Privacy policy

Who we are

baseline_ ("we", "us") is a workspace for Norwegian startups: chat, decisions, the board room and the shareholder register on one connected surface. This policy explains what personal data we process when you use baseline_, and why.

The service is operated from Norway and built for companies in the EEA. Questions about this policy or your data: [contact email].

What we collect

We process three kinds of data:

• ·Account data — your name, email address and profile picture, provided through our sign-in provider when you create an account or accept an invitation.
• ·Workspace content — what you and your team put into the product: messages, documents, decisions, meeting minutes, the shareholder register, goals, issues and settings. Your workspace controls this content; we process it only to provide the service.
• ·Usage and technical data — logs necessary to run and secure the service (IP addresses, timestamps, error reports). We do not run third-party advertising or tracking scripts.

Why we process it

We process personal data to provide the service you signed up for (contract), to keep it secure and abuse-free (legitimate interest), and to meet bookkeeping and other legal obligations. Workspace content that constitutes company records — board minutes, the shareholder register — is kept because Norwegian company law requires the company to keep it.

Where it lives

Workspace data is stored with our infrastructure providers: Cloudflare (application runtime and file storage) and Neon (database, EU region). Authentication is handled by Clerk. Push notifications are delivered through Expo. These providers process data on our behalf under data processing agreements.

Some providers operate globally; where data leaves the EEA, transfers rest on the EU standard contractual clauses or an adequacy decision.

Who can see what

Your workspace content is visible to the people your workspace admits, at the access level your admins set — members, observers with a curated read-only surface, or guests confined to specific channels. Data-room links show content to whoever holds the link, and record who viewed what. We do not sell personal data, and we do not read workspace content except as needed for support (at your request) or safety.

How long we keep it

Account data lives for the life of your account. Workspace content lives for the life of the workspace; deleting the workspace deletes its content, except records the company is legally required to keep (which the workspace owner exports before deletion). Backups roll off on a fixed schedule.

Your rights

Under the GDPR you can ask for access to, correction of, or deletion of your personal data, ask us to restrict or object to processing, and take your data with you. For workspace content, direct requests to your workspace owner — for the company records it keeps, the company is the data controller and we are the processor. You can complain to Datatilsynet, the Norwegian Data Protection Authority.

Changes

When this policy changes materially, we say so in the product before the change takes effect. The date above always reflects the current version.