Your archives stay yours.
Your metadata matters.
How BackupTool handles account information, monitoring records and optional Google Drive access.
Who is responsible
BackupTool.com is operated by Andrejus Sevcovas, individual activity registration 480837, at Algirdo 22 - 21, Vilnius 03218, Lithuania. The operator is responsible for personal information handled by this website. Email contact@backuptool.com or use the contact form for privacy, access, correction or deletion requests. You may also write to the postal address above.
Information the service handles
WordPress account information includes your username, email address and authentication records. Connected-site information includes site names, URLs, backup destinations, monitoring intervals, connector contact times and supported backup-job results. Optional recovery records contain the details you enter about tests you performed. Do not enter passwords or personal information unrelated to the task.
We use these records to provide your private monitoring workspace, identify missing expected signals, produce the reports you request and deliver opted-in observations. BackupTool does not create, download or host your backup archives.
Optional Google Drive access
Connecting Drive is optional. New connections request drive.file and use Google Picker to select a file. This permission can allow reading, creating, modifying or deleting files shared with this app. BackupTool implements metadata requests only and does not download, create, edit or delete files. Permission covers files shared with the app through the same Google account, not exclusively the latest file selected for one site. Earlier broad Drive connections must be replaced before checks resume.
When you explicitly run a check, the server exchanges the encrypted refresh token for a short-lived access token, then requests id, size, trashed and mimeType for the exact file ID selected through Google Picker. It does not list your Drive, fetch filenames or request archive media. The response is used to interpret metadata availability. The history stores the file reference, outcome, reported size when available, HTTP status and check time. It does not save the raw Google response.
Google Picker displays file names and previews within Google’s chooser. BackupTool only submits the selected ID to its server and does not store those names or previews. A short-lived selection session contains encrypted access and refresh tokens for up to ten minutes. Cancelling the chooser keeps the session available until expiry; discarding the session removes it. Google refresh tokens and the selected file ID are stored in your workspace connection only after the server verifies that file is accessible. Tokens are encrypted with this installation’s WordPress salts. A successful metadata request does not establish archive integrity or recoverability.
Understand Google access and removalShort-lived request protection
Security controls use keyed hashes of request addresses or signup mailbox identifiers to enforce request budgets. These hashes are pseudonymous security data, not anonymous data. The counters store their expiry and request count rather than the original address or mailbox. Expired counters are removed in bounded batches when the independent scheduler runs; a scheduler outage can delay that cleanup. They are not used for advertising or marketing.
Limited use of Google information
BackupTool’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google information is used only for the visible archive-check feature and the reports you choose to generate. It is not sold, used for advertising, credit decisions or general-purpose AI training. The service has no automated sharing of these records with advertising services or other customers. You control any report you print or share.
Human access to Google-derived information is limited to your affirmative agreement for specific support, necessary security or abuse investigation, legal requirements, or permitted aggregated internal operations. The operator does not routinely inspect your Drive information.
Editable billing details
You may save your customer name, billing address and country in Workspace Settings → Billing. Customer type, company name and tax/VAT ID are optional. Customer type is self-declared and tax IDs are not independently verified. This preparation profile is encrypted at rest, included in your verified account-data export and removable through the billing form or the separate verified billing-profile eraser. The form does not send your details to PayPal or determine tax treatment. Editing or removing the profile does not rewrite recorded accounting snapshots or remove historical hosting backups.
Payment and invoice preparation records
A freshly verified subscription payment creates an encrypted immutable snapshot of the current billing profile, seller details, service period, amount and provider reference, with a unique increasing document number. Its downloadable invoice draft is not an issued tax invoice. Tax treatment, processing fees and EUR conversion remain unconfirmed where no verified values have been recorded. Verified provider refunds and reversals create separate adjustment entries, not automatic credit notes. Sandbox records are labelled separately from live sales.
These snapshots are available through verified personal-data export. Erasure requests require operator review of applicable financial retention obligations and your rights. The monitoring and editable-profile erasers do not automatically delete accounting snapshots. The operator must reconcile these records with provider statements and maintain appropriate accounting records; this implementation does not determine tax liability. Lithuanian individual-activity accounting evidence and accounting registers must generally be kept for at least 10 years. This applies to required income/expense evidence, not automatically to every monitoring record or sandbox draft. The operator reviews each financial erasure request and records the applicable retention reason.
