# Privacy Policy

> What personal data SeedBasis collects, why, who receives it, how long it is kept, and how to use your rights.

Last updated: 2026-10-23. Canonical page: https://seedbasis.com/legal/privacy

Effective 28 September 2026.

## The short version

- We use your idea, or the company you run, and your answers to research it for you. Nobody at SeedBasis reads them to run the service.
- The research and SeedBasis Agent run on AI models from Google and xAI, and on an open model run for us by Fireworks AI and Together AI, all reached through OpenRouter and all in the United States. Before a report's decision pages are written, Anthropic's model checks the claims they rest on against web pages read that day, and Anthropic deletes those requests within 30 days. When you talk with a report, ElevenLabs turns your voice into text and the agent's answers into speech, and we keep the words, never the recording. Public data sources receive search terms derived from your idea, never the idea text itself; for a company you run, also its name and website, which are public, and never the figures or documents you give us.
- We do not sell your data, use it for advertising, or train AI models on it.
- Analytics cookies load only if you allow them, and only on our public marketing pages, never inside the app. Inside the app we keep a record of which parts you use and when, on our own server and without cookies, never what you write about your idea or your company.
- You can export your data, or delete your account and everything in it, from Settings at any time.

## 1. Who is responsible for your data

The controller of your personal data is SeedBasis, LLC, a Delaware limited liability company founded and run by Efe Adiguzel, which runs SeedBasis. Contact us about privacy at privacy@seedbasis.com.

| Where you are | Who to contact |
| --- | --- |
| Canada, including Quebec | Our person in charge of the protection of personal information, Efe Adiguzel, at privacy@seedbasis.com |
| Everywhere else | Us, at privacy@seedbasis.com |

## 2. What we collect and why

Each row shows a kind of data, why we use it, and its legal basis under the EU and UK GDPR. Where we rely on legitimate interests, the interest is the purpose in the same row. People in other countries have the same protections in practice: we use each kind of data only for the purposes shown.

| Data | Why we use it | Legal basis under the EU and UK GDPR |
| --- | --- | --- |
| **Account:** email address, name if you add one, password hash, whether your email is confirmed, whether two-factor authentication is on, the Terms version you accepted and when, and when you confirmed you are 18 or older | To create and run your account, sign you in, and contact you about it | Contract, Art. 6(1)(b) |
| **Google or Apple sign-in:** the account identifier, name, email address (with Apple, possibly a private relay address) and profile picture link that Google or Apple shares, and sign-in tokens, stored encrypted | To let you sign in with Google or Apple and connect that sign-in to your account | Contract, Art. 6(1)(b) |
| **Two-factor authentication:** your authenticator secret and backup codes, stored encrypted | To ask for a second step at sign-in, if you turn it on | Contract, Art. 6(1)(b) |
| **Security records:** sessions (a session token, IP address and browser user agent); a log of security events (the action, a coarse device description such as “Chrome on macOS”, and a keyed hash of your network prefix rather than your IP address); failed sign-in counters keyed by a keyed hash of your email address; rate-limit counters. When you choose a password, we check it against Have I Been Pwned's list of breached passwords by sending only the first five characters of a one-way hash of it; the password itself never leaves our server | To keep accounts and the service secure: spot unfamiliar sign-ins, slow down password guessing, stop abuse and investigate incidents | Legitimate interests, Art. 6(1)(f) |
| **Bot check:** when Cloudflare Turnstile runs (at sign-up and password reset, and at sign-in after repeated failures), Cloudflare processes your IP address, TLS fingerprint, browser user agent and our site key | To stop automated sign-ups, abuse of forms and password guessing | Legitimate interests, Art. 6(1)(f) |
| **Your country and region:** the country, and for some countries the region, your connection comes from, as our network provider reports it. Not stored | To keep the service out of places where it is not offered, such as places under sanctions | Legal obligation, Art. 6(1)(c), where sanctions law applies; otherwise legitimate interests, Art. 6(1)(f) |
| **Onboarding answers:** your idea, its stage, what you most need to know, who has the problem, your skills and assets, budget, time, target market, and anything else you add | To research your idea and fit the report to your situation | Contract, Art. 6(1)(b) |
| **A company's answers:** for a report about a company you run, its name and website, what it sells and to whom, its size in bands, where it sells, what it most needs, what is not working, the competitors you know, and any figures you type | To research the company and fit the report to it. The figures you type are read only by the sections on the company's numbers | Contract, Art. 6(1)(b) |
| **Documents you attach to a company report:** any P&L, balance sheet, list of figures, export or other document you attach while answering its questions, kept as you sent it, and the text we read out of it on our own server. Until the report starts they wait with your account; once it starts they are the report's | To let the sections on the company's numbers read them. Only you can see them, they are never used to train a model, and they go when the report or your account goes. Please leave out what the report does not need, such as names, salaries or customer lists | Contract, Art. 6(1)(b) |
| **Unfinished answers:** the answers to a new report's questions you have given but not yet started a report from, kept with your account so you can pick up on another device or after closing the tab. Only you can read them, and they are never put in a web address | To let you finish a report you paid for where you left off | Contract, Art. 6(1)(b) |
| **Reports:** findings, charts and tables with their sources, every revision including the original research, your notes, what you record a report's tests found, and the numbers you try on its numbers page | To deliver and store your reports, let you edit them, and keep the archive of the original research | Contract, Art. 6(1)(b) |
| **Pictures and drawings you add:** any picture you paste, drop or choose on a report page, and anything you draw over a page with the pen, kept with that report | To show them on your page and in the PDF you download. Only you can see them, and anyone you give a view-only link to the report while it is on; they are never used to train a model, and they go when the report or your account goes | Contract, Art. 6(1)(b) |
| **A view-only link you turn on:** when you made it and when it ends, and a fingerprint of the link, never the link itself. Anyone who opens it reads that report's pages as your version reads, without your notes, documents, conversations or account; we keep nothing about them beyond a count of pages opened from their network, under a keyed hash rather than their IP address, for an hour or two | To let you show a report to the people you choose, and to stop a link being abused. It ends when you turn it off, when its end date comes, or when the report or your account goes | Contract, Art. 6(1)(b); legitimate interests in protecting the service, Art. 6(1)(f) |
| **Documents you attach for the agent:** any PDF, Word file, spreadsheet, CSV, Markdown or text file you attach to a message, kept as you sent it with the report the conversation is about, and the text we read out of it on our own server | To let the agent read it when you ask about it. Only you can see it, it is never used to train a model, and it goes when the report or your account goes | Contract, Art. 6(1)(b) |
| **Agent conversations:** your messages, the agent's replies, and the proposals it makes that you confirm or dismiss | To answer your questions about your reports and apply the changes you confirm | Contract, Art. 6(1)(b) |
| **Connected assistants:** the assistants you allow, your personal access tokens (stored hashed), and a record of each call an assistant makes: which tool, how it connected and when | To let an assistant you choose read your reports, and change them if you allow it, and to count calls against the monthly allowance | Contract, Art. 6(1)(b) |
| **Purchases:** from Stripe, your Stripe customer reference, what you bought and when, the amount, any discount code used, whether it was refunded, and a record of each payment notification we received. Never your card details | To give you what you paid for, confirm purchases, and keep accounting records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), where EU or UK law requires the record; otherwise legitimate interests in meeting the accounting and tax rules that apply to us, Art. 6(1)(f) |
