Do you store personal data?

Identification: no. Backstory resolves each visit to the organization, never a named individual; the visitor’s IP is truncated to a /24 network block before storage — the full address is never retained — and there are no cookies. Contacts, the separate opt-in add-on, is the exception: it stores business-contact details for people who work at an identified organization, under the Leads DPA you accept first. It never identifies the person who visited.

Do you use cookies or track individual visitors?

No. Organization identification is cookieless and organization-level — there is nothing for your visitors to accept and no tracking of the individual who browsed. Backstory identifies the organization, not the person. That holds with Contacts enabled too: Contacts surfaces people who work at an identified organization, never the individual who visited.

How is this different from third-party intent or visitor-tracking tools?

Third-party tools infer intent from activity across the web and hand you person-level data on the individual visitor. Backstory scores what organizations did on your own site — first-party and organization-level. Different signal, and you never track the individual visitor.

Security & privacy

Buying signal, without the personal data.

Most visitor-identification tools de-anonymize individuals. Backstory identifies the organization — never the person who visited — from first-party signals, with no cookies and no PII.

first-party · organization-level · no PII to identify · cookieless

How collection works

No PII to identify the organization

Organization identification — no PII

Backstory resolves your anonymous traffic to the organization behind it, from first-party signals only. Organization-level: the organization, never the individual who visited.

First-party — your own site traffic, nothing bought from across the web.
No PII to identify the organization — the visitor’s IP is truncated to a /24 network block before anything is stored. The full address is never retained.
Cookieless — nothing for visitors to accept, nothing for you to manage.
Never de-anonymize the individual who visited.

What we collect — and what we never do

An auditable data ledger

Here is exactly what Backstory does and does not touch.

What we collect

The first-party network signal of each visit — the visitor’s IP truncated to a /24 network block, kept with the identified organization as the record of how it was identified. The full address is never stored.
The pages viewed on your own site — to score buying intent and read interests.
A session identifier derived from that truncated network block and the browser’s user-agent string, salted with a secret key that rotates every eight hours and is then destroyed, so it cannot be recomputed or tracked across sessions.
50+ firmographic fields about the identified enterprise organization, the full set available on export.
The vendors that see any of this — IP-to-organization lookup, firmographic enrichment, and the AI quality filter — are named in our sub-processor register.
If — and only if — you turn on Contacts: business-contact details (name, work email with its verification status, job title, LinkedIn URL) for people who work at an organization already identified on your site, retrieved from a third-party provider and governed by the Leads DPA you accept before the feature does anything.

What we never collect

No cookies and no consent banner — nothing is stored on the visitor’s device.
No PII to identify the organization — identification itself never involves a named individual.
Never de-anonymize the individual who visited your site — not in identification, and not through Contacts.
No third-party intent data bought from across the web.

How identification works

The organization, never the full address

Identifying the organization never de-anonymizes a person. The visitor’s IP is used to resolve the organization, then truncated to a /24 network block — the full address is never stored.

Anonymous visit
Resolved to the organization
Enriched to an organization domain
Truncated to a /24 block

FAQ

Questions security & privacy teams ask

Do you store personal data?: Identification: no. Backstory resolves each visit to the organization, never a named individual; the visitor’s IP is truncated to a /24 network block before storage — the full address is never retained — and there are no cookies. Contacts, the separate opt-in add-on, is the exception: it stores business-contact details for people who work at an identified organization, under the Leads DPA you accept first. It never identifies the person who visited.
Do you use cookies or track individual visitors?: No. Organization identification is cookieless and organization-level — there is nothing for your visitors to accept and no tracking of the individual who browsed. Backstory identifies the organization, not the person. That holds with Contacts enabled too: Contacts surfaces people who work at an identified organization, never the individual who visited.
How is this different from third-party intent or visitor-tracking tools?: Third-party tools infer intent from activity across the web and hand you person-level data on the individual visitor. Backstory scores what organizations did on your own site — first-party and organization-level. Different signal, and you never track the individual visitor.

See the organizations, not the individuals.

Identify the enterprise organizations on your site — organization-level, cookieless, no PII to identify the organization.

Questions? Contact us

30-day free trial, no credit card required.