Privacy Policy

1. Information We Collect

We collect the following information when you use Basely:

• Registration data: name, email and password (encrypted)
• Usage data: sites created, edits made and platform interactions
• Payment data: processed directly by Stripe - we do not store card data
• Technical data: IP address, browser type, operating system and cookie data
• Browsing and source on public pages: only if you click "Accept all" on the cookie notice. We record the Basely pages you visit, the type of device, the campaign you came from (the utm parameters of the link) and, if you create an account, that the visit led to the signup. We use a random identifier in a secure cookie and we do not keep your IP address or your browser in these records.

2. How We Use Your Information

We use your data to:

• Provide and maintain our services
• Process payments and manage subscriptions
• Send communications about your account and service updates
• Improve our products and user experience
• Ensure platform security

3. Data Sharing

We do not sell your personal information. We share data only with:

• Stripe: for payment processing
• Infrastructure providers: for hosting and service delivery
• AI providers: for content generation (anonymized data)
• Legal authorities: when required by law
• Google (Google Analytics), Meta (pixel) and Microsoft (Clarity): on Basely public pages, and only after you click "Accept all", to measure visits and ads. Microsoft Clarity records how the page is used (clicks, scrolling and movement), with all text and form fields masked.
• Google Ads and Meta Ads, ad conversions: if you came through one of our ads, accepted "all" and later paid for a plan, we may tell that platform the ad led to a sale, using only the click identifier, the amount and the currency. We never send your name, email or IP address. Each send is approved manually by our team.
• Cloudflare (Turnstile): on funnel forms and surveys, an invisible check confirms the sender is not a bot. Cloudflare handles the signals from this check under the Turnstile Privacy Addendum.

Global Privacy Control (GPC) signal: if your browser sends the GPC signal, we treat it as an opt-out of sharing. We do not load Google Analytics, the Meta pixel or Microsoft Clarity, we do not keep ad click identifiers and we do not send conversions to any platform, even if you clicked "Accept all".

4. Storage and Security

Your data is stored on secure servers with encryption in transit (TLS) and at rest. Passwords are stored using bcrypt hashing. We implement technical and organizational security measures to protect your information.

5. Cookies

We use essential cookies for platform operation, including session authentication and language preferences. On the public pages of baselyapp.com, and only if you click "Accept all" in the cookie notice, we also use Google Analytics 4, the Meta pixel and Microsoft Clarity to measure visits, page usage and the results of our ads. These tools never run inside your panel or on the sites you publish, and you can change your choice at any time by clearing the site data in your browser. see the full cookie list.

5.1 Legal bases for processing

Under LGPD Art. 7º and similar US frameworks, we process your data on the following legal bases:

• Contract performance: to deliver the services you signed up for (Art. 7º §V LGPD).
• Consent: marketing emails, non-essential cookies and measuring browsing on Basely public pages (pages visited, source, page tests and usage signals), as well as sending ad conversions (Art. 7, I, LGPD).
• Legitimate interest: understanding where Basely accounts come from and how they use the platform (signup, product usage and plan payments), with pseudonymized data kept for the period in the retention section; fraud prevention and security (Art. 7, IX, LGPD). You can object to this processing through the data rights form.
• Legal obligation: tax records, anti-money-laundering, court orders (Art. 7º §II LGPD).
• Pre-contractual measures: handling signup attempts and quotes (Art. 7º §V LGPD).

What we keep on the server you buy

When you buy a server (VPS) at Basely, we install a platform agent on it at delivery and keep a support account with administrative access. We say this plainly because you have the right to know exactly what is on your machine.

• The agent reports the machine state (running, stopped, processor, memory, disk and network usage) and carries out the actions you request from the dashboard: start, stop, deploy, back up, change the root password.
• The agent does NOT read the contents of your files, your database or your applications' traffic.
• There is a support account on the server, with privileged access, used for diagnostics and for the actions you request. Every access is logged.
• If you would rather have a server without our agent and without our key, talk to us before buying. In that case the dashboard can no longer operate the machine.

5.2 Sub-processors (third parties)

We use carefully selected sub-processors to operate the service (payments, infrastructure, AI providers). A complete and up-to-date list is published at /sub-processors.

5.3 International data transfers

Some of our sub-processors are hosted in countries other than your own, including the USA and Singapore. Where the destination country does not have an ANPD (Brazilian Data Protection Authority) adequacy decision, we rely on standard contractual clauses or your explicit consent (LGPD Art. 33–36).