Subscription confirmations and customer statements
Verified live payments can produce a saved subscription confirmation and transactional email. Withdrawal declarations and first-payment refund requests retain your name, account email, contract reference, statement, optional note and submission time, plus acknowledgement delivery and operator review history. These commercial records are separate from monitoring data and are not deleted by the monitoring eraser. They remain subject to applicable retention obligations and your data rights; contact the operator for account and commercial-record review. Your verified privacy export includes your statements and customer-visible review notes. A mail transport acceptance does not establish inbox receipt. Sandbox request records are tests and send no acknowledgement email.
Services involved in processing
The WordPress hosting and database infrastructure process stored account and monitoring records. The configured mail service processes enquiries and notification delivery. Google processes your Drive authorization and the metadata requests you initiate. Optional S3 and B2 requests are sent to the provider you configure. PayPal processes subscription approval and payment information if the operator enables checkout; BackupTool stores the subscription reference, approved price, site allowance and verification state rather than card details. New checkouts also retain your review time, policy version, price catalog, monthly interval and the displayed renewal, cancellation and first-payment refund wording. The saved review is not proof of payment and does not create a subscription by itself. You can inspect it in Billing and request it through the verified account-data export.
These providers operate under their own service and privacy terms. Provider processing can involve countries outside Lithuania and the European Economic Area. Applicable transfer safeguards and provider arrangements must be established before enabling the service for public customer accounts. This notice describes the public service and its optional integrations.
Named providers and international processing
Namecheap provides the hosting and associated mail infrastructure. The configured SMTP host is the same hosting service; GoSMTP is the WordPress transport plugin, not a separate mailbox provider. Account, database, website, operational log and mail data can be processed through this infrastructure. Namecheap publishes a Data Processing Addendum and incorporates it into the governing terms for covered services, including relevant Standard Contractual Clauses. The operator confirmed on 14 October 2026 that this hosting plan uses a United States data centre. Hosting and associated mail processing therefore involve processing outside the EEA. The applicable account/service agreement and transfer safeguards remain part of the pre-launch transfer assessment.
Cloudflare Turnstile processes security signals to protect forms. Under its Turnstile Privacy Addendum, Cloudflare acts as a processor for site protection and as a controller when improving its bot detection. Its customer DPA describes processor obligations and transfer safeguards where applicable.
Google processes authorization and selected-file metadata under its own service terms. Its transfer-framework information describes its transfer arrangements. PayPal processes payment and payer information under its Privacy Statement; BackupTool receives payment references and verification information, not card credentials. Provider publications describe their frameworks but do not certify every transfer made by BackupTool.
Customer-configured S3, B2 and Slack destinations depend on the selected provider, account and region. Review those settings and provider terms before enabling delivery. Provider processing can take place outside the EEA. Contact contact@backuptool.com to request information about applicable safeguards. BackupTool maintains a provider register and transfer assessment; unresolved service-region or coverage questions remain launch checks.
Account, support and infrastructure retention
Account and editable profile data remain while the account is open and needed to provide the service. Closure and verified erasure requests are reviewed separately from site removal. Information retained for a legal obligation or an unresolved claim is restricted to that purpose, with the retention reason recorded. Inactive accounts and unresolved delivery records require operator review rather than an indefinite assumption that they are still needed.
Support mail is reviewed when the enquiry closes and retained only for follow-up, an unresolved dispute or a recorded legal requirement. Provider security logs and server backups follow the hosting service’s schedules. The configured Softaculous installation backup controls show a 28-day automatic purge period. Downloaded operational backups, including workstation copies, require separate operator review and deletion; the 28-day hosting control does not delete those copies. Active-record deletion can therefore precede the disappearance of a protected backup copy. A restored copy must have completed deletion requests reapplied before normal customer processing resumes.
Why personal information is processed
Account and monitoring information is processed to provide the service you request and manage that relationship. Optional Google access is used to perform the metadata feature you request, on the contractual service basis where applicable. Your Google permission grant is a separate technical authorization that you can revoke. Where processing depends on GDPR consent, you may withdraw that consent without affecting earlier lawful processing. Enquiries are processed to answer your request. Authentication, abuse prevention and delivery diagnostics support the legitimate interest of operating a secure and reliable service. Information may also be retained when a legal obligation requires it. We do not use your enquiry details for unsolicited marketing.
Retention and removal
Job events are retained for approximately 90 days, subject to the monitoring scheduler running. Provider-check history contains the latest 30 outcomes per connected site. Removing stored Drive access deletes the encrypted connection credentials; it does not erase previously recorded check history or revoke the Google grant. Use the separate Drive-history removal control to remove the site’s recorded Drive checks, or remove the connected site to delete its monitoring, provider and recovery records.