| **What the agent remembers about you:** short lines it saves from what you tell it about yourself and how you like to work, such as your role or the length of answer you prefer. Never anything about one of your reports, and never passwords, numbers, contact details or sensitive topics. Settings shows every line, where you can delete one, delete all of them or turn memory off | To work with you the way you asked, in every conversation | Contract, Art. 6(1)(b) |
| **Usage and credits:** each AI model call with its token counts and cost, report credit movements, and agent credits used | To apply credits and allowances, prevent abuse, and understand what the service costs to run | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| **What you do in the app:** which parts of SeedBasis you open and use and when, such as how far you got in a new report's questions, which sections of a report you opened, a download, a visit to the agent or feedback sent, and how many times a day. Never what you write: not your idea, your answers, your report's content, your notes or what you ask the agent | To see where SeedBasis is hard to use or where people stop, and fix it | Legitimate interests in improving SeedBasis, Art. 6(1)(f). You can object by writing to us: we then stop keeping this record for your account and delete what it holds |
| **Where you heard about SeedBasis:** your answer to that question, asked once at the end of your first report's questions, with any few words you add; and, only if you allowed analytics cookies, the tag of the link you arrived by, such as a Product Hunt or ad link | To learn which ways of finding SeedBasis work, so we spend where it helps | Legitimate interests in knowing how people find us, Art. 6(1)(f), for your answer, which you can skip; consent, Art. 6(1)(a), for the link's tag |
| **Referrals:** that your account was made through a friend's referral link, and whether your first report earned the reward; for your own link, its code and how many friends joined and bought. Neither friend is shown the other's account | To give you and your friend the agent credits the link offers, and to stop it being abused | Contract, Art. 6(1)(b); legitimate interests in preventing abuse, Art. 6(1)(f) |
| **Whether a report changed what you will do:** your answer to that question for each report, or that you closed it. After a no, what was missing: the choices you pick, and the words you write in the box after them, kept with your answer. Only the SeedBasis owner reads those words, on an admin page that opens only with a code from his authenticator app. Anything you write after another answer is emailed to our team like feedback and is not kept with your account | To know whether reports do their job, and improve them. To delete your words sooner, write to support@seedbasis.com | Legitimate interests in improving SeedBasis, Art. 6(1)(f) |
| **Email:** your address, what we sent, and whether it was delivered | To send account, security, report and billing emails | Contract, Art. 6(1)(b); legal obligation for confirmations consumer law requires, Art. 6(1)(c); legitimate interests for security alerts, Art. 6(1)(f) |
| **News and offers email:** your choice at sign-up or in Settings and when you made it | To send occasional news and offers, only if you switch it on. If you have not started a report yet, they include up to three reminders in your first week, which stop when you start one | Consent, Art. 6(1)(a), and consent under e-marketing rules such as PECR in the UK and CASL in Canada |
| **Offer emails:** the email address you give on our Pricing page to get a 10% code, your code, when we sent it, whether a purchase used it, and whether you ticked the separate box to also get SeedBasis offers | To send you the code you asked for. Offers by email only if you ticked that box: asking for the code alone signs you up to nothing | Your request, Art. 6(1)(b), for the code; consent, Art. 6(1)(a), and consent under e-marketing rules such as PECR in the UK and CASL in Canada, for offers; legitimate interests in giving each person one code, Art. 6(1)(f) |
| **Offers in the app:** after your first report, the offer of 2 more reports: its price, when it ends, whether you closed its banner, and whether you took it | To show you the offer while it lasts, and to remind you by email a day before it ends, only if you agreed to offers by email | Legitimate interests in offering customers more of what they bought, Art. 6(1)(f); for the email, the consent you gave to offers by email |
| **Analytics:** Google Analytics cookie identifiers, the public marketing pages you view, and device and browser details, processed by Google | To understand how visitors use our public marketing pages, only if you allow analytics cookies | Consent, Art. 6(1)(a), with consent for the cookies under ePrivacy rules |
| **Consent and acknowledgement records:** your choices about news and offers by email and analytics cookies, the acknowledgements you tick before checkout, and your confirmation when you start a report, each with the wording version and the time. For visitors who are not signed in, a keyed hash of a random identifier kept in the consent cookie, or of the email address given for an offer code | To remember the choices you made and be able to prove them | Legal obligation to demonstrate consent, Art. 6(1)(c) with Art. 7(1); legitimate interests, Art. 6(1)(f) |
| **Support messages and feedback:** what you write to us, by email or through the feedback form in the app, any images you attach, and our replies. A feedback message also carries your name, email address and account ID, the page it was sent from and your browser's name, such as Chrome on macOS. Your browser redraws attached images before sending them, so the location and camera details a photo can hold are not sent | To help you, and to fix and improve SeedBasis | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| **People named in public sources:** names and roles of founders, maintainers, authors or parties that appear in public sources a report cites | To research the market, competitors and earlier attempts for your report | Legitimate interests, Art. 6(1)(f) |
| **Legal and tax records:** invoice and payout records, and other records the law requires us to keep | To meet accounting, tax and other legal duties, and to deal with legal claims | Legal obligation, Art. 6(1)(c), where EU or UK law requires it; otherwise legitimate interests in complying with the law that applies to us and defending claims, Art. 6(1)(f) |