SMS and mobile information

If you give us your mobile number and tick the SMS consent box in your account, we use it only to send you alerts about your own account and your orders. Your mobile opt-in data and consent will not be shared with any third parties or affiliates for marketing or promotional purposes, and they are not sold. Text messaging originator opt-in data and consent are excluded from every category of information shared with third parties described in this policy. You can withdraw consent at any time by unticking the box in your account settings or by replying STOP to any message.

Bank data in Desk Money (via Plaid)

If you connect your business bank account to Desk Money, the connection is made by Plaid Inc. You type your bank login only inside the Plaid window; it never reaches Basely. By connecting, you allow Plaid to collect your data from your bank as described in Plaid's End User Privacy Policy, and Basely receives only what is described below.

• What we receive: the list of accounts you choose to connect (name, type and the last four digits) and their transactions (date, amount, description and merchant), plus an access token that lets us fetch new transactions.
• What we use it for: only to keep your business's books (categorizing, reconciling, month-end close and tax reports), for you and for the people you give access to, such as your accountant. We do not sell or share it for marketing.
• Automatic categorization: to suggest a category, we send the description and the amount of a transaction, with no name, account number or login, to our AI provider Moonshot AI, listed among our sub-processors.
• Protection: the access token is encrypted with AES-256-GCM using a key derived for each business, is never shown in any screen or API, and is deleted the moment you disconnect the bank.
• Retention and deletion: transactions stay in your books while you keep using Desk Money, because they are your accounting records. Disconnecting the bank stops new data. If you delete your account, every bank connection of the businesses you own is disconnected and its token is deleted, and you can ask us to delete your business's financial data at any time.

Read Plaid's End User Privacy Policy

Data from Google accounts

When you connect a Google account to Basely, we receive only what the feature you turned on needs:

• Sign in with Google: your name, email and profile photo, to create and identify your account.
• Google Calendar in Bmail (calendar.events scope): we read the events of your primary calendar to show them next to your emails, and we create an event only when the mailbox owner clicks to do so. We do not access other calendars or any other account data.
• YouTube, Google Business Profile and Google Ads, in Social: we publish to your own channel and profile what you approved, reply to reviews when you ask, and show your campaign metrics read-only, without changing anything in them.
• Access tokens are encrypted, never shared with third parties, and you can disconnect at any time, in the Basely service itself or in your Google account settings.

Basely's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising or to train artificial intelligence models, and no one on our team reads it, except with your permission, for security or when required by law.

Google API Services User Data Policy

6. Your Rights

You have the right to:

• Access your personal data
• Correct incorrect information
• Request deletion of your data
• Export your data in a readable format
• Revoke consent for data processing
• Lodge a complaint with the supervisory authority (Brazil: ANPD; USA: state Attorney General).

We answer within 15 days. For access or portability requests, after we confirm the request, we send to your account email a link to download a file with the data we keep about you. The link works once, is valid for 72 hours and only opens when signed in to the same account. If you do not have an account, we answer by email.

To exercise any of these rights, please contact us at your account settings , submit a request at /dsr or email us at privacy@baselyapp.com.

6.1 Data Protection Officer (Encarregado)

Under LGPD Art. 41, our Data Protection Officer (Encarregado pelo Tratamento de Dados) can be reached at privacy@baselyapp.com.

6.2 California Notice: Do Not Sell or Share My Personal Information

We do NOT sell your personal information in the traditional sense. We may share it with sub-processors strictly to operate the service. Under CCPA/CPRA §1798.135, California residents may exercise the right to opt out of cross-context behavioral advertising at any time. Exercise your CCPA opt-out.

7. Data Retention

We keep your data while your account is active, with these periods: browsing and source on public pages (only with "Accept all"), up to 90 days; the source of your signup, up to 90 days; ad click identifier, up to 30 days; payment records (amount, currency, date and product), 5 years, for tax and accounting obligations. After the account is closed, your data is deleted within 30 days, except payment records, which are kept for 5 years without any link to you: we replace your identification with a random code that cannot be reversed and keep only the numbers. When you withdraw consent on the cookie notice, we delete your browsing data and keep only a record that you withdrew, so we do not measure again.

8. Minors

Basely is not intended for minors under 18 years of age. We do not intentionally collect data from minors. If we identify that we have collected data from a minor, it will be deleted immediately.

9. Changes to This Policy

We may update this policy periodically. Significant changes will be communicated by email. We recommend reviewing this page regularly.

10. Contact

For privacy questions, please contact us at privacy@baselyapp.com.