Privacy policy

1. Who we are

Basecourse LLC is a limited liability company registered in Wyoming, USA ("Basecourse", "we", "us"). We build custom operations software and AI solutions for businesses, mainly construction contractors, retailers and food and beverage operators. This policy covers our website, basecourse.io, and the software and messaging services we provide to client businesses. For anything in this policy, write to hello@basecourse.io.

2. Our two roles

Our own website and business contacts

When you visit basecourse.io, send us an enquiry or deal with us as a prospective or current client, we decide how and why that data is used and we are responsible for it. Sections 3 to 9 describe what we do with it.

Services we provide to client businesses

When a client runs software or messaging that we built or operate for it, we process data on the client's behalf and on its instructions. The client decides what data is collected, who is messaged and for what purpose. The client is responsible for giving its own staff, customers and suppliers the notices they need and for obtaining any consent that applies, including a person's opt-in to receive WhatsApp messages from that business.

If a business you deal with uses a system built by Basecourse and you have a question about your data, please contact that business first. It holds the relationship with you and can act on your request directly. Section 9 explains what we do when a request reaches us instead.

3. Data we handle

Website enquiries

If you use the contact form, book a call or email us, we receive what you give us: your name, company, sector, email address, phone number if you add one, and whatever you write about your work. We also keep the correspondence that follows. The server that delivers these pages records basic request data, such as IP address, browser type, page requested and time, which our hosting provider keeps to operate and secure the service.

Apart from the WhatsApp onboarding page described below, the website itself sets no cookies, runs no analytics or advertising scripts, loads nothing from third parties, and does not call any AI model.

Client account users

People who sign in to a client's system have an account with their name, email address, role and login records such as sign-in times and IP addresses, plus the activity records the system needs for security and audit.

Operational data

Clients enter their own business data into the systems we build: orders, bookings, quantities, invoices, staff and supplier records, site and plant information, and similar. Some of this is personal data about the client's staff, customers or suppliers. The client owns this data and decides what goes in.

WhatsApp messaging data

Where a client connects its WhatsApp Business Account to our software, we handle the data needed to send and receive messages for that client: phone numbers, names and WhatsApp profile names, message content and any media attached, delivery and read status, message templates, and the identifiers of the client's WhatsApp Business Account.

WhatsApp onboarding page

A client business connects its WhatsApp Business Account to our software on the page basecourse.io/connect. That page loads Meta's JavaScript software to open Meta's own sign-up window, so on that page Meta receives your IP address and browser details and may set cookies, under Meta's own privacy policy. When the sign-up is completed we receive the identifiers of the business portfolio, WhatsApp Business Account and phone number that were shared with us, and an authorisation code that we exchange for an access token limited to those assets. No other page of this website loads third-party code.

4. How we use it

We use personal data to provide, secure, support and improve the services we deliver to the client concerned, and to answer enquiries and manage our relationship with clients. In practice that means running the system, keeping it available and safe, fixing problems, and answering the client's support questions.

• We do not sell personal data.
• We do not use personal data for advertising, and we do not send marketing email.
• We do not use one client's data for another client, or combine data across clients.
• We do not use client or website data to train AI models.

We may also disclose information where the law requires it, or to protect our rights or someone's safety.

5. Service providers

We rely on a small number of service providers, each bound by its own terms to use the data only to provide its service:

• Meta Platforms (WhatsApp Business Platform): carries WhatsApp messages between a client's WhatsApp Business Account and the people it messages. WhatsApp's own terms and privacy policy apply to the WhatsApp service itself.
• Supabase: database, authentication and file storage for the systems we build.
• Vercel: hosting for this website and for client applications.
• Cloudflare: DNS and network services.
• Google Workspace: business email, including hello@basecourse.io.
• AI model providers, where a client's solution includes AI features.

This list may change as the services develop. We tell clients about material changes to the providers that handle their data.

6. International transfers

Basecourse is a US company working from Kuwait and the United States, and our providers operate worldwide. Personal data may therefore be processed in the United States and in other countries where these providers operate. Where data protection law requires it, we rely on our providers' standard contractual terms or equivalent safeguards for these transfers.

7. How long we keep it

• Data we hold for a client is kept for the duration of the client relationship and then deleted or returned to the client, as the client agreement provides.
• Website enquiries and business correspondence are kept as long as needed to respond and follow up, and as long afterwards as tax and contract law require if an engagement follows.
• Request logs are kept for the hosting provider's standard retention period, which is short and not controlled by us.

8. Security

Data is encrypted in transit. Access to client systems and their data is controlled by role, limited to the people who need it for their work, and reviewed as engagements change. Client data lives in the client's own project on our providers, separated from other clients. How we protect client systems is described in more detail on the data & security page. No system is immune to every risk, so if you believe your data has been exposed, please tell us straight away.

9. Your rights and data deletion

Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You will not be treated differently for using these rights.

To request access, correction or deletion, email hello@basecourse.io with the subject "Data request", say what you are asking for, and tell us which business or system your data relates to, for example the company you dealt with and the phone number or email address you used. We may ask you to confirm your identity before we act. We respond within 30 days. Where the data is ours to delete, it is removed from the systems we operate within that time, and from our backups as they roll over in their normal rotation. The data deletion page sets out the steps.

Data held on behalf of a client. If your data sits in a system we run for a client, such as a client's WhatsApp messages or its operational records, the client decides what happens to it. We pass your request to that client without delay and act on its instructions. You may find it faster to contact that business directly.

What deletion covers. When we delete data, we remove it from the systems we operate and from our own backups within their normal rotation. We cannot remove copies held by the client on its own devices or accounts, or data held by WhatsApp itself, which is governed by Meta's policies. Clients may also ask us to delete all of their data when an agreement ends.

10. Children

Our website and services are for businesses. They are not directed at children, and we do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

If we change this policy, we will update it here and change the date at the top. If a change materially affects how we use data we already hold, we will tell our clients, and where we hold your data directly, we will tell you.

12. Contact

Basecourse LLC, Wyoming, USA. Email hello@basecourse.io for any question about this policy or about your data.