Privacy Policy
base0 is a document signing and workflow platform operated from India. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our services at base0.tech.
We operate as both a Data Controller (for account data) and a Data Processor (for document and signer data on behalf of our customers). Where we process data on behalf of a Customer, our Data Processing Agreement (DPA) governs that processing.
1. Who This Policy Covers
This policy applies to:
- Account holders ("Senders") — individuals or businesses who create a base0 account to send documents for signing.
- Signers — individuals who receive and sign documents through base0. Signers do not create accounts but their data is processed through our platform.
- Website visitors — individuals who visit base0.tech without creating an account.
If you are a Signer, the organization or individual who sent you a document for signing is the Data Controller of your signing data. You should contact them with questions about their data practices. base0 processes your data on their behalf as a Data Processor.
2. What Data We Collect
2.1 Account Holders (Senders)
- Identity data: name, email address
- Account credentials: hashed password
- Billing data: payment method details processed by Dodo Payments (base0 does not store full card numbers)
- Usage data: login timestamps, IP addresses, browser type, device information
- Document metadata: document names, recipients, status, timestamps
2.2 Signers
- Identity data provided by the Sender: name, email address, phone number (if SMS used)
- Signing data: signature image or typed signature, signing timestamp, IP address, device and browser metadata
- Consent record: timestamp of consent screen acceptance
- Audit trail data: document opened timestamp, signing completion timestamp
2.3 Document Content
base0 stores the content of documents uploaded by Senders and signed by Signers. base0 does not read, analyze, or use the content of your documents for any purpose other than providing the signing service. Document content may include personal data of individuals named within documents — this data is controlled by the Sender.
2.4 Data We Do Not Collect
- We do not use third-party tools for monitoring.
- We do not track users across third-party websites.
- We do not sell personal data to any third party.
- We do not collect data for advertising purposes.
3. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Contract performance |
| Sending documents and signing links via email/SMS | Contract performance |
| Processing payments | Contract performance |
| Maintaining audit trails and document records | Legal obligation + Legitimate interest |
| Ensuring platform security and preventing fraud | Legitimate interest |
| Responding to support requests | Legitimate interest |
| Complying with legal obligations | Legal obligation |
| Notifying you of service updates or changes | Legitimate interest |
4. Data Storage and Retention
Your data is stored on the following infrastructure:
- Documents and files: AWS S3 (Amazon Web Services), encrypted at rest using AES-256.
- Account and signing data: NeonDB (PostgreSQL), hosted on Neon Technologies infrastructure.
- Emails: Delivered via Resend Inc. Resend does not store the content of emails beyond delivery.
4.1 Retention Periods
| Data Type | Retention Period |
|---|---|
| Signed documents and files | Indefinitely until Sender requests deletion or account is deleted |
| Account data (Sender) | For the duration of the account + 30 days after deletion |
| Signer signing records | Same duration as the associated document |
| Audit logs | Same duration as the associated document |
| Payment records | 7 years (as required by financial regulations) |
| Backups | Purged within 90 days of account deletion |
5. Data Sharing
We share personal data only in the following circumstances:
- Authorized Sub-Processors: We share data with the third-party services listed in our DPA (base0.tech/dpa) to operate the platform. These include AWS (storage/hosting), NeonDB (database), Resend (email), and Dodo Payments (billing).
- Legal requirements: We may disclose data when required by law, court order, or governmental authority.
- Business transfers: In the event of a merger, acquisition, or asset sale, personal data may be transferred. We will provide notice before data is transferred and subject to a different privacy policy.
We never sell personal data. We never share data with advertisers or marketing platforms.
6. International Data Transfers
base0 is operated from India. Our infrastructure (AWS, NeonDB) is currently hosted in the United States. By using our services, you acknowledge that your personal data may be transferred to and processed in the United States.
For users in the EU/EEA or UK, we rely on Standard Contractual Clauses (SCCs) as the legal mechanism for international data transfers. Our DPA (base0.tech/dpa) incorporates the EU SCCs by reference.
Customers with EU data residency requirements may contact us at [email protected].
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
| Right | How to Exercise |
|---|---|
| Access | Request a copy of your data by emailing [email protected]. We will respond within 30 days. |
| Erasure | Delete your account from Settings > Account > Delete Account. For signer data erasure, contact [email protected]. |
| Portability | Request an export of your data in machine-readable format by emailing [email protected]. |
| Rectification | Update inaccurate account data from your dashboard, or contact [email protected]. |
| Objection / Restriction | Contact [email protected] with your request and grounds for objection. |
| Withdraw Consent | Where processing is based on consent, you may withdraw it by contacting [email protected]. |
Signers: If you wish to exercise rights over your signing data, contact the organization that sent you the document, as they are the Data Controller. You may also contact us at [email protected] and we will assist in directing your request appropriately.
8. Security
We implement strict security measures to protect your personal data. For detailed information, please review our dedicated Security & Compliance page. Our core security standards include:
- All data in transit is encrypted via HTTPS/TLS.
- Documents stored in AWS S3 are encrypted at rest (AES-256).
- Database is encrypted at rest via NeonDB.
- Signed documents receive a SHA-256 cryptographic hash to ensure tamper-evidence.
- Access to production systems is restricted to authorized personnel.
- All document events are logged in a tamper-evident audit trail.
While we take all reasonable precautions, no system is completely immune to security risks. In the event of a data breach that affects your personal data, we will notify you within 48–72 hours of becoming aware.
9. Cookies
base0 uses only essential session cookies required for authentication and platform functionality. We do not use advertising, tracking, or analytics cookies. No cookie consent banner is required for essential cookies, but we disclose their use here for transparency.
10. Children's Privacy
base0 is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor's data has been submitted to our platform, contact [email protected] and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered account holders at least 14 days before taking effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy. The current version will always be available at base0.tech/privacy.
12. Contact
For any privacy-related questions, data requests, or concerns:
- Email: [email protected]
- Address: India
We aim to respond to all privacy inquiries within 5 business days and to fulfill all data requests within 30 days.