Privacy Policy

Two different roles

Almost every confusion about privacy in a hosting product comes from mixing up two things, so we separate them throughout:

• Account data — who you are, which organisation you belong to, what you did in the dashboard. We decide how this is used, which under the GDPR makes us the controller.
• Database content — the rows inside the Postgres databases you run on Baseway. You decide what goes in them and why. You are the controller; we are your processor and act on your instructions.

We do not read, query, mine, or train anything on the contents of your databases.

What we collect

Account and identity

Your name, email address, and whether that address has been verified. We authenticate with magic links, so we never hold a password for your Baseway account — there is nothing to leak. Sign-in links are single-use and expire.

Organisation and membership

Your organisation’s name and URL slug, who its members are, each member’s role, and any pending invitations, including the email address an invitation was sent to.

Sessions

For each active session we store a session token, its expiry, the IP address and browser user-agent it was created from, and which organisation is currently selected. The IP and user-agent exist so you can recognise and revoke a session you don’t recognise.

Activity log

Every state change is recorded: who acted, in which organisation, what action, against which object, and when. Some entries carry the detail needed to make them meaningful — a cluster name, a region, an error message, or the email address of a member who was invited, joined, had their role changed, or was removed.

Operational telemetry

We sample technical measurements from your clusters: CPU time, memory working set, database size in bytes, connection counts, container start time, and the timestamp of each sample. These describe the shape of your workload, never its content. Every measurement carries the time it was taken, and the dashboard shows that age rather than implying freshness.

Database credentials and import sources

We generate and store the roles and passwords your databases use, plus a passphrase used to encrypt your backups. These are held encrypted at rest with AES-256-GCM envelope encryption, not in plain text. When you import an existing database from a connection string, we store a redacted copy of that string for display, and the secret portion separately and encrypted.

Server logs

Our servers produce operational logs. Values under keys containing password, secret, token, or credentials are stripped before a log line is written or an error is surfaced.

Website analytics

Our public website uses Umami, an open-source analytics tool we run on our own instance rather than handing your visit to an advertising network. It records the page you viewed, the referring site, and coarse technical facts — browser, operating system, device type, screen size, and the country your request came from.

It sets no cookies and does not follow you between sites. Visitors are counted using a value derived by hashing your IP address together with your browser’s user-agent and a salt that rotates daily, so yesterday’s visitor cannot be matched to today’s. Your IP address itself is not stored. There is no profile, no advertising identifier, and nothing that can be sold.

The Baseway dashboard uses the same self-hosted, cookie-less Umami instance to count page views, and nothing more — no session recorder, no profile, and no third-party tracker watches what you do behind sign-in.

What we don’t collect

We run no advertising pixels and no cross-site trackers. There is no Google Analytics, no Segment, no Mixpanel, no Facebook pixel, and no session recorder. We set exactly one cookie, for your login session; the analytics described above set none, which is why you are not made to click through a consent banner.

Why we are allowed to hold it

Where it lives, and who else touches it

Your databases and their backups are stored in Falkenstein, Germany. Databases run on local NVMe storage on servers we operate; backups are encrypted with a per-cluster passphrase that we hold before they reach object storage.

These are every third party involved in running the service:

Hetzner is a German company, so your database contents live on German servers operated by a German provider — no US entity sits between your data and the disk. Cloudflare, Resend and Vercel are US-incorporated companies; they touch dashboard traffic, email addresses, and website analytics respectively, never your database contents. Where personal data is transferred outside the EEA, we rely on the European Commission’s Standard Contractual Clauses. We will update this list before adding or changing a subprocessor.

How long we keep it

How it is protected

• The control plane never dials in. Servers running your databases reach out to us over HTTPS with their own bearer token. Nothing opens a connection inward to your data.
• Credentials are encrypted, not stored. Database passwords and backup passphrases use AES-256-GCM envelope encryption. Server agent tokens are stored only as hashes.
• Connections are verified. Cluster endpoints require TLS with full certificate verification.
• Isolation. Each organisation gets its own namespace, and each cluster its own instance and its own backup repository.

No system is perfect. To report a vulnerability, email security@baseway.dev — we will not pursue anyone acting in good faith.

Your rights

If you are in the EU or UK you may request access to your personal data, a correction, deletion, a portable copy, or a restriction on how we use it, and you may object to processing based on legitimate interests. Email privacy@baseway.dev and we will respond within one month.

You can delete most of it yourself: removing a cluster purges its storage, and deleting your organisation removes its members and invitations. The activity log is deliberately harder to erase, because an audit record you can quietly edit is not an audit record.

You also have the right to complain to your local data protection authority.

Children

Baseway is a tool for software teams and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

When this policy changes we update the date at the top. For changes that materially affect you — a new subprocessor, a new category of data — we will tell you by email before they take effect.

Contact

[Registered company name], [Registered address]. Registered number [Company registration number]. Privacy enquiries: privacy@baseway.dev.