This describes what Base actually stores, which is a shorter list than most policies of this kind. Where a section says we do not collect something, that is a statement about the code, not an aspiration.
Two groups of people, with different data:
| Data | Why |
|---|---|
| Email address, name | To identify your account, sign you in, and contact you about the service. |
| Password | Stored only as a salted hash. We cannot read it. |
| Session tokens, API keys, OAuth authorization codes and access tokens | Stored only as SHA-256 hashes, never in plain text. A stolen copy of our database does not yield a working credential. |
| Workspace membership and role | To decide what you can see and change. |
| Abuse signals — rate-limit events, suspension records, automated content scans | To keep the free tier from being used to host phishing forms. Retained while the workspace exists. |
Your bases, tables, rows, columns, views, comments, forms, automations, uploaded files, and the change history behind them. This is your data. We store it to provide the product and do not use it to train any model, ours or anyone else's.
When someone submits a form you published, Base stores the answers they gave, plus a small amount of context for spam and abuse handling:
If you collect personal information through a Base form, you are responsible for telling your respondents what you collect and why, and for having a lawful basis to do so.
When you connect Base to an AI assistant over MCP, the assistant sends us the arguments for the specific tool it is calling — a table id, a row of values, a SQL query. That is all we receive.
Base does not read, request, or store your conversation history, the assistant's memory, its conversation summaries, or files you uploaded to it. It does not log conversation content: there is no request-body logging on the MCP or OAuth paths at all.
We do not use advertising pixels, and we do not sell or share anything for advertising. We do
use one third-party analytics tool, PostHog, across the site — our public pages, the signed-in
application, and the public form pages at /f/… — to understand which features get
used and to decide which of them to turn on for whom. It sets its own cookies.
On the form pages we run it in a reduced mode: we record that a form page was viewed, and we do not record what you type into it. Autocapture and session recording are both switched off there, and because nothing identifies you, no profile is created for you. If you are filling out a form, the answers you enter go to the person whose form it is — not to us as analytics.
The cookies Base itself sets are base_session, which keeps you signed in and is
strictly necessary for the product to work, and PostHog's analytics cookies described above.
To run the product: authenticate you, store and return your data, deliver your forms, fire your automations, and bill you if you are on a paid plan. To keep it working and safe: rate limiting, spam filtering, abuse investigation, and debugging. To contact you about the service. That is the complete list. We do not sell personal data, and we do not share it for advertising.
Base runs on a deliberately small number of vendors. Each one below receives data only to perform a function for us.
| Service | What it receives |
|---|---|
| Cloudflare (Workers, Durable Objects, D1, R2, Turnstile, Email Routing) | Hosting, storage, and delivery for everything above. All customer data lives here. |
| Cloudflare Workers AI | The text of a form submission is sent to a Llama model hosted by Cloudflare to score it for spam before it reaches your inbox. This is the one place submission content is processed by a model. It is not used for training. |
| WorkOS (AuthKit) | Email address and name, if you sign in with SSO. |
| Airtable | Only if you run a migration. You approve a read-only connection on Airtable's own consent screen — we ask for schema.bases:read and data.records:read and nothing else — or you supply an access token yourself. Either way the credential is held in a secure, HTTP-only cookie for the length of the migration and dropped when it finishes; we never ask Airtable for a refresh token and store nothing. We only read the base you asked us to copy, and never write to Airtable. |
| PostHog | Product analytics for the whole site: pages viewed, features used, and — once you sign in — your user id, email, name and workspace, so we can tell which customers a feature is on for. On public form pages it records the page view only, with autocapture and session recording off, so the answers you type into a form are never sent to it. Not used for advertising, and not used to train models. |
| Google Fonts | Our public pages load web fonts from Google, which sees the requesting IP address. The signed-in application does not. |
| Composio | Only if you connect an integration. Composio holds the OAuth tokens for the apps you connect and runs the tool calls those automations make. We send our user id so the connection is yours; we do not store the provider tokens ourselves. Only the apps on our allowlist can be connected. |
| Webhook endpoints you configure | If you build an automation, Base sends the rows and events you selected to the URL you chose, signed. You control that destination and what happens to the data there. |
We may also disclose data if we are legally required to, or to protect the rights and safety of our users. We will tell you unless we are legally prevented from doing so.
Data is stored on Cloudflare's global network and processed wherever their edge serves your requests, which may be outside your country.
Everything is served over HTTPS. Passwords are hashed; session tokens, API keys and OAuth tokens are stored only as hashes. MCP access uses OAuth 2.1 with PKCE and scoped tokens, and tokens passed in a URL query string are rejected outright rather than accepted. The SQL query tool can reach only generated per-table views, enforced server-side by several independent checks, and every query is rolled back regardless of what it contains.
No system is perfectly secure, and we do not hold a SOC 2 report today. We say so plainly rather than implying otherwise.
You can access, correct, export, or delete your data at any time — most of it directly in the product, and the rest by asking us. Depending on where you live you may also have the right to object to or restrict processing, to portability, and to complain to your data protection authority. Email us and we will action it; we do not charge for this and we do not make it hard.
To disconnect an assistant, revoke its access in that assistant's connector settings — the token stops working immediately and is unusable once it expires.
Base is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us information, email us and we will remove it.
If we change this policy materially, we will update the date above and email account holders before the change takes effect.
Privacy questions, data requests, and security reports all go to support@bips.ai. We aim to reply within a few business days, and we investigate reported vulnerabilities in good faith — tell us privately first and we will not come after you for it.