You give us most of this data yourself. Google or Apple share your sign-in details when you choose them, Stripe tells us about purchases, public sources supply what reports cite, and the rest is created as you use the service. We need your account details and onboarding answers to provide the service; without them we cannot research an idea for you.

We do not ask for sensitive data such as health information, religious beliefs or biometric data. Please do not put it in your idea, answers or notes.

> The GDPR treats only EU and member state law, and the UK GDPR only UK law, as a “legal obligation”. Where another country's law requires us to keep or use data, we rely on our legitimate interest in complying with it for users in the EU and the UK.

## 3. How AI is used with your data

- When you start a report, your onboarding answers are sent to AI models reached through OpenRouter: Google's models, and an open model made by Z.ai and run for us by Fireworks AI and Together AI in the United States. Z.ai receives nothing. The models turn your answers into a research plan, extract findings from the sources we collect, check the findings' citations, and write the report.
- The research plan turns your idea into search terms. Those terms, not your idea text, are sent to public data sources such as GitHub, npm, PyPI, Stack Exchange, Crossref, the World Bank and public web pages, to Tavily, the web search service we use, to Microsoft's Bing Webmaster Tools and DataForSEO, for how often terms are searched and how much search traffic competitors' websites get, and, through OpenRouter, to OpenAI, Anthropic and Google, to ask their AI models which products they recommend for your kind of product. Whoever runs a public source can see the searches made on it, and Tavily's privacy policy says it may use search queries to improve its service.
- For a report about a company you run, the research looks the company up by its name and website in public sources, such as its own website, reviews, job postings, news, filings and the UK's Companies House register, and sets it against business statistics from Eurostat and the US Census Bureau. The figures you type and the documents you attach are read only by the sections on the company's numbers, never by the research plan, and never sent to search services or public sources. While a report carries them, the AI models that research and write it are reached only at endpoints that keep no copy (zero data retention). Numbers about other companies, such as your competitors, are estimates from public data, shown as ranges with how they were worked out.
- Before a report's decision pages are written, the claims its answer rests on are checked again against web pages read that day, by Anthropic's model, reached through OpenRouter at Anthropic's own endpoints, which do not offer zero data retention. Anthropic receives the research brief's description of your idea and its customers, the report's claims with the quotes they rest on, and passages of the public pages read, never your name, email address or account details. Once every page of a report is written, Anthropic's model also reads the finished report once, the same way, to find places that disagree with each other or state what their findings do not give, and rewrites those places: it receives the report's pages, which can restate what you told us about your idea, budget and time, the claims of the findings they cite, and the report's verdict, never your name, email address or account details. It deletes these requests within 30 days, and its commercial terms do not allow it to train models on them. A report about a company you run that carries figures you typed or documents you attached skips the check and has its finished pages read by Google's model at an endpoint that keeps no copy instead, so nothing of that report reaches Anthropic.
- When a report names a company, we copy the company's logo from its own website and show it beside the company's name. The request comes from SeedBasis and carries nothing about you or your idea, and your browser loads the logo from SeedBasis, never from the company's website.
- When you use SeedBasis Agent, your messages and the relevant parts of your reports are sent to the model to produce each answer. When you attach a document, we read its text on our own server. The parts the agent reads to answer you, and the parts deep research reads for a question you ask about it, are sent only to AI endpoints that keep no copy (zero data retention). Deep research cites your documents apart from public sources and never adds them to your report's research. When a PDF you attach has no text in it, such as a scan, we turn its pages into pictures on our own server and send those pictures, and nothing else of the file, to Google's model through OpenRouter, only at endpoints that keep no copy, to copy out the words; it uses a little of your agent time. The file itself never leaves SeedBasis. An AI assistant you connect can list your documents and read their text.
- When you talk with a report, your browser asks you first before SeedBasis can use your microphone, and the microphone is open only while the call is. What you say is sent to our server as short recordings, which we read in memory and send through OpenRouter to ElevenLabs to turn into text, or to Google's model when ElevenLabs cannot; the agent then answers your words as it answers a typed message, and its answer is sent to ElevenLabs to be spoken, or to OpenAI's audio model when ElevenLabs cannot, which receives only the agent's answer, never your voice. Every request of a call goes only to endpoints that keep no copy (zero data retention), except the OpenAI fallback, which may keep a request for up to 30 days to monitor abuse. We never keep a recording: the words of each call, what you said and what the agent answered, are kept with the report, and the agent's changes during a call can be undone as any other.
- We do not train AI models on your data, and we only use AI providers whose terms do not allow them to train on it. Google keeps the requests we send it for up to 55 days to detect abuse and then deletes them, except requests that carry a document you attached, which go only to Google endpoints that keep no copy; Anthropic deletes the requests we send it within 30 days; the companies that run the open model, and xAI, keep no copy at all. The [AI disclosure](https://seedbasis.com/legal/ai) explains what each provider keeps, and for how long.
- For some parts of a report, search terms derived from your idea are also sent to xAI, whose model finds public posts on X. These searches run only on xAI's endpoints with zero data retention, so it keeps no copy of them, and we read each post from X itself.
- **If a report cites your post on X.** Reports can cite public posts on X about a problem, a product or a company. A report links to the post and says in its own words what the post shows. It never shows the post's text or who wrote it. We keep the post's text, its author's name and handle, and the day it was posted, only to check that the citation is accurate. We never profile the people who wrote them, and our research is instructed to leave out posts about health, money, politics, religion, sex life or crimes. We check each post on X at least once a day, and delete our copy within 24 hours of the post being deleted, protected or changed. To object to a citation of your post, write to privacy@seedbasis.com, and we remove it from every report within 24 hours. We rely on our legitimate interest in showing founders what people say in public about the problems they research.
- Reports are research for you to judge, not decisions about you. SeedBasis makes no decision about you based solely on automated processing that has legal or similarly significant effects.

