Privacy Policy

Who we are

This policy describes how TRADE ESTATE SE (hereinafter "BASE", "we", "our") collects, uses and protects your personal data when you use the BASE service at app.base-ai.app and the marketing site at www.base-ai.app.

BASE is the data controller for personal data you provide when using our service, as defined under the EU General Data Protection Regulation (GDPR).

Company information and legal contact: see Imprint.

What we collect

Account & profile

Email, name, interface language, country, currency and account settings you choose. Authentication credentials (password) are stored as a salted hash and never readable in plaintext.

Data you add yourself

Content you create or upload to BASE: tasks, documents, receipts, expenses, wellness notes, call preparation, agent messages, goals and check-ins. This data is stored in the agent's permission-scoped surface and is not visible to other agents unless you confirm a hand-off.

Files

When you upload a document, photo or scan, BASE stores the original file together with extracted text and metadata (title, dates, parties, amounts) needed to make it searchable.

Voice & call data

If you use the Action agent's call features, we store: the call brief you authored, the transcript, call outcome and summary. Voice recordings, where retained, are encrypted at rest and scoped strictly to the Action agent.

Technical events

Standard log data (IP address, user agent, timestamps, request paths) used for reliability, abuse prevention, security monitoring and customer support. Stored for a limited operational window (typically up to 90 days).

Inquiries from our website forms

When you submit a form on our marketing site (www.base-ai.app) — investor enquiry, contact, expert application, partner enquiry — we store: the fields you filled (typically name, work email, firm or fund, optional message and category), the page the form was on, your locale, IP address and browser user agent, and the timestamp.

This information is kept in a separate lead database hosted on our infrastructure (not in the product database) and is used solely to respond to your enquiry and stay in touch about that topic. It is not used for advertising or sold to anyone.

How we use your data

• Provide the service: store, organize and act on the information you give us, through the six BASE agents.
• Improve the service: diagnose bugs, optimize performance, develop new features. We do not use your private content (documents, finance, wellness, mentor conversations) to train external AI models.
• Communicate with you: service notifications, security alerts, account changes, and (with your explicit opt-in) product updates.
• Comply with law: respond to lawful requests from regulators or courts where required.

BASE never sells your data to advertisers, brokers, or third parties.

Permission-first agent sharing

BASE is built around the principle that each agent operates as a separate permission surface.

The six core agents — Document, Finance, Wellness, Organizer, Mentor, Action — handle different categories of sensitive personal information. Sensitive details from one agent's scope are not passed to another agent automatically. Cross-agent hand-offs (for example: "Finance found a recurring payment, should it become an Organizer reminder?") only occur after you explicitly confirm the action in the app.

Legal basis (GDPR Article 6)

We process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): processing necessary to deliver the BASE service you signed up for.
• Legitimate interest (Art. 6(1)(f)): security, fraud prevention, service reliability and protection of our users.
• Consent (Art. 6(1)(a)): for optional features such as voice call recording, marketing communications, or third-party integrations. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): tax, accounting, and lawful requests from authorities.

Where we process special category data such as health information (Wellness agent), the processing is based on your explicit consent (Art. 9(2)(a)). You can withdraw that consent and delete the data at any time from Profile.

Service providers & sub-processors

BASE uses third-party service providers to deliver the service. Each is contractually bound to handle your data only on our instructions and to maintain appropriate security and confidentiality.

Current sub-processors:

• Anthropic, PBC (United States) — AI model provider (Claude). Receives prompts and content you submit to agents for processing the request. Bound by Standard Contractual Clauses; does not train its general models on customer data per its enterprise terms.
• DigitalOcean, LLC (EU region — Frankfurt / NYC dual) — application and database hosting infrastructure for the marketing site and product backend.
• Neon, Inc. (United States, EU-hosted region option) — managed PostgreSQL database. Stores user account data and agent content. SSL in transit, encryption at rest.
• Namecheap, Inc. (United States) — domain registrar and inbound email forwarding for @base-ai.app addresses (e.g. forwarding privacy@base-ai.app to our internal inbox).
• Telegram FZ-LLC (UAE) — used only for internal operator notifications when a new website enquiry lands. No user content from the product is sent to Telegram.
• Let's Encrypt (ISRG, United States) — automated TLS certificate issuance for HTTPS. No personal data processed.
• Payment processor — to be announced before paid subscriptions launch. Will be added to this list and disclosed by email to existing users at least 14 days before activation.
• Voice transcription provider — only invoked when you use the Action agent's call or voice features. Specific provider to be added here when feature ships; transcripts retained per the Retention section below.

This list is current as of the policy "Effective" date at the top. We notify registered users by email when sub-processors are added or removed, at least 14 days before the change.

