t sell personal information, show advertising or build advertising profiles. We don’t use your photos, models or other content to train AI models, and the services that process your photos aren’t allowed to either.

07Legal bases

Where the EU or UK GDPR applies, we rely on:

• Contract: to provide your account, offers, bids, sponsorships, payments and payouts.
• Legitimate interests: security, fraud prevention, settling issues, promoting backk.me with public profiles, and improving the service. You can object to this.
• Consent: to process your photos and build your 3D model. You can withdraw it by contacting us. This doesn’t affect processing already done.
• Legal obligation: keeping financial and tax records.
• Legal claims: establishing, exercising or defending them.

08What other people can see

• Anyone, even when signed out: athlete profiles, including name, sport, country, public address, social links, follower counts, the approved 3D model, event names and dates, spaces, minimum bids, the current highest bid and the number of bids. Once a winning payment succeeds, the sponsor’s brand name and logo appear on the athlete’s model and profile, and the amount paid appears in the athlete’s sponsorship history.
• Athletes see the brand name, logo and amount of sponsors who win their spaces, and issues raised about their proof.
• Sponsors see the proof for sponsorships they won.
• Never public: your email, date of birth, original photos, payment details, and the identity of bidders who don’t win.

09How we share information

• Service providers that host backk.me and its database, store files, send email, check photos and build 3D models. They act on our instructions under contract.
• Stripe, to process payments, refunds, card disputes, subscriptions and payouts.
• Sponsors and athletes, as described above.
• Authorities, courts or advisers, when the law requires it or to protect safety or rights.
• A buyer or successor if backk.me is reorganised or sold. This policy continues to protect your information.

10Cookies and browser storage

backk.me uses only what it needs to work. We don’t use analytics or advertising cookies.

• Sign-in cookies keep you signed in until you sign out or your session ends.
• Browser storage remembers a bid you started before signing in and unsaved edits to sponsorship spaces, both cleared when you close the tab, plus your photo upload progress and the athlete shown on the home page.
• Stripe sets its own cookies on its payment pages.

11International transfers

XPO8 is based in Hong Kong. Our main systems are hosted in the United Kingdom, and some providers process information in the United States and other countries. Where the law requires, we rely on safeguards such as the European Commission’s standard contractual clauses.

12How long we keep information

The 3D modelling service deletes its copies under its own retention terms. Deleted information can stay in backups for a short time until they’re overwritten.

13Closing your account

Email contact@bacck.me from your account email to close your account. We delete or anonymise your information within 30 days, except what we must keep: open bids and sponsorships until they finish, and payment and dispute records for the periods above. A sponsorship you won can stay in the athlete’s history as a brand name and logo, without your personal details.

14Security

• Information is encrypted in transit. Database access rules apply to every request. Photos, models and logos are kept in private storage and shared through short-lived links.
• Card details are handled by Stripe and never reach our servers.
• No system is completely secure. Report security problems to contact@bacck.me.

15Your rights

• Under Hong Kong law, you can ask to access and correct your information.
• Depending on where you live, you may also ask us to delete it, restrict or object to its use, give you a portable copy, withdraw consent, or have a person review an automated decision.
• Email contact@bacck.me from your account email and say what you want. We may need to confirm your identity. We reply within one month, and tell you if we need longer and why.
• We may keep some information where the law allows, such as payment and dispute records, and will explain what and why.
• You can complain to Hong Kong’s Office of the Privacy Commissioner for Personal Data (pcpd.org.hk) or your local data protection authority. Please contact us first so we can try to help.

16Emails we send

We send service emails about your account, bids, payments, deadlines, proof, refunds and payouts. Sign-in and password emails come from our sign-in provider. We don’t send marketing emails. If that changes, we will ask for your consent where the law requires it, and every marketing email will have an unsubscribe link.

17Children

backk.me is only for people aged 18 and over. We don’t knowingly collect information from anyone younger. If you think someone under 18 has an account, tell us and we will close it.

18Changes to this policy

The date at the top shows the latest version. For material changes, we tell you in advance by email or on backk.me.

19Contact us

XPO8 Limited, 1603, The L. Plaza, 367–375 Queen’s Road Central, Sheung Wan, Hong Kong. Email contact@bacck.me, and include your account email so we can find your records.