Privacy Policy

1. Information We Collect

We collect the following information when you use Basely:

• Registration data: name, email and password (encrypted)
• Usage data: sites created, edits made and platform interactions
• Payment data: processed directly by Stripe - we do not store card data
• Technical data: IP address, browser type, operating system and cookie data

2. How We Use Your Information

We use your data to:

• Provide and maintain our services
• Process payments and manage subscriptions
• Send communications about your account and service updates
• Improve our products and user experience
• Ensure platform security

3. Data Sharing

We do not sell your personal information. We share data only with:

• Stripe: for payment processing
• Infrastructure providers: for hosting and service delivery
• AI providers: for content generation (anonymized data)
• Legal authorities: when required by law

4. Storage and Security

Your data is stored on secure servers with encryption in transit (TLS) and at rest. Passwords are stored using bcrypt hashing. We implement technical and organizational security measures to protect your information.

5. Cookies

We use essential cookies for platform operation, including session authentication and language preferences. On the public pages of baselyapp.com, and only if you click "Accept all" in the cookie notice, we also use Google Analytics 4 and the Meta pixel to measure visits and the results of our ads. These tools never run inside your panel or on the sites you publish, and you can change your choice at any time by clearing the site data in your browser. see the full cookie list.

5.1 Legal bases for processing

Under LGPD Art. 7º and similar US frameworks, we process your data on the following legal bases:

• Contract performance: to deliver the services you signed up for (Art. 7º §V LGPD).
• Consent: for marketing emails, optional analytics and any non-essential cookie (Art. 7º §I LGPD).
• Legitimate interest: fraud prevention, security (Sentry error tracking), aggregated product analytics (Art. 7º §IX LGPD).
• Legal obligation: tax records, anti-money-laundering, court orders (Art. 7º §II LGPD).
• Pre-contractual measures: handling signup attempts and quotes (Art. 7º §V LGPD).

What we keep on the server you buy

When you buy a server (VPS) at Basely, we install a platform agent on it at delivery and keep a support account with administrative access. We say this plainly because you have the right to know exactly what is on your machine.

• The agent reports the machine state (running, stopped, processor, memory, disk and network usage) and carries out the actions you request from the dashboard: start, stop, deploy, back up, change the root password.
• The agent does NOT read the contents of your files, your database or your applications' traffic.
• There is a support account on the server, with privileged access, used for diagnostics and for the actions you request. Every access is logged.
• If you would rather have a server without our agent and without our key, talk to us before buying. In that case the dashboard can no longer operate the machine.

5.2 Sub-processors (third parties)

We use carefully selected sub-processors to operate the service (payments, infrastructure, AI providers). A complete and up-to-date list is published at /sub-processors.

5.3 International data transfers

Some of our sub-processors are hosted in countries other than your own, including the USA and Singapore. Where the destination country does not have an ANPD (Brazilian Data Protection Authority) adequacy decision, we rely on standard contractual clauses or your explicit consent (LGPD Art. 33–36).

SMS and mobile information

If you give us your mobile number and tick the SMS consent box in your account, we use it only to send you alerts about your own account and your orders. Your mobile opt-in data and consent will not be shared with any third parties or affiliates for marketing or promotional purposes, and they are not sold. Text messaging originator opt-in data and consent are excluded from every category of information shared with third parties described in this policy. You can withdraw consent at any time by unticking the box in your account settings or by replying STOP to any message.

Bank data in BDesk Money (via Plaid)

If you connect your business bank account to BDesk Money, the connection is made by Plaid Inc. You type your bank login only inside the Plaid window; it never reaches Basely. By connecting, you allow Plaid to collect your data from your bank as described in Plaid's End User Privacy Policy, and Basely receives only what is described below.

• What we receive: the list of accounts you choose to connect (name, type and the last four digits) and their transactions (date, amount, description and merchant), plus an access token that lets us fetch new transactions.
• What we use it for: only to keep your business's books (categorizing, reconciling, month-end close and tax reports), for you and for the people you give access to, such as your accountant. We do not sell or share it for marketing.
• Automatic categorization: to suggest a category, we send the description and the amount of a transaction, with no name, account number or login, to our AI provider Moonshot AI, listed among our sub-processors.
• Protection: the access token is encrypted with AES-256-GCM using a key derived for each business, is never shown in any screen or API, and is deleted the moment you disconnect the bank.
• Retention and deletion: transactions stay in your books while you keep using BDesk Money, because they are your accounting records. Disconnecting the bank stops new data. If you delete your account, every bank connection of the businesses you own is disconnected and its token is deleted, and you can ask us to delete your business's financial data at any time.

Read Plaid's End User Privacy Policy

6. Your Rights

You have the right to:

• Access your personal data
• Correct incorrect information
• Request deletion of your data
• Export your data in a readable format
• Revoke consent for data processing
• Lodge a complaint with the supervisory authority (Brazil: ANPD; USA: state Attorney General).

To exercise any of these rights, please contact us at your account settings , submit a request at /dsr or email us at privacy@baselyapp.com.

6.1 Data Protection Officer (Encarregado)

Under LGPD Art. 41, our Data Protection Officer (Encarregado pelo Tratamento de Dados) can be reached at privacy@baselyapp.com.

6.2 California Notice: Do Not Sell or Share My Personal Information

We do NOT sell your personal information in the traditional sense. We may share it with sub-processors strictly to operate the service. Under CCPA/CPRA §1798.135, California residents may exercise the right to opt out of cross-context behavioral advertising at any time. Exercise your CCPA opt-out.

7. Data Retention

We keep your data while your account is active. After account closure, your data is deleted within 30 days, except when retention is necessary due to legal obligations or for dispute resolution.

8. Minors

Basely is not intended for minors under 18 years of age. We do not intentionally collect data from minors. If we identify that we have collected data from a minor, it will be deleted immediately.

9. Changes to This Policy

We may update this policy periodically. Significant changes will be communicated by email. We recommend reviewing this page regularly.

10. Contact

For privacy questions, please contact us at privacy@baselyapp.com.