Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Information We Collect

We collect the following categories of personal data:

• Account Data: Name, email address, company name, and authentication credentials when you create an account.
• Billing Data: Payment information and billing address processed through our payment providers.
• Service Data: Error logs, stack traces, and incident data you connect to our service through integrations.
• Usage Data: Information about how you interact with our service, including features used, actions taken, and session duration.
• Device & Log Data: IP address, browser type, operating system, and access timestamps.
• Support Data: Communications when you contact our support team.

We collect data directly from you when you provide it and automatically through your use of our service.

3. Legal Bases for Processing

We process your personal data based on the following legal grounds under GDPR:

• Contract Performance: To provide our services, manage your account, and process payments.
• Legitimate Interest: To improve our services, ensure security, prevent fraud, and communicate service updates.
• Consent: For marketing communications, analytics cookies, and using anonymized data to improve our AI models (when you opt in).
• Legal Obligation: To comply with applicable laws, regulations, and legal processes.

4. How We Use Your Information

We use your personal data to:

• Provide, operate, and maintain our incident resolution services
• Process transactions and send billing information
• Respond to support requests and communicate with you
• Improve and personalize our services
• Analyze usage patterns and optimize performance
• Send marketing communications (with your consent)
• Improve our AI models using anonymized data (with your explicit consent)
• Detect, prevent, and address security issues and fraud
• Comply with legal obligations

5. Cookies and Tracking

We use cookies and similar technologies categorized as follows:

• Strictly Necessary: Essential for website functionality. Cannot be disabled.
• Analytics: Help us understand how visitors use our website (requires consent).
• Marketing: Used to deliver relevant advertisements (requires consent).

You can manage your cookie preferences at any time: Manage Cookie Preferences

6. Data Sharing & Subprocessors

We do not sell your personal data. We share data with the following categories of service providers who process data on our behalf:

• Cloud Infrastructure: Amazon Web Services (AWS) — hosting and data storage
• AI Processing: Anthropic and OpenAI — for AI-powered analysis features

All subprocessors are bound by data processing agreements that ensure GDPR-compliant handling of your data.

7. International Data Transfers

Your data is stored in the European Economic Area (EEA), in AWS's eu-central-1 region (Frankfurt, Germany). OurBase Inc. is based in the United States, and our team and some of our service providers access data from the United States. We rely on the Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum for UK data) to protect personal data transferred outside the EEA, the UK, and Switzerland.

8. Data Retention

We retain your personal data for the following periods:

• Account Data: While your account is active, plus 12 months after termination.
• Billing Data: As required by tax and accounting laws (typically 7 years).
• Service Data: While your account is active, plus 12 months after termination.
• Usage & Log Data: 12 months from collection.

Upon account termination, you may request data export. Data is permanently deleted 90 days after termination unless retention is required by law.

9. Your Rights (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Restriction: Request restriction of processing in certain circumstances.
• Portability: Request transfer of your data in a machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise your rights, contact us at privacy@ourbase.ai. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work, or place of the alleged infringement.

10. Your Rights (United States)

Depending on your state of residence (for example, California), you may have the right to:

• Know and access: Request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Delete: Request deletion of your personal information, subject to legal exceptions.
• Correct: Request correction of inaccurate personal information.
• Opt out: Opt out of the sale or sharing of personal information for cross-context behavioral advertising, and of targeted advertising.
• Non-discrimination: Exercise these rights without receiving discriminatory treatment.

We do not sell personal information, and we do not share it for cross-context behavioral advertising except where you have consented to marketing cookies, which you can withdraw at any time through Cookie Preferences. The categories of personal information we collect, and the purposes for which we use and disclose them, are described in Sections 2, 4, and 6. To exercise your rights, contact privacy@ourbase.ai. We will verify your request using information associated with your account, and you may use an authorized agent to submit a request on your behalf.

11. Children's Privacy

Our services are intended for business use by individuals aged 18 and older. We do not knowingly collect personal data from children under 18. If we become aware that we have collected data from a child under 18, we will delete it promptly.

12. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security assessments. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. Your continued use of our services after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: