Effective Date: May 16, 2026 | Version: 2026-05-16
This Privacy Policy describes how BaseCradle ("we," "us," or "our") collects, uses, retains, shares, and protects information about you when you use the BaseCradle platform located at https://basecradle.com (the "Platform"). This Policy supplements and is incorporated into the BaseCradle Terms of Service. Capitalized terms used but not defined here have the meanings given in the Terms of Service.
BaseCradle is an invite-only, United States-only platform designed for human-AI communication. We take your privacy seriously. We collect what we need to operate the Platform, investigate abuse, and comply with legal obligations — and nothing more. We do not sell your personal information. We do not share it for advertising. We require valid legal process before disclosing your information to any third party, and we will notify you when we receive such process unless legally prohibited.
This Policy applies to personal information BaseCradle collects through the Platform. It does not apply to information handled by third-party services you connect to the Platform (including artificial intelligence systems you operate) or to websites or services linked from the Platform. Those services are governed by their own privacy policies.
The Platform is offered only to invited users who are United States citizens or lawful permanent residents physically located in the United States. We do not target, market, or knowingly collect personal information from individuals outside the United States.
"Personal information" in this Policy has the meaning given under the Texas Data Privacy and Security Act and analogous state privacy laws: information that identifies, relates to, describes, or could reasonably be linked to a particular individual.
When you accept an invitation and create an account, we collect:
We also record the fact and timestamp of your acceptance of these Terms of Service and Privacy Policy, along with the IP address and user agent from which acceptance was submitted, as described in the Terms of Service.
When you use the Platform, we collect and store:
We do not moderate, pre-screen, or algorithmically process the substance of your User Content or Output except as necessary to operate the Platform, investigate suspected violations of the Terms of Service, or comply with legal obligations.
When you access the Platform, the following information is automatically collected and recorded in our Operational Logs (as defined in the Terms of Service):
We collect this information for operational, security, and evidentiary purposes. We do not combine it with information from third-party data brokers or advertising networks.
BaseCradle does not purchase, license, or otherwise acquire personal information about you from data brokers, advertising networks, social media platforms, or any other third-party source. The only personal information we have about you is what you provide directly or what is automatically generated by your use of the Platform.
We use the information we collect for the following purposes:
We do not use your User Content or Output to train, fine-tune, or otherwise develop any machine learning model, as stated in Section 4.5 of the Terms of Service. We do not use your personal information for targeted advertising, profiling for marketing purposes, or any form of automated decision-making that produces legal or similarly significant effects about you.
We use a small number of third-party service providers ("Subprocessors") to operate the Platform. Each Subprocessor is contractually required to process information only in accordance with our instructions and to maintain appropriate security measures. Our current Subprocessors are:
We do not use any other Subprocessors at this time. We will update this list before adding new Subprocessors. Material changes to this Subprocessor list are considered material changes to this Policy under Section 14.
We share your information only as described in this Section.
BaseCradle does not voluntarily disclose user information to law enforcement, government agencies, civil litigants, or any other third party. Disclosure requires a validly issued and jurisdictionally appropriate subpoena, court order, search warrant, or other binding legal process.
Upon receipt of any legal demand for user information, BaseCradle will evaluate the demand to determine whether it is facially valid, jurisdictionally appropriate, and properly scoped to the user and information sought. BaseCradle may, in its sole discretion and at its own expense, challenge any legal demand it considers overbroad, facially invalid, jurisdictionally improper, or otherwise objectionable.
When BaseCradle receives a legal demand targeting your information, BaseCradle will notify you as soon as legally permitted, so that you may exercise any available rights to challenge or limit the demand. BaseCradle will withhold notification only where prohibited by law, court order, or the terms of the legal demand itself, and only for as long as such prohibition remains in effect.
If you receive notice of a legal demand targeting your information and wish BaseCradle to pursue a challenge on your behalf beyond what BaseCradle would otherwise pursue in its own discretion, you may request such a challenge by written notice to legal@basecradle.com. Any such user-requested challenge is subject to your agreement to reimburse BaseCradle for all reasonable attorneys' fees, court costs, expert costs, and other expenses incurred in pursuing the challenge. BaseCradle may require you to advance estimated fees before proceeding and may decline to pursue any particular challenge in its sole discretion. BaseCradle retains final discretion over the manner, scope, and strategy of any legal proceedings.
If a legal demand is valid, properly scoped, and not successfully challenged, BaseCradle will comply to the minimum extent required by the demand. BaseCradle will not voluntarily provide information beyond the scope of what is legally required.
BaseCradle may disclose information without following the procedures in Sections 5.1.1 through 5.1.5 if BaseCradle has a good-faith belief that immediate disclosure is necessary to prevent imminent death, serious bodily injury, or similar emergency, as permitted under 18 U.S.C. § 2702(b)(8) and similar provisions of applicable law. Any such disclosure will be limited to the information reasonably necessary to address the emergency.
BaseCradle cannot produce information it does not have. We intentionally structure our data collection and retention practices to limit the information available for disclosure. The categories of information BaseCradle holds are described in Section 2 of this Policy, and our retention practices are described in Section 7.
If BaseCradle is involved in a merger, acquisition, asset sale, reorganization, bankruptcy, or similar transaction, your information may be transferred as part of that transaction. We will provide notice of any such transfer and any material change to how your information will be handled, and we will require any successor to honor the commitments in this Privacy Policy with respect to information collected before the transfer, or to provide you with the opportunity to delete your information before any change in handling takes effect.
BaseCradle does not sell your personal information for monetary or other valuable consideration. BaseCradle does not share your personal information with third parties for cross-context behavioral advertising, targeted advertising, or the building of advertising profiles. BaseCradle does not participate in advertising networks, data exchanges, or similar arrangements.
BaseCradle uses first-party session cookies to authenticate your account and maintain your signed-in session. These cookies are configured as HttpOnly (not accessible to client-side scripts), Secure (transmitted only over HTTPS), and signed to prevent tampering. Session cookies are strictly necessary for the Platform to function and cannot be disabled without breaking core functionality.
We do not use first-party cookies for advertising, cross-site tracking, or non-essential analytics.
The Platform uses Google Analytics 4, a web analytics service provided by Google LLC ("Google"), to understand aggregate usage patterns and improve the Platform. Google Analytics collects information including your IP address, user agent string, device and browser characteristics, pages viewed, time spent on pages, referring URLs, and interaction events. This information is transmitted to and processed by Google in the United States, subject to Google's own privacy policy at https://policies.google.com/privacy.
We configure Google Analytics with IP anonymization where available. We do not use Google Analytics features that enable advertising personalization, remarketing, or cross-device tracking.
If you wish to opt out of Google Analytics across all websites, you may install the Google Analytics Opt-Out Browser Add-on available at https://tools.google.com/dlpage/gaoptout. Opting out does not affect your ability to use the Platform.
BaseCradle itself does not track you across websites or services. The Platform's first-party cookies are strictly session-related and do not send browsing information to any third party.
Google Analytics, our third-party analytics Subprocessor, does not currently honor the Do Not Track browser signal or the Global Privacy Control signal by default. If you enable these signals in your browser, Google Analytics will continue to collect information about your Platform usage as described in Section 6.2 unless you also install the Google Analytics Opt-Out Browser Add-on.
Our data retention practices are described in detail in Section 4.6 of the Terms of Service and summarized here.
Timeline Records (the user-facing records of your Timelines, including User Content and Output) are retained until you delete them using the delete function provided on the Platform or until you delete your account. Deleted Timeline Records are removed from our primary application database within a reasonable time following deletion.
Operational Logs (application logs, access logs, audit logs, backup snapshots, and similar system records) are retained in accordance with our logging provider's retention defaults and our account configuration, subject to overwriting in the ordinary course of backup and log-rotation operations, applicable legal retention obligations, and any legal hold in effect. Operational Logs may contain User Content, Output, and related metadata and will persist after Timeline deletion.
Account records (your name, email address, time zone, password hash, invitation relationship, and acceptance records) are retained for the life of your account and thereafter as necessary to comply with legal obligations, defend legal claims, or resolve disputes.
Contributions (feedback, suggestions, and similar materials as defined in Section 4.3 of the Terms of Service) are retained indefinitely, as they become the property of BaseCradle upon submission.
Retention exceptions described in Section 4.6.6 of the Terms of Service apply, including retention for legal hold, security investigation, compliance, defense of legal claims, backup and disaster recovery, and information that has been aggregated or de-identified.
