BaseFrame procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ This section provides additional information regarding our processing of Personal Information of people located in the European Union (EU), European Economic Area (EEA), Switzerland, and the United Kingdom (UK) in accordance with the EU General Data Protection Regulation (GDPR), UK Data Protection Regulation, and the Swiss Federal Data Protection Act. For transfers from the EEA, United Kingdom, or Switzerland, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses, adequacy decisions, or other lawful bases.” | Captured 2026-07-19Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Our Services are hosted in the United States of America. If you choose to use our Services from a different jurisdiction, please note that your Personal Information may be transferred to and stored in the United States of America. By providing your Personal Information, you consent to the transfer and processing of your information in accordance with this Policy.” | Captured 2026-07-19Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Lodge a Complaint: The right to lodge a complaint with a supervisory authority or other regulatory agency if you believe we have violated any of the rights afforded to you under applicable data protection laws. We encourage you to first reach out to us so we have an opportunity to address your concerns directly before you do so. Global Privacy Control (GPC): You may also exercise your opt-out rights by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC). We honor Opt-Out Preference Signals, including GPC. If you choose to use an Opt-Out Preference Signal, you will need to turn it on for each supported browser or browser extension you use.” | Captured 2026-07-19Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) or equivalent laws: Data Controller: BaseFrame Inc. is the data controller for Personal Information processed in connection with the Services. Data Protection Officer: Not applicable. Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe we have violated your privacy rights. We encourage you to contact us first so we can address your concerns.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose information to third parties in the following circumstances: Service Providers: We may engage third-party service providers to assist in providing hosting services or other services necessary for the operation of the Services. These service providers may have access to or process your information as part of providing those services for us. They are contractually obligated to protect your information. Key service providers include: Clerk : account authentication and identity management. Stripe : payment processing and subscription billing. Composio : integration infrastructure that brokers connections to third-party services (Gmail, Slack, Linear, and 46+ others). When you connect a third-party service, a per-user entity is created in Composio on your behalf. All Composio API requests are routed through BaseFrame's servers. Google Cloud Platform : cloud infrastructure, database, and serverless compute hosting. Meta Platforms, Inc. : advertising measurement and audience building via the Meta Pixel (browser-side) and Meta Conversions API (server-side). On our public website only. Server-side events are sent for signup, demo requests, downloads, and subscription billing milestones, and include hashed email, IP address, user agent, and the Meta browser cookies (_fbp, _fbc) when present. See Section 5 for details and the opt-out path. RB2B, Maverick, and Delivr AI : marketing analytics and visitor identification on our public website only (subject to your cookie consent). ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ AI Providers: When you use AI agents, your prompts and instructions may be processed by third-party AI providers (such as Anthropic, OpenAI, or other providers you select) pursuant to your API key and their terms of service. BaseFrame does not control how AI providers process this data, and such processing is governed by the applicable AI provider’s terms and privacy policy. Connected Services: When you connect third-party services, information is shared with those services as necessary to enable the integration. Such sharing is governed by the terms and privacy policies of those services. Business Purposes: We may make certain information available to third parties for various purposes, including compliance with reporting obligations or for our business purposes. Any such disclosure will be in accordance with applicable laws and regulations. Legal Requirements: We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, respond to a court order, judicial or other government subpoena or warrant, or to cooperate with law enforcement or other governmental agencies. Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, we may transfer your information to the acquiring entity as part of the transaction. Affiliates: We may share Personal Information with our affiliates, subsidiaries, and branch offices to which it is reasonably necessary or desirable for us to disclose Personal Information for the purposes mentioned above. With Your Consent: We may share information with your consent or at your direction.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Third-Party Service Data: When you authorize connections to third-party services (such as email, messaging, calendars, file storage, development tools, or other applications), data from those services may be accessed and processed by the Desktop Application to enrich workflow analysis. This data may include: email and calendar metadata; contacts and address books; calendar events and scheduling information; files and documents; usage data from connected applications; and any other data accessible through the APIs of those services. Note: Third-party service connections are brokered through Composio, an integration infrastructure provider. A per-user entity is created in Composio on your behalf when you connect a service. All Composio operations are proxied through BaseFrame's servers, so your credentials are never exposed to Composio directly. Microsoft Account: When you connect a Microsoft account, an OAuth access token is stored encrypted in BaseFrame's cloud database to enable persistent access to Microsoft services (Outlook, Teams, OneDrive, etc.). This token is used only to fetch data for workflow analysis on your behalf.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Services may contain features or links to websites and services provided by third parties. Any information you provide on third-party sites or services is subject to those operators’ privacy and security policies. We encourage you to review the privacy policies of those third parties before providing them with any information. We are not responsible for the privacy practices of third parties.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “The Meta Pixel may share your IP address, browser information, page URL, interaction events, and the Meta browser cookies (_fbp, _fbc) with Meta. Meta may combine this information with other data they collect about you. We also pass your Clerk user identifier (after sign-in) as an “external_id” to help Meta match events across devices. You can manage your Meta ad preferences at facebook.com/settings?tab=ads . Meta Conversions API (CAPI): In addition to the browser-side Pixel, we send certain conversion events to Meta server-side via the Meta Conversions API. This includes event types such as Lead (demo request), CompleteRegistration (signup), DownloadStarted (desktop app download), Subscribe (subscription started), and Purchase (subscription payment). For each event, we send the event name, a unique event identifier (used for de-duplication with the browser Pixel), the page URL, an action source, and user-data fields that we hash with SHA-256 before transmission: email address, phone number (when provided), first and last name (when provided), Clerk user identifier (“external_id”), country code, and the Meta browser cookies (_fbp, _fbc) when they exist. We also include the request IP address and user agent. Meta uses these events for ad delivery optimization, conversion measurement, and audience building. Limited Data Use (LDU): For visitors whose IP indicates California or another applicable jurisdiction, we instruct Meta to process events under their Limited Data Use mode, which restricts Meta’s secondary use of the data per CCPA/CPRA requirements. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “See Section 5 for details. Rewardful : affiliate-program attribution on our public website only (subject to your cookie consent). PostHog : product analytics, session recording (with inputs masked), and feature-flag delivery (subject to your cookie consent). Clerk : identity, authentication, and user management for signed-in users. Clerk stores email, hashed passwords (if used), and basic profile information.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ RB2B: We use RB2B to identify anonymous business visitors to our website. RB2B may match website visitors against a third-party business contact database and share identifying information (such as company name and professional contact details) with us. RB2B operates only within the United States and only on visitors associated with a business context. You may request opt-out at rb2b.com/privacy . Maverick: We use Maverick (Maverick Intelligence) to personalize website content and analyze visitor intent. Maverick may collect browsing behavior and device information to power its personalization features. Delivr AI / Sitelytics: We use a Delivr AI tracking pixel served via sitelytics.tech to attribute traffic and measure the effectiveness of marketing channels. Rewardful: We use Rewardful to attribute affiliate-program referrals. Rewardful sets first-party cookies to identify the referring affiliate when a visitor lands on our site via an affiliate link, and records that attribution when the visitor signs up or pays. Marketing Attribution Storage (first-party): When you arrive at our site from an advertising campaign, we store the URL parameters identifying that campaign (UTM tags and click identifiers such as fbclid, gclid, msclkid, ttclid) in your browser’s local storage so that we can correctly attribute a later signup to its original source. These values stay on your device until you opt out, sign up (at which point they are sent to our servers to be associated with your account), or clear your browser data.” | Captured 2026-07-19Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.