Privacy Policy

This Privacy Policy explains how Electric Pass Labs, LLC d/b/a Basehand (“Basehand,” “we,” “us,” or “our”) collects, uses, and discloses personal information in connection with our website, application, AI agents, and related services (the “Services”). Personal information means information that identifies, relates to, or can reasonably be linked to an individual.

1. Who we are and when this applies

We are responsible for personal information we use to manage our own website, account relationships, support, security, and business operations. Where privacy law uses the term, we act as the “controller” of that information.

When a business uses Basehand to manage its website, customer inquiries, content, or connected accounts, we also process information on that business’s behalf and according to its instructions. For that processing, the business is generally the controller and Basehand is its processor or service provider. The data processing agreement is included in Section 10 of the Terms of Service and applies as part of that agreement whenever this processing begins; it does not require a separate document or signature. Processing account information for our own purposes can begin when you register, as described in this policy.

If you are a customer, employee, or website visitor of a business using Basehand, consult that business’s privacy notice and direct questions about its collection and use of your information to it. This policy explains Basehand’s role; it does not replace the business’s notice. If you contact us about information we process for a business, we may refer your request to that business and assist it as required.

This policy does not govern the independent practices of social networks, domain registrars, linked websites, or other third parties. Optional features involve the information described below only when those features are available and used.

2. Information we collect

• Account and business information. Your name, email address, business name and category, account membership and permissions, and business details you provide, such as locations, contact details, hours, services, and branding.
• Content and agent interactions. Prompts, conversations, files, images, website text and code, instructions, generated responses, suggested or approved actions, and records of tasks and website changes. This material may contain personal information about you or other people.
• Customer and visitor information. Information a business or its visitors submit through supported features, such as names, contact details, messages, and other fields in a website contact form. The business determines which information its forms request.
• Connected-account information. When you connect a third-party account, we receive the account identifiers and profile information the provider makes available, the permissions you grant, authorization tokens, and information needed for the enabled feature. For example, a Google Business Profile connection can provide your account name and email and access to business profile details.
• Domain and purchase information. If you use domain registration or paid features, information needed for the transaction, such as registrant name, organization, email, phone number, postal address, the domain requested, and transaction or payment-status records. A payment provider may collect payment details directly when that payment flow is offered; its notice governs its own processing.
• Communications. Information you send when you email us, request support, provide feedback, or submit a privacy or legal request.
• Technical and activity information. Information generated when the Services are accessed or operated, such as IP address, browser and device information, request times, requested pages, authentication events, errors, and service activity. Infrastructure providers may process request and security logs to deliver and protect the Services.
• Information from other sources. Information retrieved from accounts you connect, people you authorize, and public business websites or listings when needed for a task you request, such as building a website from your existing business materials. Publicly available information can still be personal information.

3. How we use information

We use information for the following purposes, depending on how you use the Services:

• Create and authenticate accounts, manage business workspaces and access permissions, and provide the features you request.
• Generate and edit content, host websites and files, receive form submissions, and carry out agent tasks and approved or enabled automations.
• Connect to external services, maintain authorized connections, and submit changes, messages, or other information as you direct.
• Handle purchases, domain requests, billing records, and related customer support where those services are offered.
• Respond to inquiries, provide service and security notices, diagnose problems, and maintain and improve the reliability and usability of the Services.
• Develop, train, fine-tune, test, and evaluate AI models to improve the quality of our Services, subject to the restrictions and legal requirements described in Section 4.
• Detect and investigate fraud, abuse, unauthorized access, and other harmful activity; enforce our agreements; satisfy legal obligations; and establish, exercise, or defend legal claims.

Processing business customer data on a customer’s behalf remains subject to that customer’s instructions and applicable agreements. Describing service maintenance or improvement here does not give us unrestricted permission to repurpose that data.

4. AI agents and model providers

Information used to perform tasks

AI features require processing the information relevant to a task. This can include your prompt, conversation history, business details, selected files or website content, and results returned by tools or connected services. We send relevant task information to the model provider used for the feature to generate responses and actions. Basehand’s application integrates Anthropic’s Claude models.

Agent conversations, outputs, and action records can themselves contain personal information. Information included in an output may be inaccurate, including information about a person; contact us to request correction of personal information we control. Avoid putting unnecessary personal or sensitive information into prompts or files.

When an agent sends a message, publishes a page, or updates a connected account, information included in that action is disclosed to the applicable recipient, audience, or service. Review the task, its intended recipients, and its permissions before authorizing it. Automated work may continue while you are offline if you have enabled it.

Training and improving models

We reserve the right to use customer data and conversations to train AI models to improve the quality of Basehand’s Services. This may include prompts, submitted content, agent responses, feedback, and task results. Such use can involve developing, training, fine-tuning, testing, or evaluating models ourselves or with service providers acting on our behalf for that purpose. It is separate from processing information to answer an individual prompt or perform a particular task.

We undertake training only where we have the necessary rights and a valid legal basis. Where consent or a separate authorization is required, we obtain it before using the affected information for training. Information we process solely on a business’s behalf is not used for our own model training unless the applicable agreement and lawful instructions permit that use and any required notices or consents are in place. When we determine the purposes and means of training involving personal information, we are responsible for that processing as a controller.

Connected-service restrictions still apply: we do not use Google API data to train generalized AI models, and we do not train on other information where doing so is prohibited by law, an applicable provider policy, or our agreement with you. Sending data to an AI provider to perform your task does not by itself authorize that provider to use it for unrelated training. This policy does not grant providers a right to use your information for their own unrelated purposes.

Your rights to object, withdraw consent where applicable, or request deletion are described in Section 10. Deleting source records does not necessarily reverse the effects of completed training; we will assess requests affecting models and derived data and take the steps required by applicable law. This is not an exception to your statutory rights.

5. When information is shared

We never sell or share any data for advertising, including targeted or cross-context behavioral advertising. Sharing needed to operate Basehand or carry out your instructions is described below and does not authorize advertising use.

We disclose information in the following circumstances:

• Service providers. Providers supporting the Services, such as hosting and storage services, AI model providers, communication services, and payment providers where used, receive the information needed for their functions. The applicable service arrangements and data protection requirements govern processing on our behalf.
• Your business workspace. Owners, administrators, and other authorized users may access information within their permissions. A business that manages your account may control membership and access to business content. Do not treat a shared business workspace as a private personal account.
• Your instructions and connections. We disclose information to the services and people involved in tasks you authorize. These recipients may process information for their own purposes under their own notices. Revoking future access does not recall information already delivered.
• Public content. Website pages, social posts, business profile changes, and other material you publish or authorize for publication are available to their intended audiences, which may include the general public. Search engines and others may index, copy, or retain public material.
• Domain services. Registration and management require sharing registrant and domain information with relevant registrars, registries, and related providers. Some registration information may be disclosed through registration-data services or lawful access procedures under applicable rules. Do not assume that all registrant information will remain private.
• Legal and safety needs. We may disclose information when reasonably necessary to comply with law or valid legal process, protect rights and safety, investigate abuse or security incidents, or resolve a dispute.
• Copyright complaints. We may provide a copyright notice and its identifying and contact information to the affected user. We send counter-notices, including the identifying and contact information required by the process, to the original complainant so the parties can respond and exercise their legal rights.
• Business changes. Information may be disclosed to professional advisers and prospective or actual counterparties in connection with financing, a merger, acquisition, reorganization, sale of assets, or insolvency, subject to appropriate confidentiality protections and applicable law.
• At your request or with your consent. We may disclose information for another purpose you specifically request or authorize.

6. Connected accounts

Connecting an account authorizes access to the permissions shown in the connection flow. For Google Business Profile, this includes basic account identity and permissions to manage business information. Access tokens and, where provided, refresh tokens allow the connection to work without requiring you to sign in for each task.

You can disconnect an integration using the available account controls or revoke Basehand’s permissions with the provider. For Google, you can review access through your Google Account connections. Disconnecting stops future access through that authorization but does not automatically delete information already stored in Basehand, remove published content, or delete the provider’s own records. Contact us about deleting stored information.

Use of information obtained through Google APIs is subject to the Google API Services User Data Policy, including applicable Limited Use requirements. Such information is used for the connected features you request; it is not used for advertising or to train generalized AI models. Any transfer or human access must be permitted by that policy and applicable law.

7. Cookies and website requests

The Basehand application uses cookies for functions such as maintaining a session and remembering sign-in. You can control or delete cookies through your browser settings. Blocking these cookies may prevent sign-in or cause parts of the application to stop working.

Our public homepage loads a typeface from Google Fonts. To deliver that typeface, your browser connects to Google and sends technical information, including your IP address and request information. Google’s handling of those requests is described in its Google Fonts privacy information. The public website does not currently include advertising pixels or third-party analytics scripts.

Customer websites may include additional scripts, embeds, cookies, or integrations chosen by the business operating them. That business is responsible for explaining those technologies and obtaining any required consent. A browser “Do Not Track” preference does not disable essential service requests or sign-in cookies. Where applicable law requires us to honor an opt-out preference signal, we will do so.

8. Retention and deletion

We retain personal information for as long as reasonably needed for the purposes described in this policy, including providing an active account and its content, carrying out authorized tasks, maintaining security, meeting legal and recordkeeping obligations, and resolving disputes. Relevant factors include the type and sensitivity of the information, the feature it supports, your instructions and deletion requests, contractual obligations, and applicable legal requirements.

You may request deletion or account closure at hello@basehand.com. We will assess and act on requests as required by applicable law and our obligations to the business that controls the data. We may retain information where needed for legal compliance, fraud prevention, security, outstanding transactions, or legal claims. Closing an account does not necessarily require immediate deletion of every record.

Copies in backups or logs may remain until their applicable retention cycle ends and remain subject to appropriate protections while retained. Content already published, sent to someone else, registered with a domain provider, or copied by third parties may remain outside our control. Revoking an integration, canceling a subscription, and deleting an account are different actions; contact us if you need help identifying the appropriate request.

For information processed on a business’s behalf, the return and deletion obligations in Section 10 of the Terms of Service apply. That section also describes our commitments concerning subprocessors, assistance with privacy requests, security incidents, and international transfers.

9. Security

We use safeguards designed to protect personal information, including access controls and encryption of stored connected-account authorization tokens. No method of transmission or storage is completely secure, and we cannot guarantee that information will never be accessed, altered, or lost without authorization.

Keep your email account, devices, and sign-in credentials secure; limit workspace permissions; and contact us promptly if you suspect a security incident. Do not email us passwords, full payment-card details, or unnecessary identity documents. This policy does not limit any security or breach-notification obligations imposed on us by law.

10. Your choices and rights

You can update information through available account controls, change who has access to your workspace, disconnect external accounts, and request account closure. To make a privacy request, email hello@basehand.com and describe the information and action involved. Providing the email associated with your account or the relevant business helps us locate the records.

Depending on where you live and which law applies, you may have rights to know whether we process your personal information; access or receive a portable copy; correct inaccurate information; request deletion; restrict or object to certain processing; withdraw consent; opt out of certain sales, sharing, targeted advertising, or profiling; or appeal a refusal of your request. These rights are subject to legal exceptions and do not all apply in every jurisdiction or to every type of business information. Listing a right does not mean we engage in the activity it covers.

We may need to verify your identity and authority before acting. An authorized representative may submit a request where the law permits, with evidence of authorization and any verification required by law. We will respond within the applicable legal period and explain any refusal or extension as required. To appeal a decision where an appeal right applies, reply to our response and state that you wish to appeal. We will not unlawfully discriminate or retaliate against you for exercising privacy rights.

If we rely on consent, you may withdraw it at any time; withdrawal does not affect processing lawfully carried out before withdrawal. You may also complain to the relevant privacy regulator or other competent authority. For information processed on a business’s behalf, contact that business first as explained in Section 1.

11. International information

Basehand stores and processes data in the United States and Europe. Your information may be transferred to, stored in, and processed in either region, including transfers between them, depending on the Services and providers involved. Privacy laws may differ from those in your country. Our providers’ processing on our behalf is subject to this United States and Europe storage and processing commitment.

If you instruct us to publish information or send it to a connected service or another recipient, that recipient’s own storage and processing are governed by its practices and may occur elsewhere. Publicly published information can be accessed worldwide. Use of the Services alone does not waive legal protections or substitute for a transfer mechanism required by law.

Where European, UK, or similar data protection law applies to processing for which we are a controller, our legal basis depends on the purpose: performing a contract with you or taking steps you request before entering one; our legitimate interests in providing, securing, supporting, and administering the Services, subject to your rights; complying with legal obligations; or your consent where required. Where our customer is a legal entity, account administration involving its representatives generally rests on our legitimate interests rather than a contract with each individual.

Where legally required, cross-border transfers must be supported by an applicable adequacy decision, approved contractual safeguards, or another lawful mechanism. Contact us for information about the locations and safeguards relevant to your use of the Services. Nothing in this policy claims certification under a data-transfer framework.

12. Children and sensitive information

Basehand’s application and agent services are intended for adults operating businesses, not for children under 18. We do not knowingly collect personal information from children under 13 through our own account services. If you believe a child has provided such information, contact us so we can investigate and take appropriate action, including deletion where required.

Businesses using Basehand must comply with laws governing information about children and may not direct our Services toward children or submit children’s information without an appropriate lawful arrangement. Do not submit sensitive personal information unless the relevant feature expressly supports it and the required agreements and protections are in place.

13. Changes to this policy

We may update this policy as the Services and our practices change. We will post the updated policy with a revised date and provide additional notice of material changes when required, such as through the application or by email. Where a new use of information requires consent, we will obtain it before beginning that use. Updating this policy does not by itself authorize incompatible uses of information previously collected.

14. Contact us

For privacy questions, requests, or concerns, contact Electric Pass Labs, LLC d/b/a Basehand at hello@basehand.com. Please identify your request as a privacy matter and include only the information needed to help us respond.