Basable

← Back to home

Privacy Policy

Last updated: 16 September 2026

1. Data Controller

Basable, based in the Netherlands, is the data controller for the personal data processed through this Service. We process your data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch data protection law.

Contact: privacy@basable.com

2. Data We Collect

  • Identity data: Your email address and, optionally, your name.
  • Authentication data: One-time login codes, passkey public keys, and session identifiers required to keep you signed in.
  • Usage data: Pages visited, features used, deployment history, and interaction timestamps.
  • Deployment artifacts: Application code, configuration files, and AI-generated content created through the Service.
  • Technical data: IP address, browser type, and device information collected automatically.

3. Legal Basis for Processing

  • Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service, including account management, deployment execution, and support.
  • Legitimate interest (Art. 6(1)(f) GDPR): Service improvement, security monitoring, fraud prevention, and analytics.
  • Consent (Art. 6(1)(a) GDPR): Where required, for example for optional marketing communications.

4. Data Processors

We share your data with the following third-party processors:

  • Hetzner Online GmbH (Germany) — Cloud hosting and infrastructure. Our management systems, our databases, and projects hosted on cloud servers run on Hetzner servers in the EU.
  • OVH Groupe SA (France) — Bare-metal hosting. Projects placed on dedicated hardware run on OVH servers in the EU.
  • Anthropic, PBC (USA) — AI code generation. When you use the AI assistant, your prompts, the assistant conversation, and relevant contents of your connected repository (including source code) are sent to Anthropic's Claude API for processing. Subject to the EU-US Data Privacy Framework.
  • Stripe Payments Europe, Ltd. (Ireland, with Stripe, Inc., USA, as sub-processor) — Payment processing. Your payment method details are collected directly by Stripe and never touch our systems; we share billing identity and invoice amounts.
  • Amazon Web Services EMEA SARL (Luxembourg; data stored in the AWS Frankfurt region) — Encrypted database backups and infrastructure state. Backup contents are encrypted at rest.
  • Cloudflare, Inc. (USA) — Transactional email delivery (login codes), DNS management for platform and project hostnames, and — where enabled — traffic routing and failover for project hostnames. Subject to the EU-US Data Privacy Framework.

All processors are bound by data processing agreements in accordance with Art. 28 GDPR. Transfers to processors outside the EU/EEA rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

5. Data Retention

  • Account data: Retained for the duration of your account. Deleted within 30 days of account closure.
  • Deployment artifacts: Retained while your account is active. Deleted within 30 days of account closure or project deletion.
  • Usage logs: Retained for up to 12 months for analytics and security purposes.
  • Legal obligations: Certain data may be retained longer where required by law (e.g. invoicing records for 7 years under Dutch tax law).

6. Your Rights

Under the GDPR, you have the right to:

  • Access your personal data.
  • Rectify inaccurate personal data.
  • Erase your personal data ("right to be forgotten").
  • Restrict the processing of your data.
  • Data portability — receive your data in a machine-readable format.
  • Object to processing based on legitimate interest.
  • Withdraw consent at any time, where processing is based on consent.

To exercise your rights, contact privacy@basable.com. We will respond within 30 days.

7. Cookies

We use strictly necessary cookies for authentication and session management. These cookies are essential for the Service to function and cannot be disabled. We do not use advertising or tracking cookies.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (TLS), access controls, and regular security reviews.

9. Supervisory Authority

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Autoriteit Persoonsgegevens
PO Box 93374
2509 AJ The Hague
Netherlands
autoriteitpersoonsgegevens.nl

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service or by email.

11. Contact

For privacy-related inquiries, contact our Data Protection Officer at privacy@basable.com.