Recovery records remain until their connected site is removed. WordPress accounts are managed by the operator and are not deleted by removing a monitored site. Subscription references, checkout-review snapshots and terms acceptance remain for separate account and commercial-record review, including applicable legal retention requirements. They are not erased by removing a monitored site. Contact-form receipts contain only a reference, topic and time and expire after 15 minutes. Enquiries are sent to the business mailbox; they are not automatically deleted by that receipt expiry. Ask the operator to review or delete enquiry and account records. Hosting backups and mail delivery logs may have separate retention periods; deletion of active records does not immediately erase every infrastructure copy.
Your requests and choices
You can request access, correction, deletion or restriction of personal information, and request portability or object to processing where applicable. You can withdraw optional Google authorization without affecting processing already performed. We may need to verify the requester’s identity before acting and explain any applicable legal retention requirement.
Contact the operator using the form or postal address above. You may lodge a complaint with Lithuania’s State Data Protection Inspectorate (VDAI) or another competent supervisory authority.
Email verification and trial reminders
When signup is open, we temporarily store an encrypted name, email address, terms version and optional trial reminder choice for up to 24 hours. The verification link is single-use. We create an account only after mailbox verification is completed and the customer chooses a password. Passwords are stored through WordPress password hashing, not in plaintext.
We keep the account verification time, terms acceptance, trial dates and trial usage claim to operate access and prevent repeated trials. Optional expiry reminders use the account email address and can be disabled in Settings. Mailer attempts are recorded separately from actual inbox receipt. Rate limits use salted hashes of email addresses and network addresses with short expiry periods. Unused verification records expire automatically; completed links are removed.
Form abuse protection
When enabled, the contact and signup forms use Cloudflare Turnstile to assess browser interactions and connection information for abuse prevention. Your browser contacts Cloudflare, and BackupTool sends the resulting verification token to Cloudflare for a server-side validity check. BackupTool does not retain these tokens or separately forward your IP address in the verification request. Cloudflare processes its own browser and request data as described in its privacy policy. Form processing is blocked if required verification fails or is unavailable.
How to exercise your data rights
Email contact@backuptool.com with the right you wish to exercise and enough information to locate your account. Do not send your password or an identity document unless a necessary, proportionate verification method has first been agreed. Verified WordPress personal-data export and erasure requests are available through the operator. Billing-profile removal, monitoring-record removal and account closure affect different records.
For GDPR requests, we respond without undue delay and normally within one month. If complexity or the number of requests permits an extension, we explain the reason within the first month. We explain any lawful refusal or retention requirement and the available complaint route. Requests are normally free; any lawful exception will be explained.
Where California privacy law applies to the operator and your information, you may request knowledge or access, correction and deletion, use an authorized agent subject to appropriate verification, and exercise applicable sale/sharing opt-out or sensitive-information limitation rights without unlawful discrimination. Applicability depends on the statutory conditions; this notice does not claim that every small business is covered. Contact us through the same email or form.
Required information and automated decisions
An email address and authentication information are necessary to create and secure an account. Site and reporting settings are necessary to monitor that site. Google access and trial-reminder preferences are optional. Declining them does not prevent use of unrelated workspace features. Billing details may be necessary when you purchase a subscription or require an invoice.
Reporting labels, request limits and access rules are automated operational controls. They do not independently certify recovery or make legal or similarly significant decisions about you. Contact the operator if you believe an account restriction or recorded result is incorrect.
Changes to this notice
This notice describes the current implementation. Changes to Google data access or use require updated disclosures and renewed consent before the new access or use begins. The update date appears above.
Optional follow-up and scheduled metadata
Incident follow-up stores acknowledgement, investigation notes, review reminders and customer-explained resolution. Reporting resumption does not establish archive integrity or recovery. Each timeline retains its latest 100 entries until the site is removed. Dated handover exports can contain these notes and customer-recorded tests; review them before sharing.
Queued email follow-up, daily digests and scheduled branded HTML summaries require workspace opt-in and use the configured recipient. Optional Slack routing sends site names, current signals, timestamps and workspace links to the channel configured by the customer. Investigation notes, exact archive references and test details are excluded from Slack messages. The webhook URL is encrypted. Transport acceptance is recorded separately from inbox or channel receipt. Terminal delivery records are cleaned after 90 days; incomplete outcomes remain for review and are not automatically retried.
Exact-object metadata schedules require separate per-provider consent and reuse the existing saved provider access. Google metadata checks may also request modifiedTime alongside the file ID, size, trash status and MIME type. Provider-reported modification times and request mode may be retained with the latest 30 metadata observations. Selecting a different object requires new schedule consent. This does not list Drive, find newer archives, read archive contents or create a new Google permission grant. Quiet hours and delivery maintenance windows defer follow-up notifications; they do not stop external backup software.