Who we are
Digital-Backdrops.com (digital-backdrops.com) is run by BrandPacks Limited (Hong Kong), the company behind TemplatesBooth, "we" or "us".
We are responsible for the personal data described here: its "controller" under the UK and EU GDPR, and its "data user" under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486, the "PDPO"). To ask about your data, use our contact form and choose "My account or access".
Browsing and free downloads
You can browse every page and download every free file without telling us who you are. The site never asks you to upload a photo: you download a backdrop and do the compositing in your own editor or booth software.
When you choose Free download, we record a download request so the short-lived link works and we can count downloads:
- the backdrop and shape you chose, and the time;
- your country (two letters, worked out by Cloudflare from your connection);
- a hashed IP value (see below), used to stop automated bulk downloading.
The request is valid for 15 minutes and the download link itself for 5 minutes. Request records are deleted after 7 days. Legal basis: our legitimate interest in providing free downloads and preventing abuse.
The download page. The page shown before a free download is our own page. It shows one short promotion for TemplatesBooth, our sister site, with no third-party advertising code. If we ever add an advertising partner there, we will update this policy first, and no optional ad technology will load without the consent the law requires.
Hashed IP value. We never store your IP address itself. If you connect over IPv6, we first shorten the address to its network part (the /64 prefix). We then combine it with a secret that changes every day and store only the scrambled result (a one-way hash). Because the secret changes daily, values from different days cannot be matched to each other. For IPv6 we also keep a second, wider count for the network the address belongs to (its /48 prefix), hashed the same way, so limits cannot be avoided by switching addresses inside one network. We use it only to limit how often downloads, forms and sign-ins can be tried from one connection. Rate-limit records are deleted after about two days.
Accounts
You only need an account for lifetime access. When you create one, we store:
| What | Details | How long |
|---|---|---|
| Your account | Your email address, your password scrambled with PBKDF2 and a random salt (we never store or see the password itself), the date you joined and last signed in, your country and a hashed IP value at sign-up. | Until you ask us to delete your account. |
| Sign-in sessions | A hashed copy of the token in your session cookie, with its start, last-use and expiry time. | Until you sign out or the session expires (30 days after last use). |
| Access and downloads | Whether your account has lifetime access and how it was granted, and a log of the high-resolution files you download (backdrop, shape, time). | Access records while your account exists; download logs 24 months. |
Legal basis: performing our agreement with you. We use your email address to run your account and to answer you. We do not send marketing email to account holders.
Password resets. If you ask to reset your password, a single-use reset link is created. For now it is sent to our team inbox and a person on our team forwards it to your email address, usually within one working day. The link expires after 72 hours.
Deleting your account. Ask through the contact form from the email address on the account. We delete your account, sign-in sessions, password-reset links, access records and download history, and remove your address from the notify-me list and from contact messages. If you bought lifetime access, we keep the payment record (amount, currency, date and Stripe reference) for our accounts, with your email address removed (see payments). Stripe keeps its own record of the payment under its privacy policy. We do this within one month of your request.
Lifetime access and payments
Checkout is not open yet, so we hold no payment data today. When it opens, payments will be handled by Stripe on Stripe's own checkout page. Stripe will collect your card details and billing information under its own privacy policy; we will never see or store your card number.
From Stripe we keep a purchase record: the Stripe session and payment references, the amount and currency, the status (paid, refunded, disputed) and the times, linked to your account. We keep purchase records for as long as tax and accounting law requires, even if you delete your account. Legal basis: performing our agreement with you, and our legal obligations.
The "notify me" list
While checkout is closed, you can leave your email address to hear when lifetime access opens. We store the address, the page you joined from, the date, your country and a hashed IP value. We use it only for the email that tells you checkout has opened, and for nothing else. You can ask to be removed at any time. Legal basis: your consent, which you can withdraw at any time through the contact form.
Contact form
When you send a message, we store your name, email address, topic and message, the page you sent it from, the date and time, your country and a hashed IP value, and our server emails a copy to our team inbox so we can reply. Legal basis: our legitimate interest in answering questions. Messages are deleted 24 months after they were sent, or sooner if you ask. Please do not send passwords or payment details through the form.
Spam check. The contact form and the notify-me form use Cloudflare Turnstile to tell people from bots. When you start filling one in, your browser loads a small script from Cloudflare (challenges.cloudflare.com), which looks at technical signals such as your IP address and browser details, and we receive only a pass or fail result. Turnstile does not use cookies to track you.
Partner API
Booth software and template sites can use our API. For partners with a key, we log each call (the key, the endpoint, the time and the result) and keep these logs for 400 days. When a partner requests a high-resolution file for one of its users, it may send us an opaque reference of its own choosing, never an email address; we store that reference with the download log. The partner is responsible for its own users' data.
Anonymous usage counts
The site counts a short list of actions, such as "a backdrop page was viewed", "a free download started" or "someone joined the notify-me list", sometimes with
one extra detail from a fixed list: a backdrop id, a shape (landscape, square or portrait), a collection, or which page a notify-me form was on (for
example the pricing page). Each count is added to a daily total for the whole site, with no visitor ID and
no cookie. Anything that is not on the fixed list is stored as other, so emails and anything you type are never stored. The same action names are also sent to Google Analytics (see Cookies, storage and analytics). Daily totals are deleted after 400 days.
Cookies, storage and analytics
- Signing in sets one session cookie,
dbk_session. It is needed for your account and is not used for tracking. - Google Analytics sets first-party cookies on this site: in Europe only after you choose "Allow analytics", elsewhere by default unless you choose "No thanks". Details below.
- No advertising cookies, social media pixels or session recording tools.
