Privacy Policy

Account data: email, username, display name, bio, and your password (stored hashed by Supabase Auth; we never see it in plain text).

Project data: everything you create in the product: portfolios, programs, projects, work breakdown structures, tasks, notes, risks, stakeholders, issues, change requests, lessons learned, and reports.

Uploaded documents: files you upload to the knowledge base are stored, and their text is extracted and split into chunks with vector embeddings so you can search across them and so the AI assistant can reference them.

AI chat data: your chat sessions and messages with the AI assistant, and a log of AI feature usage (for reliability and cost monitoring, not advertising).

Payment data: handled by Stripe. We store your Stripe customer ID and subscription status, not your card details.

Optional AI provider key: if you add your own API key for a third-party AI provider in Settings, Baseline encrypts it at the application layer using AES-256-GCM before database storage. It is decrypted only on the server when routing your request to that provider.

Usage data: Baseline records which pages of the app you visit and how long you spend on each, tied to your account. This is first-party and used only to operate, support, and improve the Service, including making it faster: Baseline loads the pages you are likely to open next, based on your own recent visits and on patterns across all accounts (which kinds of pages people tend to open after which, never anyone's specific projects or content). It is not shared with anyone and is not used for advertising. You can turn it off at any time in Settings. Once it is off, no further usage data is recorded for your account and your own history is no longer used to predict your next pages.

Technical data: session cookies used to keep you signed in, and data processed by Cloudflare Turnstile to tell humans from bots on sign-up and login. Baseline does not use advertising or third-party analytics trackers.

• To provide, operate, and maintain the Service you signed up for.
• To process your subscription payment and manage billing, via Stripe.
• To send account-related email, such as password resets.
• To protect the Service from bots, abuse, and unauthorized access.
• To power AI features you actively use (search, chat, and report generation), as described below.
• To maintain and improve the reliability of the Service.

Our legal basis for this processing is performance of our contract with you (providing the Service you subscribed to), and our legitimate interest in operating a secure, reliable product, where that interest doesn't override your rights. Usage data (section 1) is processed on the basis of legitimate interest, and you can object to it at any time by turning it off in Settings.

When you upload a knowledge-base document, its extracted text is sent to Cloudflare Workers AI to create mathematical vector embeddings used for semantic search. Search queries are also sent to that service to create a query vector. The source files remain in private Supabase storage, and the embeddings and extracted chunks are stored in Baseline's database.

When you use AI chat or generate a report, the relevant text (your message, project data, and any document passages retrieved for the answer) is sent to the AI provider configured for your account: OpenAI, Anthropic, Google, OpenRouter, or Ollama. Each hosted provider processes that data under its own privacy terms. We don't use your data to train our own models.

Where you've entered your own provider API key, requests are made directly using that key and are also subject to that provider's terms and your agreement with them.

We share data with the processors that make the Service work, and no one else:

• Supabase: database, authentication, and file storage.
• Stripe: payment processing and subscription management.
• Resend: delivery of transactional email (e.g. password resets).
• Cloudflare: bot protection on sign-up and login (Turnstile), and managed vector generation for knowledge-base search (Workers AI).
• Vercel: application hosting.
• Sentry: error reports when something breaks, stored in the EU. Reports leave out passwords, cookies, form contents and email addresses.
• Your selected AI provider: as described in the section above, only when you use an AI feature.

We don't sell your data, and we don't share it with anyone for advertising purposes. We may disclose data if required to by law, or to protect the rights, safety, or property of Baseline or others.

Baseline's database, file storage and application servers are located in the European Union (Frankfurt, Germany). Some of our processors also operate infrastructure in other countries, including the United States, so your data may be processed outside the country you live in. For transfers out of Nigeria, the UK or the EU, we rely on the safeguards our processors maintain (such as Standard Contractual Clauses) and on the transfer bases allowed by the Nigeria Data Protection Act 2023.

We keep your data for as long as your account exists. If you cancel your subscription without deleting your data, it remains stored. Nothing is automatically deleted for non-payment. You control deletion directly from your profile:

• Delete your data permanently removes your project data while keeping your account and login active.
• Delete your account permanently removes your account and all associated data.

Both are irreversible once carried out. Some minimal records (such as billing history Stripe is required to retain, or logs kept briefly for security purposes) may persist after deletion where we're legally required to keep them.

Under the Nigeria Data Protection Act 2023, and the UK GDPR, EU GDPR or similar laws where they apply to you, you have the right to access, correct, delete, or receive a copy of your data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. Most of these you can exercise directly in the product: editing your profile, or using "Delete my data" / "Delete account" on the profile page. For anything else, email support@aboveone.net. If you're not satisfied with our response, you have the right to complain to a data protection authority: the Nigeria Data Protection Commission (NDPC), or your local authority if you live elsewhere (in the UK, the Information Commissioner's Office).

We use cookies that are strictly necessary for the Service to function: keeping you signed in, and Cloudflare Turnstile's bot-verification cookie on sign-up, login and password reset. Baseline also uses your browser's local storage for your light or dark theme choice and, unless you've turned usage data off, a short queue of usage events waiting to be sent. For the length of your browser session it also keeps how long recent page loads took and the list of pages to load ahead of time, so navigation feels instant. We don't use cookies for advertising or cross-site tracking.

We use security measures including encrypted connections (TLS) and application-layer AES-256-GCM encryption for stored AI provider API keys. Encryption keys are held separately in the server environment. You can also turn on two-factor sign-in with an authenticator app in Settings. No system is ever completely secure, and we can't guarantee absolute security.

Baseline isn't directed at anyone under 18, and we don't knowingly collect data from children.

We may update this Policy from time to time. If we make material changes, we'll notify active subscribers by email or in-app notice before they take effect.

Questions about this Policy or your data? Email support@aboveone.net.