Privacy notice

Changes

From 30 September 2026, Fat Genie is provided by The Better Growth Company Ltd.

On 6 October 2026, this notice was updated to describe optional adaptive recommendation, outcome-learning and bounded experimentation controls. Those adaptive permissions remain off until the signed-in user enables them.

On 7 October 2026, this notice was updated to describe optional managed social connections, including Ayrshare as Backroom's social-connectivity provider, and the resulting platform observations. A supported network is not treated as connected until the user has authorised it through the linking flow.

1. Who is responsible

Backroom by Fat Genie is operated by The Better Growth Company Ltd, a company registered in England and Wales (company number 12585000), trading as Fat Genie. Registered office: Apartment 1107 9 Churchyard Row, London, England, SE11 4FF. For Backroom account data and our own service operations, The Better Growth Company Ltd is the data controller.

Privacy enquiries and rights requests may be sent by email to privacy@fatgenie.co.uk.

2. Information we process

• Account and authentication data: name, email address, role, password hash, sessions and login-attempt records.
• Profile and operating data: creator or business profile details, goals, platform links, commercial preferences, onboarding state, account tier and, where available, the browser-reported IANA time zone used to preserve calendar-day semantics.
• Workspace content: information you choose to put into planning, brand, campaign, revenue, collaboration, compliance and customer-management tools.
• AI feature data: prompts, relevant workspace inputs, generated outputs and technical job records when you ask an AI-assisted feature to perform work.
• Adaptive-learning data: if you enable adaptive features, Backroom may record recommendation receipts, your explicit decisions about them, eligible observed outcomes, learned preferences or suppressions, confidence and the evidence used to support those learned items.
• Connected-platform data: if you choose to connect a supported platform, Backroom may record connection state, sync receipts, bounded content metadata and available performance measurements. Ayrshare handles the underlying social-network authorisation and provider access tokens. Backroom stores an encrypted Ayrshare Profile Key for your connection profile; that key is not exposed through the browser or account export.
• Provenance and approval records: where a feature supports answerable work, we may record source, generation status, approved Brand Board identifiers and versions, model identity and relationships between saved artefacts.
• Technical and security data: request, device/browser and security information needed to operate, troubleshoot and protect the service, including short-lived per-account AI request counters used as safety limits.
• Administrative records: authorised administrative actions and audit events needed to operate and secure Backroom, including a limited completion receipt when reviewed active-service account erasure is executed. The receipt does not retain the deleted account's name or email address.

3. Why we use it

We use account and workspace information to provide the service you request, maintain your account and deliver requested features. Where the processing is necessary to perform our agreement with you, we rely on contract.

Backroom does not currently use workspace content for general direct marketing. If we introduce marketing email, we will use the consent or other permission required by law and provide an appropriate unsubscribe route in every message.

We use authentication, security, abuse-prevention, service-integrity and limited operational records where necessary for our legitimate interests in operating and securing Backroom, protecting users and investigating faults or misuse. We may also process information where necessary to comply with a legal obligation or establish, exercise or defend legal rights.

Where Backroom records a browser-reported time zone, it is used to preserve the calendar day the user selected for date-based workspace records and to avoid treating the server's time zone as the user's local day.

We do not use Backroom account or workspace data for behavioural advertising. We do not sell personal information.

If you choose to connect a supported external platform, we process the authorised provider data to provide the connection, observation and analysis you requested. Connected observations are not automatically treated as permission for adaptive learning; the separate adaptive controls on your Account page continue to govern whether eligible observed outcomes may affect personal recommendations.

4. Data you enter about other people

Some Backroom tools let you organise information about contacts, collaborators or customers. You are responsible for ensuring that you have a lawful basis to collect and use that information and that what you enter is accurate, relevant and limited to what is necessary.

To the extent we process personal data you supply solely on your behalf in order to provide the service, our Terms set out the applicable customer-data processing responsibilities.

5. Service providers and AI

Backroom is hosted using Floot. When you invoke an AI-assisted feature, relevant inputs may be sent to OpenAI through an API so the requested feature can produce an output. We also use infrastructure and professional service providers where reasonably necessary to host, secure, maintain and support the service.

Where an AI feature offers approved Brand Board context, that context is not applied silently. If you choose to use it, Backroom sends only the relevant approved strategic fields needed for that request and records the Board and version where the resulting work is saved with provenance. Saving generated work does not itself make that work approved, measured or factually verified.

For managed social connections, Backroom uses Ayrshare (Neverminds Solution LLC) as a service provider to present the account-linking flow and maintain the underlying social-network authorisations. Social-network passwords and provider access/refresh tokens are handled by Ayrshare rather than stored in Backroom. Backroom receives connection state and authorised social data needed for the requested feature. Connected content and metrics remain externally supplied data; they do not acquire instruction or approval authority merely because they came from an authorised account.

