How BASE handles your data: permission-first agent sharing, encryption at rest, EU residency, full GDPR rights.
This policy describes how TRADE ESTATE SE (hereinafter "BASE", "we", "our") collects, uses and protects your personal data when you use the BASE service at app.base-ai.app and the marketing site at www.base-ai.app.
BASE is the data controller for personal data you provide when using our service, as defined under the EU General Data Protection Regulation (GDPR).
Company information and legal contact: see Imprint.
Email, name, interface language, country, currency and account settings you choose. Authentication credentials (password) are stored as a salted hash and never readable in plaintext.
Content you create or upload to BASE: tasks, documents, receipts, expenses, wellness notes, call preparation, agent messages, goals and check-ins. This data is stored in the agent's permission-scoped surface and is not visible to other agents unless you confirm a hand-off.
When you upload a document, photo or scan, BASE stores the original file together with extracted text and metadata (title, dates, parties, amounts) needed to make it searchable.
If you use the Action agent's call features, we store: the call brief you authored, the transcript, call outcome and summary. Voice recordings, where retained, are encrypted at rest and scoped strictly to the Action agent.
Standard log data (IP address, user agent, timestamps, request paths) used for reliability, abuse prevention, security monitoring and customer support. Stored for a limited operational window (typically up to 90 days).
BASE never sells your data to advertisers, brokers, or third parties.
BASE is built around the principle that each agent operates as a separate permission surface.
The six core agents — Document, Finance, Wellness, Organizer, Mentor, Action — handle different categories of sensitive personal information. Sensitive details from one agent's scope are not passed to another agent automatically. Cross-agent hand-offs (for example: "Finance found a recurring payment, should it become an Organizer reminder?") only occur after you explicitly confirm the action in the app.
We process your personal data on the following legal bases:
Where we process special category data such as health information (Wellness agent), the processing is based on your explicit consent (Art. 9(2)(a)). You can withdraw that consent and delete the data at any time from Profile.
BASE uses third-party service providers to deliver the service. Each is contractually bound to handle your data only on our instructions and to maintain appropriate security and confidentiality.
Current categories of sub-processors:
A current sub-processor list is available on request to privacy@base-ai.app. We will publish the full list publicly before general availability launch.
BASE infrastructure is primarily hosted within the European Union. Where data is transferred to a sub-processor outside the EU/EEA, we rely on:
We retain personal data only as long as necessary for the purposes described above, or as required by law.
When you delete your account from Profile, your active content is removed promptly. Some backup copies may persist for a limited window (up to 30 days) before being permanently erased.
You have the following rights regarding your personal data:
To exercise these rights, use the relevant controls in Profile, or contact privacy@base-ai.app.
BASE is intended for users 18 years or older. We do not knowingly collect personal data from children under 16 without parental consent. If we become aware that we have inadvertently collected such data, we will delete it promptly.
We may update this Privacy Policy from time to time. The version number and "Last updated" date at the top of this page reflect the current version. Material changes will be communicated by email to registered users at least 14 days in advance.
For privacy-related questions or requests:
For security vulnerabilities or responsible disclosure: Security page.
