Privacy & Cookie Policy

Backstage is a product of Xian Management LLC ("we", "us", or "our"). Xian Management LLC operates the Backstage event coordination platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website or use our platform.

We are committed to complying with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

We collect the following categories of personal data:

• Account & Identity Data: Full name, email address, password (hashed), account type, and organization name.
• Profile & Usage Data: Role, onboarding preferences, event activity, document uploads, and messaging history within the platform.
• Billing & Payment Data: Subscription plan, payment status, and promo code usage. Card details are processed by our payment provider and never stored on our servers.
• Technical Data: IP address, browser type, device type, operating system, referring URLs, and pages visited.
• Cookie & Tracking Data: See Section 8 (Cookies) for full details.
• Communications: Support requests, feedback, and any messages you send us.

We process your data under the following legal bases:

• Contract: Processing necessary to provide the Service you have signed up for.
• Legitimate Interests: Improving the platform, preventing fraud, and ensuring security.
• Consent: For optional analytics and marketing cookies, and for receiving promotional communications. You may withdraw consent at any time.
• Legal Obligation: Compliance with applicable laws and regulations.

• Provide, operate, and maintain the Backstage platform
• Process account registrations, subscriptions, and billing
• Send transactional emails (account verification, password reset, event invites)
• Send product updates and marketing communications (where you have opted in)
• Analyze usage to improve features and user experience
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal data. We may share data with:

• Service Providers: Hosting (Base44 infrastructure), email delivery (transactional email providers), payment processing (Wix Payments / Base44 Payments), and analytics tools, all under data processing agreements.
• Event Collaborators: When you join or create an event, relevant profile information (name, role) is visible to other authorized team members on that event.
• Legal Authorities: Where required by law, court order, or to protect our rights.

We retain your personal data for as long as your account is active or as needed to provide the Service. You can delete your account at any time from Settings → Delete account (in the app), or by emailing us. Upon account deletion, we will delete or anonymize your data within 30 days, except where we are required to retain it for legal or regulatory purposes. Inactive invited accounts may be removed after six months of inactivity.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Request deletion of your data.
• Portability: Receive your data in a machine-readable format.
• Restriction / Objection: Restrict or object to certain processing activities.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.
• Opt-out of Sale (CCPA): We do not sell personal data. California residents may submit a request by emailing us.

To exercise any of these rights, contact us at support@backstagex.app, or use the in-app account deletion option in Settings. We will respond within 30 days.

We use cookies and similar technologies on our website. Here is a breakdown by category:

You can manage your cookie preferences at any time using the banner shown at the bottom of the page, or by clearing your browser's local storage. Note that disabling strictly necessary cookies may affect the functionality of the site.

Our infrastructure is hosted in the United States. If you are located in the EEA, UK, or Switzerland, your data may be transferred to and processed in the US. We ensure appropriate safeguards are in place (such as Standard Contractual Clauses) for any such transfers.

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We implement industry-standard technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS), hashed passwords, and role-based access controls.

We may update this policy from time to time. When we make material changes, we will notify you via email or a prominent notice on the platform. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, requests, or complaints, contact us at:

If you are in the EU/EEA and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local supervisory authority (e.g. your national Data Protection Authority).