Privacy Policy

This Privacy Policy ("Policy") explains how BaseDynamics Inc. and its affiliates ("BaseDynamics," "We," "Us," "Our") collect, use, disclose, and protect Personal Data of natural persons described in Section 2 below ("You"), when We act as a Controller.

Capitalized terms not defined here have the meaning given in Our Terms of Service.

1. Definitions

• "Controller" means the entity that determines the purposes and means of Processing Personal Data.
• "Customer" means the business or individual that has subscribed to the Services under an Order Form or the Terms.
• "End-User" means an individual, other than a Customer or User, whose data is transmitted by or on behalf of a Customer to the Services.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Process" / "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Services" means BaseDynamics' cloud-based customer intelligence platform, including its AI-driven agents, and any related websites, applications, and documentation.
• "User" means an individual authorized by a Customer to access the Services on the Customer's behalf.

2. Personal Data We Collect

2.1 Data You Provide Directly.

This may include: name, work email, phone number, job title, company name, billing information, account credentials, and content of communications (e.g., support tickets, demo requests, survey responses).

2.2 Data Collected Automatically.

When You visit Our website or use the Services, We may automatically collect: IP address, browser and device information, log data, cookies and similar identifiers, and usage data (e.g., pages visited, features used, session duration).

2.3 Data From Third Parties.

We may receive limited data about You from business partners, data enrichment providers, or publicly available sources for sales and marketing purposes.

If You provide Us with Personal Data about another individual, You confirm You have the authority and, where required, consent to do so.

3. How We Use Personal Data

We use Personal Data to:

1. provide, operate, and improve the Services;
2. create and manage accounts;
3. communicate with You, including for support and product updates;
4. process payments;
5. conduct marketing, subject to Your opt-out rights;
6. ensure security and prevent fraud;
7. comply with legal obligations; and
8. enforce Our agreements.

4. How We Share Personal Data

We may share Personal Data with:

1. service providers and sub-processors who support Our operations (e.g., cloud hosting, analytics, payment processing, customer support, AI-model providers);
2. professional advisors (legal, accounting, audit);
3. an acquirer or successor in connection with a merger, financing, or sale of assets;
4. law enforcement or regulators where required by law; and
5. other parties with Your consent.

Our current AI-model sub-processors are listed in Our Data Processing Agreement. We may engage additional AI-model providers in the future (which may include providers such as Google or xAI) to support the Services; any such addition will be announced and made available in accordance with the sub-processor notification process described in the DPA.

We do not sell Personal Data.

5. Legal Basis for Processing (EEA/UK/Switzerland)

Where the GDPR or UK GDPR applies, We rely on one or more of the following legal bases: performance of a contract, Our legitimate interests (e.g., improving and securing the Services), compliance with a legal obligation, or Your consent. Where We rely on consent, You may withdraw it at any time without affecting the lawfulness of prior Processing.

6. International Data Transfers

We are based in the United States and primarily Process Personal Data in the US, including on infrastructure hosted on AWS (US region). Where We transfer Personal Data originating from the EEA, UK, or Switzerland to a jurisdiction not deemed adequate, We rely on appropriate safeguards, including the Standard Contractual Clauses, as further described in Our Data Processing Agreement.

7. Data Security

We implement technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. BaseDynamics is currently pursuing SOC 2 and ISO 27001 certification; until such certifications are obtained, We do not represent that they have been achieved. Details of Our security program are available on request.

8. Data Retention

We retain Personal Data for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce Our agreements. Upon expiration of the applicable retention period, We will delete or anonymize the Personal Data, or isolate it from further Processing if deletion is not immediately possible.

9. Your Privacy Rights

Subject to applicable law, You may have the right to:

1. access the Personal Data We hold about You;
2. correct inaccurate data;
3. request deletion;
4. object to or restrict certain Processing;
5. request portability of Your data; and
6. withdraw consent where Processing is based on consent.

You may exercise these rights by contacting us at privacy@basedynamics.com. We will verify Your request and respond within the timeframe required by applicable law. We will not discriminate against You for exercising these rights. You also have the right to lodge a complaint with Your local data protection authority.

