Privacy Policy

1. Who is responsible

We are the controller for the personal data described in this policy. You can reach us about anything in it at privacy@basable.com.

For personal data your projects process, such as data about the users of your applications, you are the controller and we act as your processor. That processing is governed by section 10 of the Terms of Service, not by this policy.

2. Personal data we process

• Account data: your email address, your name if you give it, the public keys of your passkeys, and the sessions that keep you signed in.
• Organisation and billing data: your organisation's name, its members and their roles, contact email address, billing name and address, VAT number, invoices, payment history and the references Stripe gives us for your payment method. Card and bank details are entered on Stripe's own pages and never reach us.
• Domain registrant data: the registrant contact details of an organisation that registers a domain through us.
• Git provider data: identifiers of the git accounts, app installations and repositories you connect, such as your GitHub username.
• Project content: your prompts and conversations with the AI assistant, the source code and configuration the Service reads from or writes to your repositories, build and deployment records, and the logs of your environments. These can contain personal data you put in them.
• Connected applications: the AI clients you authorise through the MCP sign-in, and the access granted to them.
• Usage and technical data: IP address, browser and device information, requests made to the Service, timestamps, and records of actions taken in it, such as deployments and the usage we meter for billing.
• Correspondence: the messages you send us and our replies.

3. Why we process it, and on what basis

• To provide the Service: creating and securing your account, signing you in, generating code with the AI assistant, building and running your projects, registering domains, and sending service emails such as login codes and deployment and billing notices. Basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To bill you: metering usage, invoicing, collecting payments and applying VAT. Basis: performance of the contract, and our legal obligations to keep accounting and tax records (Art. 6(1)(c) GDPR).
• To keep the Service secure and reliable: preventing abuse and fraud, enforcing our Acceptable Use Policy, investigating incidents and fixing faults. Basis: our legitimate interest in a safe, working service (Art. 6(1)(f) GDPR).
• To improve the Service: understanding how features are used, from records we already hold. Basis: our legitimate interest in developing the Service (Art. 6(1)(f) GDPR).
• To comply with the law: answering lawful requests from authorities and meeting other legal obligations. Basis: legal obligation (Art. 6(1)(c) GDPR).

We do not sell personal data and do not use it for advertising.

4. Who receives it

We use the following processors, each bound by a data processing agreement under Article 28 of the GDPR:

• Hetzner Online GmbH (Germany): hosting of our management systems and databases, and of projects in Hetzner regions in Germany and Finland.
• OVH Groupe SA (France): dedicated-server hosting of projects in OVHcloud regions in France and the United Kingdom.
• Amazon Web Services EMEA SARL (Luxembourg; AWS Frankfurt region): encrypted database backups, storage of the container images built from your projects, and infrastructure state.
• Cloudflare, Inc. (United States): DNS for platform and project hostnames, delivery of our emails, object storage for projects that use it (Cloudflare R2, stored in the EU), and domain registration through Cloudflare Registrar.
• Anthropic, PBC (United States): the AI models behind the AI assistant. When you use the assistant, your prompts, the conversation and relevant contents of your repository are sent to Anthropic's API to be processed.
• Stripe Payments Europe, Ltd. (Ireland, with Stripe, Inc., United States, as sub-processor): payment processing. We share your billing identity and invoice amounts.

Personal data also goes, at your request or where the law requires, to:

• your git provider, such as GitHub, through the access you grant us to your repositories;
• the AI clients you connect through the MCP sign-in, which receive the data their tools return;
• the registry of a domain you register through us, which receives the registrant details and may publish them where its rules require;
• the European Commission's VAT Information Exchange System (VIES) and, through it, the tax authority of your EU member state, which receive your VAT number when we check that it is valid before invoicing you without VAT;
• authorities, where we are legally obliged to provide it.

These recipients process the data under their own terms and privacy policies, as independent controllers.

5. Transfers outside the EU

Most processing takes place in the European Economic Area. Projects placed in the United Kingdom are hosted there under the European Commission's adequacy decision for the UK. Transfers to recipients in the United States rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Account and organisation data: for as long as the account or organisation exists, and deleted within 30 days after it is closed.
• Project content: for as long as the project exists, and deleted within 30 days after the project is deleted or the account is closed. Your source code remains in your own repository.
• Invoices and accounting records: seven years, as Dutch tax law requires.
• Technical logs: for a limited period for security and troubleshooting, at most 12 months.
• Backups: deleted data can remain in our encrypted backups for up to 30 days before it is overwritten.

7. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections, sign-in without passwords, isolation of every project's environments in sandboxed runtimes with their own network boundaries, encrypted backups, and access limited to what each person and system needs. If a personal data breach occurs, we notify the Dutch Data Protection Authority and, where required, the people affected.

8. Cookies and local storage

We use only what the Service needs to work:

• a session cookie that keeps you signed in, which expires after 24 hours;
• a security cookie that protects the sign-in forms against cross-site request forgery;
• your browser's local storage, for preferences such as the organisation you last used, the AI model you chose and an idea you typed before signing up. It stays on your device.

We do not use analytics, advertising or tracking cookies, and our pages load no third-party scripts, fonts or images. Payment details are entered on Stripe's own pages, where Stripe's cookie policy applies.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict its processing;
• receive your data in a machine-readable format (data portability);
• object to processing based on our legitimate interest;
• withdraw consent at any time, where processing is based on consent.

To exercise a right, email privacy@basable.com. We may ask you to confirm your identity first. We reply within one month, which the law lets us extend by two further months for complex or numerous requests; if we do, we tell you why.

10. Minimum age

The Service is for people aged 16 and over. We do not knowingly process personal data of anyone younger.

11. Complaints

If you believe we process your data unlawfully, please tell us first so we can put it right. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In the Netherlands that is the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
PO Box 93374
2509 AJ The Hague
The Netherlands
autoriteitpersoonsgegevens.nl

12. Changes to this policy

We may update this policy. We announce material changes by email or in the Service before they take effect. The date at the top shows when it last changed.

13. Contact

H.A.I.C. Studios, trading as Basable
Chamber of Commerce (KvK) 77477863
The Netherlands
VAT NL003199294B04
privacy@basable.com