Privacy Policy

BaseOS ("we", "us", or "our") is a multi-tenant business operating platform. This Privacy Policy explains how we collect, use, and protect personal information when you use our services at baseos.app and any associated subdomains.

Questions or requests regarding your data can be directed to privacy@baseos.app.

We collect information in the following ways:

• Account information: name, email address, and password (hashed) when you register.
• Organization data: company name, billing details, and subscription information.
• Content you create: projects, tasks, tickets, documents, comments, and any other data you enter into the Platform.
• Usage data: pages visited, features used, timestamps, and browser or device type, collected via server logs and analytics.
• Communications: emails or messages you send to our support team.

BaseOS integrates with Google services (Google Calendar, Gmail) through the Google OAuth 2.0 flow. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request the OAuth scopes necessary for the features you choose to enable.
• Google Calendar: We read and write calendar events solely to display your schedule and create events on your behalf within the Platform.
• Gmail: We read incoming emails solely to route them to your support ticketing inbox and send automated replies on your behalf. Email content is not stored beyond what is needed to create a ticket.
• Google user data is never used to serve advertising or for any purpose unrelated to providing the integration feature you requested.
• We do not sell, transfer, or share Google user data with third parties, and we do not use it to train AI or machine-learning models.
• You can revoke our access at any time from Google Account Permissions or from Settings → Integrations within BaseOS.

We use the information we collect to:

• Provide, operate, and improve the Platform.
• Authenticate your identity and manage your session.
• Process payments and manage your subscription.
• Send transactional emails (receipts, password resets, account alerts).
• Respond to support requests.
• Analyze aggregated, anonymized usage patterns to improve features and performance.
• Comply with legal obligations.

We do not use your data for behavioral advertising or sell it to data brokers.

We share personal information only with trusted sub-processors necessary to operate the Platform, including:

• Neon / PostgreSQL: database hosting.
• AWS S3 / ImageKit: file and media storage.
• Stripe: payment processing.
• Anthropic / OpenAI: AI model inference for agent features (no personal data is stored by these providers beyond the request lifecycle).

All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security measures.

We may disclose data if required by law, court order, or to protect the rights and safety of our users or the public.

We retain your data for as long as your account is active or as needed to provide the service. When you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention and financial record-keeping.

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but commit to prompt notification in the event of a data breach affecting your rights.

We use strictly necessary cookies to maintain your authenticated session. We may use analytics cookies to understand how the Platform is used in aggregate; these do not track you across third-party sites. You can control cookies through your browser settings.

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at privacy@baseos.app. We will respond within 30 days.

If you are located in the European Economic Area, you have additional rights under the GDPR, including the right to lodge a complaint with your local supervisory authority.

BaseOS is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email or via an in-app notice at least 15 days before they take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

For privacy-related inquiries: privacy@baseos.app