Privacy Policy

Who we are

This policy describes how TRADE ESTATE SE (hereinafter "BASE", "we", "our") collects, uses and protects your personal data when you use the BASE service at app.base-ai.app and the marketing site at www.base-ai.app.

BASE is the data controller for personal data you provide when using our service, as defined under the EU General Data Protection Regulation (GDPR).

Company information and legal contact: see Imprint.

What we collect

Account & profile

Email, name, interface language, country, currency and account settings you choose. Authentication credentials (password) are stored as a salted hash and never readable in plaintext.

Data you add yourself

Content you create or upload to BASE: tasks, documents, receipts, expenses, wellness notes, call preparation, agent messages, goals and check-ins. This data is stored in the agent's permission-scoped surface and is not visible to other agents unless you confirm a hand-off.

Files

When you upload a document, photo or scan, BASE stores the original file together with extracted text and metadata (title, dates, parties, amounts) needed to make it searchable.

Voice & call data

If you use the Action agent's call features, we store: the call brief you authored, the transcript, call outcome and summary. BASE does not intentionally retain full call audio; any exceptional retention required for support, safety or law must follow the safeguards and limits described in this policy.

Technical events

Standard log data (IP address, user agent, timestamps, request paths) used for reliability, abuse prevention, security monitoring and customer support. Stored for a limited operational window (typically up to 90 days).

How we use your data

• Provide the service: store, organize and act on the information you give us, through the six BASE agents.
• Improve the service: diagnose bugs, optimize performance, develop new features. We do not use your private content (documents, finance, wellness, mentor conversations) to train external AI models.
• Communicate with you: service notifications, security alerts, account changes, and (with your explicit opt-in) product updates.
• Comply with law: respond to lawful requests from regulators or courts where required.

BASE never sells your data to advertisers, brokers, or third parties.

Agent coordination and permissions

BASE uses a shared Orchestrator to select a specialist and preserve conversation context. Every request and stored-record lookup is bound to the authenticated account.

In the current version, selected context — including recent conversation, active goal summaries, and titles of confirmed documents — may be supplied to the BASE specialist handling the request without a separate hand-off prompt. Actions that create records in another specialist area, and supported actions that affect an external service, use a visible preview or confirmation step. Connected-service access is separately controlled by the permissions you grant to that integration.

Google Workspace API data

Google integrations are optional and activate only after you connect a Google account and approve the permissions shown by Google. BASE requests only the permissions needed for the feature you choose:

• Documents Gmail reads supported attachments only from a Gmail label you select. It cannot send, delete, or change email.
• Documents Google Drive reads supported files only from a Drive folder you select. It cannot edit, move, or delete files in Google Drive.
• Action Gmail can read messages, create a reply draft, and send that reviewed draft only after a separate preview and your explicit confirmation. BASE does not send email autonomously.
• OAuth access and refresh tokens are encrypted at rest. BASE uses Google user data only to provide the visible, user-requested feature and may send the minimum necessary content to contracted processors acting on our instructions.
• Google user data is not sold, used for advertising or credit decisions, or used to train generalized AI models. Human access is prohibited except with your explicit consent, for security or abuse investigation, or where required by law.
• You can disconnect Gmail or Google Drive from the relevant Connected sources or Gmail screen. Disconnecting revokes future access. Files already imported into BASE remain until you delete them or delete your BASE account.

Legal basis (GDPR Article 6)

We process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): processing necessary to deliver the BASE service you signed up for.
• Legitimate interest (Art. 6(1)(f)): security, fraud prevention, service reliability and protection of our users.
• Consent (Art. 6(1)(a)): for optional features such as voice call recording, marketing communications, or third-party integrations. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): tax, accounting, and lawful requests from authorities.

Where we process special category data such as health information (Wellness agent), the processing is based on your explicit consent (Art. 9(2)(a)). You can withdraw that consent and delete the data at any time from Profile.

Service providers & sub-processors

BASE uses third-party service providers to deliver the service. Each is contractually bound to handle your data only on our instructions and to maintain appropriate security and confidentiality.

Current categories of sub-processors:

• AI model providers — for processing user requests (e.g. extracting fields from documents, drafting call scripts).
• Hosting, database and storage infrastructure — providers and processing locations are described in this policy and the current sub-processor list.
• Security infrastructure — DDoS protection, WAF, monitoring.
• Email delivery — transactional and notification emails.
• Calling and transcription providers — only invoked when you use Action's call features.
• Payment processing — subscription and approved in-app purchase processing through Apple or another disclosed provider where available.

The current categories and named providers are listed here; an up-to-date copy is also available on request to privacy@base-ai.app. Material changes are reflected in this policy.

International transfers

BASE currently uses infrastructure and sub-processors in the United States and other regions. Where personal data is transferred outside the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions where applicable;
• Additional technical and organizational measures (encryption in transit, minimum-necessary data principle).

Retention & deletion

We retain personal data only as long as necessary for the purposes described above, or as required by law.

• Account data: retained while your account is active.
• Content you create (documents, receipts, notes): retained while your account is active, or until you delete it.
• Technical logs: typically up to 90 days.
• Billing records: retained as required by applicable Czech accounting and tax law.

When you delete your account from Profile, your active content is removed promptly. Some backup copies may persist for a limited window (up to 30 days) before being permanently erased.

Your rights (GDPR Articles 12–22)

You have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — delete your account and stored content from Profile, or by contacting support.
• Restriction — limit how we process your data in specific circumstances.
• Data portability — export your account data in a machine-readable format from Profile.
• Object — object to processing based on legitimate interest.
• Withdraw consent — at any time, where processing is based on consent.
• Complaint — file a complaint with your local data protection authority. In the Czech Republic: Úřad pro ochranu osobních údajů (uoou.gov.cz).

To exercise these rights, use the relevant controls in Profile, or contact privacy@base-ai.app.

Browser storage

BASE uses essential browser storage to keep the service secure and functional:

• Authentication and security: session state, abuse prevention, and account protection.
• Preferences: language and interface choices needed for the site to work correctly.

BASE does not use advertising identifiers, social-media pixels, or third-party scripts to follow users across apps or websites.

Children

BASE is intended for users 18 years or older. We do not knowingly collect personal data from children under 16 without parental consent. If we become aware that we have inadvertently collected such data, we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. The version number and "Last updated" date at the top of this page reflect the current version. Material changes will be communicated by email to registered users at least 14 days in advance.

Contact

For privacy-related questions or requests:

• Email: privacy@base-ai.app
• Postal: see Imprint for our registered address.

For security vulnerabilities or responsible disclosure: Security page.