Privacy Policy

This Privacy Policy explains how Basis (“Basis”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal data when you visit basis.hk, create an account, or use our marketing Operators platform and related services (together, the “Services”).

We operate from Hong Kong. For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”), Basis is a data user in respect of personal data we control. Enquiries: [email protected].

Depending on how you interact with us, we may collect:

• Account and identity data: name, email address, password (hashed), company or brand name, role, and profile preferences.
• Billing and commercial data: subscription plan, invoices, and payment-related information processed by our payment providers (we do not store full card numbers on our servers).
• Workspace and content data: brand context, briefs, prompts, drafts, uploads, and other materials you submit to the Services.
• Usage and device data: IP address, browser type, device identifiers, pages viewed, referring URLs, and approximate location derived from IP.
• Communications: messages you send to us (including demo and contact requests) and related support records.

We use personal data for purposes directly related to the Services, including to:

• create and manage accounts, authenticate users, and provide the Services;
• generate and store Operator outputs based on your briefs and brand context;
• process subscriptions, invoices, and customer support;
• improve reliability, security, and product features;
• send service notices (verification, security, billing) and, where permitted, product updates;
• comply with applicable law and enforce our Terms of Service.

We will not use personal data for a new purpose that is not directly related to the original purpose of collection without your prescribed consent, except where the PDPO or other applicable law permits.

We collect and use personal data in accordance with the PDPO, including the Data Protection Principles. Where we rely on consent, you may withdraw it (subject to legal or contractual restrictions). Where processing is necessary to perform a contract with you, to take steps at your request before entering a contract, or to comply with legal obligations, we process on that basis.

We use cookies and similar technologies that are necessary for authentication, session security, and core site functionality. We may also use analytics and marketing cookies to understand how the Services are used and to measure campaigns.

When you first visit our site, you can accept all cookies, reject non-essential cookies, or manage preferences by category. You can change your choice at any time via Cookie preferences in the site footer, or through your browser settings. Disabling certain cookies may limit features such as staying signed in.

We may share personal data with:

• service providers who help us host, authenticate, send email, process payments, provide AI model inference, or analyse usage, under contractual obligations to protect the data;
• professional advisers and auditors where reasonably required;
• authorities or other parties when required by law, or to protect rights, safety, or the integrity of the Services;
• a successor entity in connection with a merger, acquisition, or asset transfer, subject to appropriate safeguards.

Some providers may process data outside Hong Kong. Where we transfer personal data outside Hong Kong, we take steps we consider reasonable and practicable to ensure the data will not be processed in a manner that would contravene the PDPO, including contractual protections with processors where appropriate.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide the Services, meet legal, accounting, or reporting requirements, and resolve disputes. When data is no longer required, we take steps to erase or anonymise it, unless longer retention is required or permitted by law.

We implement technical and organisational measures designed to protect personal data against unauthorised or accidental access, processing, erasure, loss, or use. No method of transmission or storage is completely secure; please use a strong unique password and notify us promptly of any suspected unauthorised access to your account.

Subject to the PDPO, you may request:

• access to personal data we hold about you;
• correction of personal data that is inaccurate;
• information about our policies and practices in relation to personal data and the kinds of personal data we hold.

To exercise these rights, email [email protected] with sufficient detail for us to verify your identity and locate the relevant data, or submit a data deletion request. We may charge a reasonable fee for data access requests where permitted by the PDPO. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) if you believe your rights have been infringed.

The Services are directed at business users and are not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected such data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Material changes will be highlighted on this page or notified through the Services or by email where appropriate. Continued use of the Services after an update constitutes acceptance of the revised policy, except where consent is required by law.

For privacy questions, access or correction requests, or complaints, contact:

Basis
Email: [email protected]
Location: Hong Kong Special Administrative Region

To request erasure of personal data, use our data deletion form. See also our Terms of Service.