10. California Privacy Rights

If You are a California resident, the California Consumer Privacy Act (as amended by the CPRA) may give You additional rights, including the right to know, delete, correct, and opt out of the sale or sharing of Personal Information. We do not sell or share Personal Information as those terms are defined under the CCPA/CPRA. To exercise these rights, contact privacy@basedynamics.com.

11. Cookies

We use necessary, analytics, and preference cookies to operate Our website and understand how it is used. You can manage cookie preferences through Our cookie banner or Your browser settings. Disabling certain cookies may affect site functionality.

12. Children's Privacy

Our Services are intended for business use and are not directed to individuals under the age of 16. We do not knowingly collect Personal Data from children. If We become aware that We have inadvertently collected such data, We will take steps to delete it.

13. Customer Data and End-Users

Where BaseDynamics Processes Personal Data on behalf of a Customer as part of Customer Data (e.g., data a Customer uploads or connects via integrations), We act as a Processor, and such Processing is governed by the Data Processing Agreement and the Customer's instructions, not this Policy. End-Users should direct privacy inquiries to the relevant Customer.

14. Google Workspace and Microsoft 365 Integrations

14.1 Overview.

The Services allow a Customer's authorized Users to connect their Gmail/Google Workspace and/or Microsoft 365 (Outlook) mailbox and calendar to BaseDynamics via OAuth. If you choose to connect an account, BaseDynamics accesses only the data described below, and only for the purposes described below.

14.2 Scopes Requested.

• Google: userinfo.email.openid, gmail.readonly, gmail.send, calendar.events
• Microsoft: offline_access, User.Read, Mail.Read, Mail.Send, Mail.Read.Shared, Mail.Send.Shared, Calendars.ReadWrite

14.3 What We Access and Why.

With Your authorization, BaseDynamics accesses email content and calendar data (including meeting details and attendee information) belonging to Users connected to a BaseDynamics Customer account, in order to:

1. analyze email content relevant to that Customer's business relationships to surface Topic, Sentiment, Intent, Keyphrase, and Competitor-mention insights as part of the Customer Voice feed;
2. send email on Your behalf where You direct the Services to do so (e.g., through an AI agent action); and
3. read and schedule calendar meetings, including with attendees, at Your direction.

This access is limited to mailboxes and calendars connected by BaseDynamics Customers and Users. We do not access or scan the inbox or calendar of any individual who is not a connected User, and We do not process an entire connected inbox indiscriminately; analysis is limited to messages and events relevant to the connected Customer's use of the Services.

14.4 AI Processing.

Email content You authorize Us to access may be sent to Our AI sub-processors (currently OpenAI and Anthropic; see Data Processing Agreement Section 6 for the current list) solely to power the Customer Voice and related features for Your account. This processing is not used to train general-purpose AI models, and is not used for advertising.

14.5 Storage.

Email content and calendar data (including meeting details and attendees) accessed through these integrations are stored on Our infrastructure (hosted on AWS) as part of the Customer Voice feed and related features, for as long as described in Section 8 (Data Retention) or until the integration is disconnected and any applicable deletion request is processed.

14.6 No Human Access; No Sale.

No BaseDynamics employee accesses the content of Your connected email or calendar as part of ordinary operations. We do not sell Google or Microsoft user data, and We do not use it for advertising or unrelated purposes.

14.7 Limited Use Disclosure.

BaseDynamics's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

14.8 Disconnecting.

You may disconnect Your Google or Microsoft account from the Services at any time through Your account settings, which revokes Our access going forward. To request deletion of previously accessed email or calendar data, contact privacy@basedynamics.com.

15. Links to Other Websites

Our website may link to third-party sites. This Policy does not apply to those sites, and We encourage You to review their privacy practices independently.

16. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated through the Services or by other reasonable means. The "Last Updated" date above indicates when this Policy was last revised.

17. Contact Us

Questions or requests regarding this Policy or Our data practices can be directed to:

BaseDynamics Inc.
16192 Coastal Hwy, Lewes, DE 19958
Email: privacy@basedynamics.com