- Our fonts are served from our own domain, so no font service sees your visit.
Session cookie. dbk_session holds a random token that keeps you signed in; we store only a hashed copy of it. It is HttpOnly
(page scripts cannot read it), sent only over HTTPS to this site, and removed when you sign out or after 30 days without use. While you are signed in, your
browser's local storage also keeps a simple yes/no note (db:signed-in, no email or token) so the menu can show "Account"; it is removed when you
sign out.
Google Analytics
We use Google Analytics 4, a service of Google LLC, to learn which pages and backdrops people use. It records pages you view, the site that sent you, your browser, device type and approximate location (city or country), and the actions listed under anonymous usage counts. It never receives your email address or the files you download.
Cookies. When analytics is allowed, Google Analytics sets two first-party cookies on our domain: _ga, which tells visits from
the same browser apart, and _ga_<ID>, which keeps track of the current visit. As of November 2026, Google sets both to expire after 2
years by default. They are used only for our statistics, not for advertising.
Your choice. If you visit from the European Economic Area, the UK or Switzerland, Google Analytics starts with its cookies off (Google
Consent Mode). Until you choose "Allow analytics", or if you choose "No thanks", it does not read or write analytics cookies; it may still send Google a
basic cookieless signal for each page, with the time, your browser type, the referring page and whether consent was given. Everywhere else, analytics
cookies are on by default. Wherever you are, you can change your choice at any time with "Cookie settings" at the bottom of every page. Your choice is
saved in your browser's local storage (db:consent), not in a cookie. If you close the notice without choosing, a note in session storage
(db:consent-dismissed) stops it reappearing until you close the tab.
What is switched off. Google signals and ad personalization are off, so Google Analytics does not link your visits to a Google account and its data is not used to show you ads.
IP addresses. As of November 2026, Google states that Google Analytics 4 does not log or store IP addresses. Legal basis: in the EEA, the UK and Switzerland, your consent; elsewhere, our legitimate interest in improving the site, with the option to opt out at any time.
Cloudflare. Cloudflare, which delivers the site, may set a strictly necessary security cookie (such as __cf_bm) if it needs to
check that traffic is not from a bot. We may also use Cloudflare Web Analytics, which counts page views without cookies or local storage.
Activity and error log
So we can see whether the site is working and how it is used, each page view, each counted action above, each request to the site's server (for example "an account
was created" or "a free download started") and any error is also written to our internal activity log. An entry holds the time, the page address without anything after a
?, the referring website, your connection's country, the kind of device (phone, tablet or computer) and, for errors, the error message. It has no visitor ID,
no cookie, no IP address and nothing you type or upload, and email addresses and long numbers are masked before anything is stored. The log is kept with Cloudflare,
which runs our database, and entries are deleted after 90 days. Legal basis: our legitimate interest in keeping the site running and improving it.
Who processes data for us
Cloudflare, Inc. hosts the site, delivers its pages, protects it from attacks, runs the database (D1) that holds accounts, download logs, the notify-me list, contact messages and usage totals, stores the backdrop files (R2) and routes email from the site to our team inbox. It also runs the Turnstile spam check. Cloudflare acts as our processor under its data processing addendum.
Google LLC provides Google Analytics as our processor under the Google Ads Data Processing Terms. We have switched off its "Google products & services" data sharing setting.
Stripe will process payments once checkout opens, as an independent controller for the card and billing data it collects. Our team inbox, which receives contact messages and password-reset relays, is held by our email provider. We do not sell or rent personal data.
Where your data is handled
We are based in Hong Kong. Cloudflare runs our database, storage and network on servers in many countries, so your data may also be handled outside Hong Kong, the UK and the EU, including in the United States. As of November 2026, Cloudflare's data processing addendum includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Google Analytics data is handled by Google, including in the United States, under terms that include the Standard Contractual Clauses.
How long we keep data
| Data | Kept for |
|---|---|
| Free download requests | 7 days |
| Rate-limit records (hashed IP values) | About 2 days |
| High-resolution download logs | 24 months |
| Accounts | Until you ask us to delete yours |
| Sign-in sessions | 30 days after last use |
| Password reset links | Until used, or 72 hours |
| Purchase records | As long as tax and accounting law requires |
| Notify-me list | Until you ask us to remove you |
| Contact messages | 24 months |
| Partner API call logs | 400 days |
| Daily usage counts (no personal data) | 400 days |
| Activity and error log | 90 days |
Your rights
Everyone. Under Hong Kong's PDPO, which applies to us wherever you live, you can ask whether we hold personal data about you, get a copy of it, and ask us to correct it. You can also ask us to delete your account or remove you from the notify-me list.
In the UK and the European Economic Area. Under the UK GDPR and the EU GDPR you also have the right to:
- get a copy of the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted;
- object to, or ask us to restrict, how we use it;
- receive it in a portable format;
- withdraw your consent at any time, without affecting what we did before.
How to ask. Send a message through our contact form from the email address the request is about. We may ask you to confirm the request from that address before we act. We reply within one month, which is also inside the 40 days the PDPO allows for access and correction requests. There is no charge.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) at pcpd.org.hk, to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to the data protection authority where you live.
Children
Accounts are for adults. We do not knowingly collect data from children under 13 through accounts, the notify-me list or the contact form. If you think a child has sent us their details, contact us and we will delete them.
Changes to this policy
When the site changes how it handles data, for example when checkout opens, we update this page and the date at the top before the change goes live. If a change affects account holders in a meaningful way, we will tell them on the site, and by email where we can.
See also our terms of use and the backdrop licence. Questions? Contact us.