Privacy Policy – baseplan.ai
1. Who is responsible. baseplan.ai is operated by Etrog, a sole proprietorship registered in Israel, 139 Keren Kayemet LeIsrael St., Be'er Sheva, Israel. Etrog is the controller of the account, usage and billing data described here. For the plans, models and other files a customer uploads, the customer is the controller and Etrog processes them on its behalf under the Data Processing Agreement. Privacy requests: privacy@baseplan.ai.
2. What we collect.
- Account: your name, your e-mail address, your password (stored only as a one-way hash), your two-step verification secret and recovery codes, your role and title in the company, your language, and your licence number if you enter one.
- Company: the company's name, logo, title block and settings.
- Project content: the files your company uploads and the outputs made from them. They may include names or contact details of people that appear in drawings or title blocks.
- Usage and security: the actions you take in projects (activity log), usage meters for billing, sign-in events, IP address and browser type in security logs, and error reports.
- Support and feedback: the messages and the feedback you send us, including a screenshot if you choose to add one.
- Billing: the plan, the payment status, the invoice references and the billing contact. Payment details are handled by Paddle, our reseller. We never receive card details.
- Sign in with Google (if you choose to use it): your name and e-mail address from Google.
3. Why we use it, and on what legal basis.
- To provide the Service, which means accounts, projects, processing and support. Basis: the contract with your company.
- To secure accounts and the Service and to prevent abuse. Basis: our legitimate interest in a secure service.
- To bill the company and to keep records required by law. Basis: the contract and our legal obligations.
- To improve the Service through non-identifying operational signals. Basis: our legitimate interest. Your company's administrator can turn them off.
- To keep projects as test cases. Basis: only with the company's separate consent.
- To send service e-mails, such as invitations, sign-in links, password resets, run results and billing notices. Basis: the contract. We do not send marketing e-mails without consent.
4. Improving the Service. Learning events are kept under a masked identifier, not under your name. The analysis is about the system, not about people. It is never shown to your company as a measure of an employee. We do not train general AI models on customer content, and we do not allow our AI providers to do so.
5. Who receives it. We share data only with the service providers that run the Service for us (our sub-processors), under contracts that protect it. Each one is listed, with what it does and where it processes data, on the sub-processors page. We also share data with Paddle as our reseller, and with authorities where the law requires it. We do not sell personal data.
6. Where it is processed. Our servers, database and file storage are in the European Union, in Google Cloud. Some providers process data outside the EU:
- the main AI provider, in the United States;
- the drawing-processing provider, in the United States;
- e-mail services.
Transfers outside the EU are protected by the EU Standard Contractual Clauses or by the EU–US Data Privacy Framework, where the provider is certified. Israel, where Etrog is located, has an adequacy decision of the European Commission and of the UK.
7. How long we keep it.
- Account data: as long as the account is active, and 90 days after you are removed from every company.
- Projects moved to the trash: deleted after 30 days.
- A closed company: its data can be exported for 30 days and is then deleted.
- Activity log and learning events: 24 months.
- Feedback screenshots: 90 days.
- Security and server logs: up to 30 days.
- Database backups: up to 7 days. Deleted files can be recovered for up to 30 days.
- Billing records: as long as tax and accounting law requires.
8. Cookies. The Service uses one strictly necessary sign-in cookie, valid for one working day. During a visit it keeps the page you were on in the browser's temporary session storage. We use no advertising or analytics cookies, and the website baseplan.ai sets no cookies. The payment window is provided by Paddle, which may set its own cookies needed for payment.
9. Security. All traffic is encrypted, and data is encrypted at rest. Every user must use two-step verification. Passwords are hashed. Access to data is limited by company and by role. The security measures are described in the DPA.
10. Your rights. Depending on the law that applies to you (for example the GDPR, the UK GDPR or the Israeli Privacy Protection Law), you may ask to access, correct, delete, restrict or export your personal data, or object to its use. Write to privacy@baseplan.ai. We answer within 30 days. If your data is part of a customer's project content, we will pass your request to that customer as the controller. You may also complain to your data protection authority. In Israel, that is the Privacy Protection Authority.
11. Children. The Service is for professionals and is not intended for anyone under 18.
12. Changes. We will announce material changes to this policy by e-mail or in the Service. The version and date are shown at the top. The English text prevails over any translation.