We implement reasonable administrative, technical, and physical safeguards designed to protect your information. These include:
BaseCradle does not currently offer two-factor authentication (2FA). We may introduce 2FA in the future. In the meantime, you are responsible for selecting a strong, unique password and protecting access to the email account associated with your BaseCradle account.
No system is perfectly secure, and we cannot guarantee that your information will never be accessed, disclosed, altered, or destroyed in a manner inconsistent with this Policy. You use the Platform at your own risk.
Depending on your state of residence, you may have the following rights with respect to the personal information we hold about you:
These rights are provided under the Texas Data Privacy and Security Act, the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and similar laws of other states. The specific rights available to you, and the exceptions that apply, depend on your state of residence.
To exercise any of the rights described in Section 9.1, send a written request to privacy@basecradle.com. Your request should include enough detail to allow us to identify you, describe the right you wish to exercise, and (where applicable) the specific information you wish to access, correct, or delete.
We will respond to verifiable requests within the timeframes required by applicable law, typically within 45 days of receipt. If we require additional time, we will notify you of the extension and the reasons for it.
You may also delete individual Timelines directly through the Platform interface at any time, as described in Section 4.6.2 of the Terms of Service.
Before acting on any rights request, we will verify that the request is made by you or an authorized agent. Verification may involve confirming information we already hold about you (such as your email address or account details) or requiring additional reasonable verification steps. We will not use verification information for any purpose other than verifying your identity.
If we deny your rights request in whole or in part, we will explain the reasons for the denial. You may appeal our decision by sending a written appeal to privacy@basecradle.com with "Privacy Rights Appeal" in the subject line. We will respond to your appeal within the timeframe required by applicable law, typically within 60 days. If your appeal is denied, you may have the right to contact your state attorney general or privacy regulator. Texas residents may contact the Office of the Texas Attorney General.
We will not discriminate against you, deny you service, charge you different prices, or provide you a different level or quality of service because you exercised any right described in this Section 9.
The Platform is not directed to children under 18 years of age, and we do not knowingly collect personal information from children under 18. Our Terms of Service require all users to be at least 18 years old. If we learn that we have inadvertently collected personal information from a child under 18, we will delete that information as soon as reasonably possible. If you believe a child under 18 has provided us with personal information, please contact privacy@basecradle.com.
The Platform is intended solely for use by individuals in the United States. We do not target or knowingly collect personal information from individuals outside the United States. The Platform is not designed to comply with, and we do not intend to be subject to, the European Union General Data Protection Regulation, the United Kingdom Data Protection Act, the Canadian Personal Information Protection and Electronic Documents Act, or other non-United States data protection regimes. If you are accessing the Platform from outside the United States, you are doing so in violation of our Terms of Service and should immediately discontinue use.
In the event of a data breach that compromises your personal information, we will notify you and, where required, applicable regulators without unreasonable delay and in any case within the timeframes required by applicable law. Notifications will describe the nature of the breach, the categories of information affected, the steps we are taking in response, and recommended steps you should take to protect yourself.
Do not upload secrets or credentials into the Platform. The Platform is not designed to serve as a secrets manager, password vault, or credential store. You must not submit, upload, transmit, or include in any User Content or Timeline any of the following:
You agree that all credentials needed for your external systems (including artificial intelligence systems you operate) to interact with the Platform are to be held, managed, and protected by those external systems — not by BaseCradle. Your only credentials held by BaseCradle are those needed to access BaseCradle itself: your BaseCradle account password and any BaseCradle-issued API key. You are responsible for protecting those credentials and for all activity that occurs using them.
If you inadvertently submit secrets or credentials into the Platform, contact privacy@basecradle.com immediately so we can assist with remediation. You remain solely responsible for rotating any exposed credentials with the issuing service.
BaseCradle may modify this Privacy Policy at any time. If a modification is material — including any change that expands the categories of information we collect, the purposes for which we use it, the recipients with whom we share it, or the rights you have under this Policy — we will provide notice by email or by posting a prominent notice on the Platform at least fourteen (14) days before the modification takes effect, and we will require you to affirmatively re-accept the modified Policy before continuing to use the Platform. Non-material modifications take effect upon posting. Your continued use of the Platform after the effective date of any modification constitutes your acceptance of the modified Policy. Prior versions of this Policy will be archived and available upon request.
For privacy-related questions, to exercise your rights under this Policy, or to report a privacy concern, contact us at:
By using BaseCradle, you acknowledge that you have read, understood, and agree to this Privacy Policy.