## 4. Who receives your data

- **Service providers** that process data for us under contract: hosting and the database, AI model access, web search and search statistics, sending email, forwarding email to our support inbox, and network protection and bot checks, plus Google Analytics if you allow analytics cookies. The [subprocessors](https://seedbasis.com/legal/subprocessors) page lists each one, what it receives and where.
- **Stripe and Link.** Sold through Link, LLC, a Stripe company, is our merchant of record: it sells credits and top-ups to you, takes payment through Stripe, handles tax, receipts, invoices and payment support, and is responsible for the payment data you give at checkout under [Link's privacy policy](https://link.com/privacy) and [Stripe's privacy policy](https://stripe.com/privacy). We send Stripe your email address and account reference to open a checkout, and receive what you bought and its amount back.
- **Google and Apple**, if you choose to sign in with them, under their own privacy policies.
- **Google**, whose Gmail inbox receives the email you send to our support, privacy, security and legal addresses and the feedback you send from the app, under its own [privacy policy](https://policies.google.com/privacy).
- **An AI assistant you connect**, which reads what you allow, your documents included, under your agreement with its provider.
- **Anyone you give a view-only link to**, who can read that report's pages as your version reads, with your pictures and logo, but not your notes, documents, conversations or account, until you turn the link off or it ends.
- **Professional advisers** such as our accountants and lawyers, who are bound by confidentiality.
- **Authorities and courts**, when the law requires it, or where needed to protect rights, safety or the service.
- **A buyer or successor**, if the business is sold or reorganised. This policy continues to apply to your data.

We do not sell personal data, and we do not share it for targeted advertising.

## 5. International transfers

Our hosting and database are with Amazon Web Services (AWS), on a server in Frankfurt, Germany. AWS is a US company, and most of our other providers are in the United States or process data there, so your data is transferred between countries.

