Privacy Policy

1.1 Information You Provide

• Account Information: Email address, name, password (encrypted)
• Database Connection Information: Connection strings, database credentials (encrypted at rest)
• Payment Information: Processed and stored by Stripe (we do not store card details)
• Support Communications: Messages sent through contact forms or email

1.2 Information We Collect Automatically

• Usage Data: Pages visited, features used, time spent, interactions
• Device Information: Browser type, operating system, IP address
• Analytics Data: Via Vercel Analytics (anonymized)
• Log Data: Error logs, access logs (retained for debugging)

1.3 Your Database Content

We operate on a "Bring Your Own Database" (BYOD) model. Your data remains in your PostgreSQL database. We access your database only:

• To provide the Service (read, write, update, delete operations you initiate)
• To display your data in the interface
• Never for analytics, marketing, or any other purpose

Example: We can see "50 users applied the CRM template this week" but we can't see "John Smith applied the CRM template."

We use collected information to:

• Provide, maintain, and improve the Service
• Process your transactions and manage subscriptions
• Send transactional emails (welcome, password reset, receipts)
• Respond to support requests and inquiries
• Monitor usage and detect technical issues
• Prevent fraud and abuse
• Comply with legal obligations

We do NOT use your information for:

• Selling or sharing with third parties for their marketing
• Training AI models
• Behavioral advertising

We share your information only in these circumstances:

3.1 Service Providers

• Stripe: Payment processing (PCI-compliant)
• Resend: Transactional email delivery
• Vercel: Hosting and analytics
• Your Database Provider: Supabase, Neon, Railway, or your custom PostgreSQL host

3.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to:

• Comply with legal obligations
• Protect our rights and property
• Prevent fraud or abuse
• Protect user safety

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any change in ownership.

We implement security measures to protect your information:

• Encryption: Database connection strings encrypted at rest
• HTTPS: All data transmitted over secure connections
• Access Controls: Limited employee access to user data
• Regular Updates: Security patches applied promptly
• BYOD Model: Your database content stored in your infrastructure

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

You have the following rights regarding your personal data:

5.1 Access and Portability

Request a copy of your personal data in a structured, machine-readable format.

5.2 Correction

Update or correct inaccurate personal data through your account settings or by contacting us.

5.3 Deletion

Request deletion of your account and personal data. Note: This does NOT delete your database content, which remains in your own database.

5.4 Objection and Restriction

Object to certain processing of your data or request restriction of processing.

5.5 Withdraw Consent

Where we rely on consent, you can withdraw it at any time.

To exercise these rights, email us at: privacy@bases.sh

We use essential cookies to:

• Maintain your login session
• Remember your preferences
• Provide analytics (Vercel Analytics - anonymized)

We do NOT use cookies for:

• Third-party advertising
• Cross-site tracking
• Behavioral profiling

• Account Data: Retained while your account is active
• Usage Logs: Retained for 90 days
• Payment Records: Retained for 7 years (legal requirement)
• Database Content: Stored in YOUR database (under your control)

After account deletion, we retain minimal data for legal compliance (e.g., payment records for tax purposes).

Our Service is hosted on Vercel (US-based). If you access the Service from outside the US, your information may be transferred to, stored, and processed in the US.

We comply with GDPR requirements for international transfers through:

• Standard Contractual Clauses with service providers
• Your explicit consent to use the Service

Our Service is not intended for users under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

We may update this privacy policy from time to time. We will notify you of material changes by:

• Updating the "Last updated" date
• Sending an email to your registered email address
• Posting a notice on our website

Your continued use of the Service after changes constitutes acceptance of the updated policy.

For questions about this privacy policy or to exercise your rights, contact us: