Privacy Policy

Effective date: October 10, 2026

Base316 is a product of Thinkfleet AI, LLC, a North Carolina limited liability company ("Base316", "we", "us"). This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the choices you have.

Base316 is a hosted platform that software companies ("Customers") use to add billing, usage metering, entitlements, sign-in and access control to their own applications. That gives us two different relationships with personal information, and this policy treats them separately:

As a controller, for information about the people who visit our websites, create a Base316 account, or contact us. Sections 1 to 3 cover this.
As a processor (service provider), for information our Customers store in Base316 about their users and customers ("End Users"). We handle that information only on our Customer's instructions. Section 4 covers this.

If you are an End User of an application built on Base316 — for example, you signed in to a company's app and the sign-in page was provided by Base316 — that company decides how your information is used, and its own privacy policy applies. Contact them first; we will help them answer you.

1. Information we collect as a controller

Account information. When you create a Base316 account we collect your name, email address and password. We store passwords only as a one-way cryptographic hash, never in readable form. If you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider, along with the tokens it issues to keep you signed in.

Security information. When you sign in we record your IP address, browser user agent and session details. If you turn on two-factor authentication or passkeys, we store what is needed to verify them (such as a passkey's public key). We keep an audit log of significant actions in your workspace — who did what, when, and from which IP address — so workspace owners can review activity.

Workspace and billing information. We record the workspaces you belong to, your role in each, and invitations you send or receive, including the invitee's email address. Base316's own subscriptions are billed through Stripe. Stripe collects and holds your card details; we store only the identifiers Stripe gives us and your plan and payment history.

Usage information. We record how the service is used — API requests, errors, and feature usage — to operate, secure and improve it.

Website analytics and ad measurement. On base316.com we use Google Analytics and the Google Ads tag only if you choose Allow on the cookie banner. Google Analytics collects information such as pages visited, approximate location derived from your IP address, device and browser type, and referring site. The Google Ads tag tells us whether a visit that came from one of our ads went on to sign up, so we can measure what our advertising achieves; it is configured with ad personalization turned off, so it is not used to build advertising audiences or to show you ads elsewhere. If you choose Decline, neither is loaded.

Communications. If you email us we keep the correspondence so we can respond and keep a record of support requests.

2. How we use it and our legal bases

We use the information in Section 1 to:

provide the service — create and secure your account, run your workspaces, process API requests, and send the emails the service depends on (verification, password reset, invitations, receipts and important notices). Legal basis: performance of our contract with you.
bill you for paid plans, through Stripe. Legal basis: contract, and our legal obligations to keep financial records.
keep the service secure — detect and prevent fraud, abuse and unauthorized access, rate-limit requests, and investigate incidents. Legal basis: our legitimate interest in protecting the service and its users.
improve the service — understand which features are used and where errors occur. Legal basis: legitimate interest, and your consent for website analytics.
measure our advertising — learn which of our ads lead to sign-ups. Legal basis: your consent.
communicate with you about your account, changes to the service or these terms, and support requests. Legal basis: contract and legitimate interest.
comply with law — tax, accounting and lawful requests from authorities. Legal basis: legal obligation.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use the information in Section 4 for any of our own purposes.

3. Cookies and similar technologies

Strictly necessary cookies keep you signed in and protect forms from cross-site request forgery. They cannot be turned off, because the service does not work without them. They include:

the dashboard session cookie, which lasts up to 30 days or until you sign out;
short-lived cookies used during sign-in with an external provider (around 10 minutes);
on hosted sign-in, consent and customer-portal pages, cookies prefixed b316_ that protect each form and bind a sign-in flow to the browser that started it. These last between 10 minutes and the length of the session.

Preference cookies remember choices such as your language (NEXT_LOCALE), the environment you last selected, whether the sidebar is collapsed, and your cookie choice (consent, 30 days).

Analytics and advertising-measurement cookies (_ga and _ga_*, set by Google Analytics, and _gcl_*, set by the Google Ads tag) are used on base316.com only if you choose Allow. To change your choice, clear the consent cookie for base316.com in your browser and the banner will ask again.

Applications that use Base316's browser SDK may store an End User's session token in the browser's local storage. That is controlled by the application's developer.

4. Information we process for our Customers

Customers use Base316 to store and process information about their End Users. Depending on which features a Customer uses, this can include:

identity: name, email address, phone number, profile picture, an identifier from the Customer's own system, and any additional fields the Customer defines;
credentials and security: password hashes, passkeys, two-factor authentication factors, sessions, sign-in history with IP address and user agent, and accounts linked from sign-in providers such as Google, Apple or Microsoft;
organizations and roles the End User belongs to;
billing: customer accounts, subscriptions, invoices, payment method details (card brand, last four digits and expiry — never the full card number, which stays with the payment processor), credits and wallet balances;
usage events that the Customer's application sends for metering, which can contain any data the Customer chooses to include;
records in data collections the Customer defines;
delivery logs for the emails and text messages sent on the Customer's behalf;
identity verification results. When a Customer uses identity verification, the End User's identity document and selfie are collected and checked by Stripe; Base316 stores only the verification status.

For this information, the Customer is the controller and Base316 is its processor. We process it only to provide the service to that Customer, on the Customer's documented instructions, and under our Terms of Service. Customers are responsible for having a lawful basis to collect it, for giving End Users any required notice, and for responding to End Users' requests. Base316 gives Customers tools to do this, including exporting everything held about an End User and erasing an End User on request.

Enterprise customers may request a data processing agreement by contacting us.

5. Text messages (SMS)

Base316 sends text messages only to deliver one-time verification codes: to sign in with a phone number, to verify a phone number, or as a second sign-in factor. A code is sent only when someone requests one on a sign-in or verification page, or when a Customer sends a test message to their own number. We do not send marketing or promotional text messages.

A typical message reads: "Acme code: 482913. It expires in 10 minutes. Do not share it with anyone."
We record each message's destination number, purpose and delivery status so Customers can troubleshoot delivery and so we can prevent abuse.
Mobile phone numbers, and the consent given to receive text messages, are never shared with or sold to third parties or affiliates for marketing or promotional purposes. We share them only with the carrier and messaging provider (Twilio) needed to deliver the message.
Reply STOP to stop receiving messages from a number, or HELP for help. Message and data rates may apply.

Our SMS Terms describe the program in full.

6. Who we share information with

We share personal information only with the service providers that help us run Base316 ("subprocessors"), under contracts that require them to protect it and use it only to provide their service to us:

Amazon Web Services (United States, us-east-2): hosting, database, file storage, email delivery (Amazon SES), and encryption key and secret storage.
Stripe: payment processing for Base316's own plans; payment collection for Customers who connect a Stripe account; identity verification.
Twilio: delivery of text messages.
Google: website analytics and advertising measurement (only with your consent), and sign-in with Google if you choose it.
GitHub: sign-in with GitHub, if you choose it.
Anthropic: the AI setup assistant in the dashboard, only when you use it. What you type into the assistant, and a summary of your environment's configuration, are sent to Anthropic to generate a response.
Let's Encrypt (and, as a fallback, ZeroSSL): issuing TLS certificates for custom domains that Customers connect. They receive the domain name only.

We also share information:

at a Customer's direction — for example, to the webhook endpoints, log destinations, single sign-on providers and payment accounts a Customer configures. Those destinations are chosen and controlled by the Customer;
when the law requires it, or when it is necessary to protect the rights, property or safety of Base316, our users or others. Where we can, we will tell the affected Customer first;
in a business transfer, such as a merger, acquisition or sale of assets, in which case this policy will continue to apply to the information transferred.

7. International transfers

Base316 is operated from, and stores data in, the United States. If you use Base316 from outside the United States, your information will be transferred to and processed in the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.

8. How long we keep information

Account information is kept while your account exists. When you delete your account or a workspace, we delete it, together with every project, environment and End User record in that workspace, except for what we must keep for the reasons below.
Audit logs are kept for 365 days.
Sign-in history, webhook history and text-message delivery logs are kept for a period set by the workspace's plan: 7 days on Free, 90 days on Pro, 400 days on Scale, and as agreed on Enterprise.
Short-lived security records — sign-in codes, verification challenges and pending authorization requests — are deleted automatically once they expire, usually within minutes to hours.
Usage events are kept for as long as the Customer's workspace exists, so a corrected meter definition can be recalculated over past usage. Customers can delete them by deleting the workspace.
Invoices and payment records are kept as long as tax and accounting law requires, even after an account is deleted.
Backups are kept for a limited period and then overwritten. Deleted information can remain in backups until they expire.

9. Security

We protect information with measures appropriate to its sensitivity, including:

encryption in transit (TLS) for all connections;
AES-256-GCM encryption for stored third-party credentials, such as the API keys and tokens Customers connect;
one-way hashing of passwords, secret API keys, session tokens and verification codes, so the values cannot be read back;
tenant isolation, so that one Customer's credentials can never be used to reach another Customer's data;
rate limits, lockouts and abuse protections on sign-in and messaging;
audit logging of significant actions.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as the law requires.

10. Your rights and choices

Depending on where you live, you may have the right to:

know and access the personal information we hold about you, and receive a copy in a portable format;
correct inaccurate information;
delete your information;
object to or restrict certain processing, and withdraw consent where processing is based on consent;
opt out of the sale or sharing of personal information. We do not sell or share it;
not be discriminated against for exercising these rights.

You can update most account information in your account settings, and delete your account there too. For any other request, email aisupport@thinkfleet.ai. We will verify your identity before acting on a request and respond within the time the law requires (generally 30 days, or 45 days under California law). You may use an authorized agent to make a request on your behalf.

If you are an End User of an application built on Base316, please send your request to that application's owner, who controls your information. If you contact us instead, we will forward your request to them where we can identify them.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to complain to your local data protection authority.

11. Children

Base316 is a service for businesses and is not directed at children. You must be at least 18 years old to create a Base316 account. We do not knowingly collect personal information from children under 13 as a controller. If you believe a child has given us personal information, contact us and we will delete it. Customers whose applications are used by children are responsible for complying with the laws that apply to them, such as COPPA.

12. Changes to this policy

We may update this policy as the service changes. When we do, we will change the effective date above. If a change is material, we will notify account holders by email or in the dashboard before it takes effect.

13. Contact us

Thinkfleet AI, LLC (Base316) North Carolina, United States Email: aisupport@thinkfleet.ai