We may disclose information where required by law or where reasonably necessary to establish, exercise or defend legal rights. Providers acting on our behalf are expected to process personal data only for the relevant service purposes and subject to appropriate contractual and security controls.

6. International processing

Some service providers or infrastructure may involve processing outside the UK. Where UK restrictions on international transfers apply, we use an applicable adequacy regulation or other appropriate safeguard required by UK data-protection law.

7. Retention

We keep account and workspace information for as long as reasonably necessary to provide the service and manage the account, subject to deletion, legal, dispute and backup requirements. Authentication and security records are kept only for as long as reasonably necessary for access control, abuse prevention and security. Administrative audit information may be kept for longer where needed to demonstrate accountable system operation.

Where we cannot state a single fixed period, we decide retention by reference to the purpose, sensitivity, legal or contractual requirements, security needs and whether the information can be safely deleted or anonymised.

Connected-account observations and sync receipts are retained as user-owned workspace data while reasonably necessary to provide the connected feature, subject to account deletion, disconnection controls, provider requirements and applicable retention obligations. Disconnecting a managed network instructs Ayrshare to unlink that network and remove Ayrshare's authorisation for it. A reviewed Backroom account erasure also requires the corresponding Ayrshare User Profile to be deleted or confirmed absent before local active-service erasure completes. Backroom's encrypted Ayrshare service credential and per-user Profile Keys are deliberately excluded from account export and are not treated as reusable workspace content.

The current AI safety control records hourly per-account request counts for abuse and runaway-cost protection rather than billing. When a new usage window is created, Backroom prunes that account's counter rows older than 72 hours.

Where active-service account erasure is completed after review, Backroom retains a limited administrative completion receipt containing operational identifiers, relevant lifecycle timestamps, the administrator who completed the action and the erasure scope. This supports accountability for the deletion process without retaining the deleted account's name or email in the receipt. Its retention is governed by the accountability, legal and security purposes for which that record is required.

8. Automated decisions

Backroom does not use AI-assisted features to make a solely automated decision about you that has a legal or similarly significant effect on you. If that changes, we will explain the decision, the information used and the safeguards available before the feature is used for that purpose.

9. Adaptive recommendations and learning

Adaptive recommendation controls are off by default. If you enable them, Backroom may use your explicit feedback to change which recommendations it prioritises for you. Separate controls govern whether future eligible observed outcomes may be used for personal learning and whether bounded low-consequence recommendation experiments may be run.

These permissions do not authorise Backroom to publish content, send messages, make payments, alter account permissions or take other consequential external actions. Generated AI text is not treated as observed outcome evidence merely because Backroom generated it.

Signed-in users can pause adaptive learning, inspect retained learned items and reset learned state from the Account page. Resetting learned state does not delete unrelated account or workspace records. Adaptive recommendation and decision records are included in the machine-readable account export.

10. Your rights

Depending on the circumstances, UK data-protection law may give you rights of access, rectification, erasure, restriction, objection and data portability. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.

If you think Backroom has not handled your personal data properly, you can make a data-protection complaint directly to us at the registered office above or by email to privacy@fatgenie.co.uk. We will acknowledge the complaint within 30 days of receiving it, take appropriate steps to investigate without undue delay, keep you informed as appropriate and tell you the outcome without undue delay.

You may also complain to the Information Commissioner’s Office. You do not have to contact us first.

Signed-in users can download a machine-readable export of their account and user-owned workspace records from the Account page. They can also submit an account-deletion request there. A deletion request starts a controlled review: information will not be represented as erased until applicable retention, security, processor and backup handling has actually been addressed.

A completed active-service erasure removes the creator account and associated active Backroom workspace data from the live service. A completion receipt does not represent provider or platform backup copies as having been instantaneously purged; backup handling remains subject to the applicable verified backup lifecycle and any lawful retention requirement.

11. Product feedback

If you submit product feedback while signed in, we record the feedback category, message, relevant page path, optional feature label, timestamp and account identifier so that we can investigate and improve Backroom. Workspace content is not automatically attached to a feedback report. Feedback is not automatically treated as AI-training data or as canonical evidence about your business.

12. Cookies and device storage

Backroom uses a strictly necessary authentication cookie for signed-in sessions. The application also instructs Floot analytics to operate without a persistent analytics session identifier. See Cookies & storage for the current details.

13. Changes

We will update this notice when Backroom’s processing materially changes. Material changes that affect how personal data is used will be brought to users’ attention through an appropriate service notice or account flow.