Privacy Policy

This policy explains how Ascennity Private Limited (“we”, “us”) handles personal data when you use Basefile — the client feedback and approval tool at basefile.io and app.basefile.io, including the shared pages at app.basefile.io/shared/: what our users share with their clients, opened through a link or an email.

Questions and privacy requests go to support@basefile.io. Our registered office is at SY 11 We Work, Krishe Emerald, Whitefield, Madhapur, Shaikpet, Hyderabad- 500081, Telangana, India, and our Corporate Identity Number (CIN) is U63111TS2026PTC217203.

Who this applies to

Two kinds of people use Basefile:

• Account holders — the freelancer or small business who creates a Basefile account, and, on the Studio plan, the teammates its owner invites. We decide how to process your account data (email, password, plan, and settings), so we are its controller under UK data protection law and its Data Fiduciary under India’s Digital Personal Data Protection Act, 2023.
• Client contacts — people an account holder shares work with. You do not create a Basefile account. Either the account holder adds your name and email and we send you a magic link, or they give you a link to a project or a file and you add your name the first time you comment, answer, or send files. For the project content they put in Basefile, they decide why it is there, so they are its controller; we host it for them as their processor. We still handle some data of our own — sending links, keeping an access log, and remembering your email preferences.

What we collect

From account holders:

• Email address and password (stored as a one-way hash, never as plain text)
• Name, once you add it
• A profile picture, if you add one
• Account name, plan (Free, Plus, or Studio), and how you use the product
• On Studio, the email address and name of each person the owner invites to the team, which teammates are on which projects, and which teammate wrote each note or did each thing
• If you sign up from a link on this website, which page it was on (for example, the invoice generator), or which link brought you to the website (for example, the “Made with Basefile” link on the shared pages)
• Notification and client reminder preferences, whether you want tips and check-ins, and theme
• When you were last in the app, to the hour, so we can check in if you’ve been away
• If you turn on push notifications, the address your browser gives us for each device and the keys that encrypt each notification to it
• Email confirmation, password reset, and email-change codes
• Projects, files and their versions, the addresses of websites you capture, comments, approvals, and project details you create
• Session data: a signed cookie, IP address, and browser user agent
• If you buy Plus or Studio, the order details Paddle shares with us: your Paddle customer and subscription IDs, the email and country on the order, your plan and its price, your subscription status, and your charges and refunds

From client contacts:

• Name and email, as entered by the account holder — or, if you came in by a project’s or a file’s link, only the name you give
• A profile picture, if you add one
• Whether you want every email, or only the ones that need you
• Files you send, your comments (and where you pinned them on a file, or at which moment of a video), and your approvals and requests for changes, with any note you add
• When you open a file the account holder shared (the first time, and the latest), so they know it reached you
• Sign-in and link data: IP address, user agent, and an access log (magic link issued, signed in, signed out, rejected, project or file link opened, name given)

We also process:

• Email delivery events from our email provider, including bounces and spam complaints, which we use to stop mailing an address
• File metadata (name, type, size, checksum) for files stored in the product

We never see or store your card number; Paddle handles payment details when you buy a plan. We do not run advertising or analytics cookies. We do not use your content to train AI models.

Why we use it

Each use below ends with its legal basis under UK data protection law.

• To create and secure your account, and to let client contacts in with a magic link or a project’s or a file’s link. Basis: our contract with you, and for client contacts, our legitimate interest in running the shared pages an account holder set up
• To provide Basefile and the shared pages: projects, files, captured websites, versions, comments, approvals, and notifications to the people each project or file is shared with. Basis: as above
• To let an owner invite teammates by email, and to show each teammate the account’s work. Basis: our contract with the account holder
• To email you when something needs you, when something changes, or when you asked for a recap; to remind a client about files waiting for their answer, on the schedule the account holder chooses (three times at most for each thing) or when they send a nudge; and, for account holders who turn them on, to send push notifications. Basis: as above
• To send account owners a few emails about getting started (a welcome, and a note after their first share and first approval), and occasional tips and check-ins if they’ve been away, which they can turn off at any time. Basis: our legitimate interest in helping you get the most from Basefile
• To apply plan limits (active projects, storage, file size, and people on a team). Basis: our contract with you
• To sell Plus and Studio through Paddle and keep your plan in step with your subscription. Basis: our contract with you
• To keep the service secure, debug problems, and prevent abuse. Basis: our legitimate interest in keeping Basefile safe and working
• To count visits to this website, without cookies, and to see which of its pages people sign up from. Basis: our legitimate interest in knowing how the site is used
• To respond to support requests and to meet legal obligations. Basis: our contract with you or our legitimate interest in helping you, and for legal obligations, the law itself

Cookies

We only set cookies the product needs:

• A signed session cookie for account holders, which lasts 30 days
• A signed session cookie for client contacts, which lasts up to 30 days of activity and no more than 90 days in total
• An encrypted cookie for someone who opened a project’s or a file’s link, so it opens again on that browser without it. It holds the link and, once you give your name, which contact you are. It lasts 90 days, and stops working as soon as the account holder switches the link off or replaces it
• A short-lived, encrypted cookie that carries information between steps — for example, the email you’re confirming or the page you were trying to open — and protects forms. It’s deleted when you close your browser
• A theme preference, kept for a year
• Whether you keep the app’s menu open or collapsed, kept for a year
• Your local time zone, so greetings and times match your clock, kept for a year

These are not advertising cookies. We do not use a cookie banner, because we do not set optional tracking cookies.

The marketing site and the app load the Inter typeface from Google Fonts. That request is made to Google.

On this website (basefile.io), we count visits with Plausible Analytics. It sets no cookies and does not store IP addresses or build profiles of visitors. It records which pages are viewed, the referring site, country, browser, and device type, and when someone clicks Get started or opens the demo, saves an invoice from the invoice generator, saves or copies a packet from the welcome packet tool, copies the link to our feedback guide, or opens a page that doesn’t exist. The app at app.basefile.io does not load it.

The free invoice generator and welcome packet tool on this website keep what you type, and any logo you add, in your browser’s local storage, so it’s there when you come back. It never leaves your device: we don’t receive it, and neither does anyone else. “Clear saved details” on each page removes it.

If you buy a plan, the checkout and the page for managing your subscription are Paddle’s. Paddle may set the cookies it needs to take a payment and prevent fraud. Its privacy policy covers them.

One page on this website, basefile.io/billing, loads Paddle’s scripts. Paddle’s emails about a failed payment lead there, so Paddle can show its secure form for updating a card, and Paddle may set the cookies it needs to do that. No other page on this website loads them.

We don’t track you across other sites, and no other company tracks you through Basefile, so we treat every visitor the same whether or not your browser sends a Do Not Track signal.

How long we keep it

• Account data and project content stay until the account holder deletes them. When they close the account from Settings, we delete that data 14 days later. They can sign in before then to keep the account
• After that deletion, our backups may still hold a copy for up to 14 days, until those backups expire. Email we have already sent may stay with Postmark for 45 days (their default). Server logs stay until log rotation on the host removes them
• Uploads that never landed on a record are removed after two days
• A request to capture a website is removed a day after it finishes; the address stays with the file it made
• Magic-link records are removed after 30 days
• A team invitation works for seven days, and its record is deleted 30 days after that, whether or not it was accepted
• A teammate the owner removes can’t sign in again. Their name, email and profile picture stay in the workspace, with what they wrote, until the account is closed
• Expired client sessions are removed 30 days after they expire
• Account-holder sessions last 30 days
• Sessions on the shared pages last up to 30 days of activity, and no more than 90 days in total
• Access records for the shared pages (magic link issued, signed in, signed out, rejected, project or file link opened, name given) are kept for 12 months, then deleted
• Workspace exports can be downloaded for 72 hours, then the file is deleted
• Records of orders, charges, and refunds are kept, by us and by Paddle, for as long as tax and accounting law requires, even after an account is closed

Who we share it with

We do not sell your personal data or share it for advertising. We use service providers who process data for us so we can run Basefile:

• Postmark — transactional and notification email
• Cloudflare — file storage (R2, in North America), DNS, and hosting for this website
• PlanetScale — the database, hosted in the United States (US East)
• Hetzner — runs the application on servers in the United States (Ashburn, Virginia)
• Sentry — error monitoring, in the United States. When something breaks, it receives technical details about the error, such as the page and the code involved. It does not receive passwords, cookies, form contents, or IP addresses
• Plausible Analytics — privacy-friendly visit counts for this website, hosted in the EU, without cookies
• Google — the Inter font on our sites
• Your browser’s push service (Apple, Google, Mozilla, or Microsoft, depending on the browser) — delivers push notifications to account holders who turn them on. Each one is encrypted to your device, so the push service can’t read it

When you buy Plus or Studio, you also deal with Paddle, our online reseller and the Merchant of Record for all our orders. Paddle collects your payment details, billing address, and any tax number to take the payment and charge the right tax, and it handles that data under its own privacy policy. We give Paddle your email and your account’s ID so it can link the order to your account, and Paddle shares the order details listed above with us.

Basefile’s data is stored in the United States: the app runs on servers in Ashburn, Virginia, the database is in US East, and files are stored with Cloudflare R2 in North America. We are a company based in India. Account holders also share data with their teammates, with the client contacts they invite, and with anyone they give a link to a project or a file. We are not responsible for how an account holder uses Basefile with their own clients.

Magic links

Client contacts sign in with a single-use link we email them. An invite from the account holder works for seven days. A sign-in link a client asks for on the shared pages works for 15 minutes. The button in each email we send a client about their project signs them in the same way and opens what the email is about; it works for seven days. Each link works once — after that, they can ask for a new one. Opening a link takes a confirmation step so mail scanners cannot use it. Once signed in, a client stays signed in on that browser for up to 30 days of activity, and no more than 90 days in total. We record that a link was issued or used, with IP address and user agent, so we can investigate unwanted access.

Project and file links

An account holder can also share a link to a project, or to a single file. Anyone who has it can open that project, or only that file, without an email, until the account holder switches the link off or replaces it with a new one. The first time you comment, answer, or send files, you add your name. That makes you someone the account holder shares with, with no email address, so we send you no email. A cookie keeps it open on that browser for 90 days. We record when the link is opened and when a name is given, with IP address and user agent, so we can investigate unwanted access.

The demo

Anyone can open the demo from this website. We make a private copy of a sample file and open it by its link, as a guest named “You”, with the same cookie a project’s or a file’s link sets, and we record the IP address and browser that opened it. Your notes and answers stay in your copy: nobody else sees them, and we send no email. We delete the copy, and everything recorded with it, after a day.

Website captures

An account holder can add a website by its address. Our own browser, on our servers, opens that page and saves pictures of it, as a desktop and a phone show it, as a file in their account. No other company sees the address or the page. That browser can only reach the public internet, starts fresh for every capture, and keeps no cookies or data from one to the next. The pictures are stored like any other file, and deleted with it.

Files

Files you upload are stored on Cloudflare R2 and handed out through short-lived, authorised links. Most expire in minutes; the link that plays a video lasts up to two hours, so it can play through. We do not scan files for viruses.

A profile picture works differently, because it appears on nearly every page. Your browser shrinks and crops it before sending it, and our servers keep only a small square copy, with nothing else from the original file, such as where it was taken. It shows beside your name to the people you work with in that account, at a long, unguessable address that browsers may keep. It isn’t sent to Gravatar or anyone else outside the services below. You can change or remove yours at any time, and an account holder can remove a client contact’s.

To show a file in the browser, our own servers make copies of it: pictures of a PDF’s or a design file’s pages, and for a video, a copy that plays in any browser and a still from it. No other company sees the file to do this. Each copy is kept with the file it was made from and deleted with it.

Approving a file or asking for changes on the shared pages is recorded with the name of who answered, when, which version, and any note they added. An approval also has a record page that can be saved as a PDF. It is not an electronic signature.

Your rights

Depending on where you live, you may have the right to access, correct, or delete personal data, withdraw consent, or complain to a regulator.

Write to support@basefile.io from the email we have on file. The owner of an account can download a copy of the workspace from Settings, under Your data, and close the account from Settings. We delete it 14 days after they confirm. They can sign in before then to keep it. A teammate can ask the owner to remove them from the team, or write to us.

If you are a client contact, some of your data lives in an account holder’s workspace. We may need to involve them, and they may need to correct or remove it in their account.

Account holders can change their name, email, profile picture, and notification preferences in Settings, and turn off tips and check-ins there or with the link in any of them. Client contacts can change or remove their profile picture from the menu beside their name, and switch to hearing only when something needs them, using the link in our emails.

Children

Basefile is for businesses and people aged 18 or over. We do not knowingly collect data from children.

Grievances

Our Grievance Officer handles privacy questions and complaints. Write to them at support@basefile.io. We aim to acknowledge quickly and to resolve privacy grievances within 90 days. If you are in India and are not satisfied, you may escalate to the Data Protection Board of India once that route is available to you.

Changes

We will update this page when our practices change. The date at the top is the latest version.