- **From the EU, the EEA and the UK:** we use the European Commission's standard contractual clauses, with the UK addendum for UK data, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK extension where it has one.
- **From Canada, including Quebec:** your data may be stored and processed outside Canada, where courts and authorities of those countries may be able to reach it. Before personal information from Quebec leaves Quebec, we assess whether it will be adequately protected, and our contracts with providers require that protection.
- **From the United Arab Emirates:** we transfer data outside the UAE only where UAE data protection law allows it, such as to countries with adequate protection or under contractual safeguards.
- You can ask for a copy of the safeguards for any provider at privacy@seedbasis.com.

## 6. How long we keep data

| Data | How long |
| --- | --- |
| Account, onboarding answers, reports with every revision, notes, pictures and drawings you added, documents you attached, agent conversations, connected assistants, usage and credits | Until you delete your account. Deletion removes them, including the archived original research. |
| Voice calls with a report | The words of each call, what you said and what the agent answered, until you delete the report or your account. The recordings of your voice are never kept: each is read in memory and dropped once it is turned into text. Your voice minutes and how they were used are kept until you delete your account. |
| Unfinished answers to a new report's questions | Until you start a report from them, or 30 days after you last changed them, when an hourly job deletes them. Deleting your account removes them too. |
| Documents attached to a company report's questions before it starts | Until the report starts and takes them, or 30 days after they were added, when an hourly job deletes them. Starting the questions again or deleting your account removes them too. Once a report takes them, they are kept with it until you delete the report or your account. |
| Purchase records | Until you delete your account. After that, they stay without the link to your account for 7 years, as tax law requires for business records, and an hourly job then deletes them. |
| Records of payment notifications from Stripe, which hold an event reference and no link to your account | Deleted by an hourly job after 30 days |
| Password accounts whose email address is never confirmed | Deleted by an hourly job once 72 hours have passed |
| Sessions | End after 7 days without activity, and 30 days after sign-in at the latest. An hourly job deletes expired sessions. |
| Security event log | 12 months. If you delete your account, the events stay for that period but are no longer linked to you. |
| Failed sign-in counters | 24 hours |
| Rate-limit counters | Deleted by an hourly job once they have expired |
| Consent and acknowledgement records | Until you delete your account. After that, they stay for 3 years as proof of what you agreed to, linked only to a one-way code made from your email address instead of your account, and an hourly job then deletes them. Cookie choices made while not signed in are deleted after 3 years. |
| Offers in the app | Until you delete your account |
| Offer sign-ups from the Pricing page | Your address until you unsubscribe or delete your account, when it is deleted at once. A one-way code made from it stays with your code and whether a purchase used it, so the same address does not get a second code, and is deleted 3 years later together with the proof of your consent. |
| Invoice and accounting records | 7 years, as tax law requires for business records. Link, as the seller, keeps its own invoice and payment records under its privacy policy. |
| Support messages and feedback | 2 years after the last message |
| What you do in the app | 12 months, and deleted at once with your account |
| Where you heard about SeedBasis, referrals, and your answers about your reports, with any words you wrote after a no | Until you delete your account, or until you ask us to delete your words |
| Which reminders to start a first report we sent you | Until you delete your account |
| Email delivery records at our email provider | 30 days, as Resend keeps them |
| Server and traffic logs | 30 days |
| Google Analytics data, if you allowed analytics cookies | 2 months |
| Search terms stored with cached public research results, which are not linked to your account | Deleted by an hourly job within two days of the last report that used them being deleted |
| Backups | Deleted data leaves our backups as they expire, within 14 days |

At the end of each period we delete the data, or anonymise it so it can no longer identify you.

## 7. Your rights

Wherever you live, you can do these things yourself in Settings:

- **Export your data:** one JSON file with your account and sign-in methods, settings, what the agent remembers, consent records, every report with all its revisions, notes, the pictures and drawings you added and the documents you attached with their text, onboarding answers, any unfinished answers to a new report's questions and the documents waiting with them, agent conversations and proposals, usage, report credits and agent credits, purchases, active sessions and security events. It never includes secrets such as your password hash, session tokens, two-factor secret or sign-in tokens.
- **Delete your account:** this permanently removes the account and everything in it, including the archived original research. Section 6 lists the records that stay.
- **Correct your details:** change your name and email address, and edit any finding, chart or note.
- **Change your choices:** news and offers email in Settings, pricing page offers through the unsubscribe link in each email, and analytics cookies through Cookie settings at the bottom of our public pages. Deleting your account also stops offer emails to its address.

### In the EU, the EEA and the UK

You have the right to access your data, have it corrected or erased, restrict its use, receive it in a portable format, object to processing based on legitimate interests, and withdraw consent at any time without affecting what happened before. We answer within one month. For complex requests we may extend that by two further months, and we tell you if we do.

You can complain to the data protection authority where you live or work, or where you think a problem happened. The EU and EEA authorities are listed by the [European Data Protection Board](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). In the UK, you can complain to us first, and we acknowledge complaints within 30 days; you can also go to the [Information Commissioner's Office](https://ico.org.uk/make-a-complaint/).

### In Canada, including Quebec

You can ask to access your personal information and have it corrected, and withdraw your consent where we rely on it. In Quebec you can also ask for your data in a structured, commonly used technological format, and ask us to stop disseminating information about you or to de-index a link to your name where the law allows. We answer within 30 days. Our person in charge of the protection of personal information is Efe Adiguzel, at privacy@seedbasis.com. You can complain to the [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca) or, in Quebec, to the [Commission d'accès à l'information](https://www.cai.gouv.qc.ca).

### In the United Arab Emirates

You can ask how we process your data and receive a copy of it, have it corrected or erased, restrict or stop its processing, and object to decisions based solely on automated processing. You can complain to the UAE Data Office.

### In the United States

See section 11.

### How to make a request

Email privacy@seedbasis.com from the address on your account. We may ask you to confirm your identity before we act. Requests are free unless they are clearly unfounded or excessive.

## 8. Cookies

We use only the cookies and browser storage the site needs to work, plus Google Analytics cookies on our public marketing pages if you allow them. The [Cookie Policy](https://seedbasis.com/legal/cookies) lists each one.

## 9. Children

SeedBasis is for adults. You must be 18 or older, or the age of majority where you live if that is higher, to create an account. When you sign up, you confirm this with the Terms, and we record when. We do not knowingly collect data from anyone younger. If you believe a child has an account, tell us at privacy@seedbasis.com and we will delete it.

## 10. Security

We protect data with encryption in transit, a database that accepts no connections from the internet, slow password hashing, optional two-factor authentication, strict session limits and a security event log. The [Security](https://seedbasis.com/security) page describes each control. If a breach puts your data at risk, we notify the authorities where the law requires, generally within 72 hours, tell you without undue delay, and keep a record of every breach.

## 11. Notice for United States residents

- **What we collect.** In the categories California law uses: identifiers such as your email and IP address; commercial information about purchases and credits; internet activity such as security logs, which parts of the app you use and when, and, with your consent, analytics on our public marketing pages; and the content you give us, such as your idea, answers, notes, pictures and drawings you add, and messages. Section 2 lists sources, purposes and recipients.
- **No sale or sharing.** We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months.
- **Global Privacy Control.** If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics cookies and as a request to opt out of sale and sharing.
- **Do Not Track.** Browsers' Do Not Track signals have no agreed meaning, so the site does not act differently when it receives one. It does honour Global Privacy Control, as described above.
- **Tracking across sites.** We do not track you across other websites, and we do not let other companies collect personal information about your activity over time and across websites through our service, apart from Google Analytics on our public marketing pages if you allow it, with Google signals and advertising features switched off.
- **Sensitive information.** We use your password only to sign you in, and we do not use any information to infer characteristics about you.
- **Your rights.** Depending on your state, you can ask to know, access, correct or delete your personal information, and to receive a copy. Use Settings or email privacy@seedbasis.com. An authorised agent can make a request for you with your signed permission. We will not treat you differently for using these rights, and if we turn down a request you can appeal by replying to our answer.
- **Nevada.** We do not sell personal information. Nevada residents can still send an opt-out request to privacy@seedbasis.com.
- **Retention.** Section 6 shows how long we keep each kind of data.

## 12. Changes to this policy

If we change this policy in a way that matters to you, we tell you by email or in the app before the change takes effect. The effective date at the top of this page shows the current version.

## 13. Contact

SeedBasis, LLC, run by Efe Adiguzel. Privacy requests: privacy@seedbasis.com.