International transfers

BASE infrastructure is primarily hosted within the European Union. Where data is transferred to a sub-processor outside the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions where applicable;
• Additional technical and organizational measures (encryption in transit, minimum-necessary data principle).

Retention & deletion

We retain personal data only as long as necessary for the purposes described above, or as required by law.

• Account data: retained while your account is active.
• Content you create (documents, receipts, notes): retained while your account is active, or until you delete it.
• Technical logs: typically up to 90 days.
• Website-form enquiries (investor, contact, expert, partner): retained for up to 24 months from submission, then deleted unless we are still actively in contact about that enquiry. You can request earlier deletion at any time via privacy@base-ai.app.
• Billing records: retained as required by applicable Czech accounting and tax law (typically 10 years for VAT-relevant records).
• Encrypted backups of the lead database and product database are retained for up to 30 days for disaster recovery, then automatically overwritten.

When you delete your account, your active content is removed promptly. Some backup copies may persist for the recovery window (up to 30 days) before being permanently erased.

Your rights (GDPR Articles 12–22)

You have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — delete your account and stored content.
• Restriction — limit how we process your data in specific circumstances.
• Data portability — receive your account data in a machine-readable format (JSON / CSV).
• Object — object to processing based on legitimate interest.
• Withdraw consent — at any time, where processing is based on consent.
• Complaint — file a complaint with your local data protection authority. In the Czech Republic: Úřad pro ochranu osobních údajů (uoou.gov.cz).

How to exercise these rights:

• Account deletion and data export are being rolled out as self-service options in Profile during the early-access phase. Until then, please email privacy@base-ai.app from the address you registered with — we action requests within 30 days (GDPR statutory limit), typically within 1–3 business days.
• All other rights: email privacy@base-ai.app.

We do not charge for handling rights requests and do not require you to use a specific form.

Cookies

BASE uses a minimal set of cookies:

• Strictly necessary: authentication session, security, language preference. No consent required under EU ePrivacy rules.
• Analytics: privacy-respecting usage statistics (no personal identifiers, no cross-site tracking). Opt-in via the cookie banner.

We do not use advertising cookies, social-media tracking pixels, or third-party tracking technologies.

Installable web app (PWA)

BASE is distributed as a Progressive Web App (PWA) — you can use it directly in your browser at app.base-ai.app, or install it to your home screen / desktop. There is no separate "mobile app"; the installable version is the same web application running in a dedicated window with offline support and notification access.

What changes when you install BASE

• Local storage on your device. Your browser stores authentication tokens, your interface preferences (locale, theme), and a cache of recent agent content so the app can open quickly and work briefly offline. You can clear this at any time via your browser's site-data controls.
• Push notifications (optional). When you accept notifications, your browser generates an anonymous subscription identifier and shares it with BASE. We use it only to send notifications you have asked for (agent reminders, security alerts). You can revoke notifications from your browser's site settings at any time.
• No additional tracking. The installable version uses the same code and the same analytics as the website. We do not enable extra trackers, advertising IDs, or device fingerprinting because you installed the app.

Permissions each agent may ask for

BASE requests browser permissions only when a specific agent needs them, and only when you initiate the related action for the first time. You can decline; the agent then operates in a limited mode (for example, typed input instead of voice). You can revoke or re-grant each permission later from your browser's site settings.

• Microphone — used by the Mentor agent for voice conversations and by the Action agent for voice-driven phone calls. Audio is processed for that request only, never used for advertising or third-party model training.
• Camera — used by the Documents agent to scan papers and IDs, and by the Finance agent to capture receipts. Captures are saved inside that agent's private surface.
• Notifications — used to deliver reminders and security alerts you have agreed to.
• Storage — granted by default; used for the local cache described above.
• Calendar / Reminders / Contacts — when the Organizer agent connects to your calendar or contacts, we use OAuth (Google Calendar, Apple Calendar where supported) so the connection happens with the provider, not via raw permission to your address book. You can disconnect at any time from Profile.
• Health data — the Wellness agent integrates with Apple Health / Google Fit via OAuth when you enable it. Health data is stored only inside the Wellness agent's private surface and never shared with other agents or third parties.

If you uninstall

Removing the installed icon does not delete your account or your content on our servers — that data remains until you delete the account itself (see "Your rights" above). Local cache and tokens on the uninstalled device are removed by the browser.

Children

BASE is intended for users 18 years or older. We do not knowingly collect personal data from children under 16 without parental consent. If we become aware that we have inadvertently collected such data, we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. The version number and "Effective" date at the top of this page reflect the current version. Material changes will be communicated by email to registered users at least 14 days in advance.

Contact

For privacy-related questions or requests:

• Email: privacy@base-ai.app
• Postal: see Imprint for our registered address.

For security vulnerabilities or responsible disclosure: Security page.