Privacy policy

This policy explains which personal data we process when you visit this website (basepilot.de) and when you use the BasePilot console (console.basepilot.de), for which purposes and on which legal basis, and which rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Phone: +49 1556 7026442
Email: hi@basepilot.de

Please send data protection enquiries to the email address above.

2. Visiting this website

Server log data

When you open this website, your browser transmits technically necessary data to our server: IP address, date and time of the request, the address requested, the amount of data transferred, the page visited before (referrer), and information about browser and operating system. We process this data to deliver the website, to keep it stable and secure, and to defend against attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure operation of the website. Log data is stored only for as long as these purposes require and is deleted afterwards.

No cookies, no tracking

This website sets no cookies and uses neither analytics nor marketing tools. Fonts, graphics and scripts are served from our own server; no third-party content is embedded. A consent banner is therefore not required.

3. Contacting us

If you contact us by email or phone, we process the details you provide (name, contact details, content of the enquiry) in order to handle your request. The legal basis is Art. 6 (1) (b) GDPR where the enquiry aims at a contract or concerns an existing contract, and otherwise Art. 6 (1) (f) GDPR. We delete the enquiry once it has been dealt with conclusively and no statutory retention obligations apply.

4. Using the console

Registration and user account

A user account is required to use the console. We process your name, your email address and a password, which is stored exclusively as a cryptographic hash. If you set up two-factor authentication or passkeys, we store the key material required for them. The legal basis is Art. 6 (1) (b) GDPR.

Sign-in through third parties

Where the console offers it, you may sign in with an existing account at Google (Google Ireland Limited, Ireland) or GitHub (GitHub, Inc., USA). In that case we receive your name, your email address and, where applicable, your profile picture from the provider; the provider learns that you are signing in to BasePilot. Using this option is voluntary. The legal basis is Art. 6 (1) (b) GDPR. The provider's own privacy notice applies to its processing.

Sessions, cookies and local storage

The console uses only technically necessary cookies and entries in your browser's local storage: for the sign-in session and for display settings such as the colour scheme. For each session we store the IP address and the browser identifier in order to list sessions, detect misuse and limit sign-in attempts. The legal bases are § 25 (2) no. 2 TDDDG and Art. 6 (1) (b) and (f) GDPR.

Organizations, members and activity log

Within an organization we process the assignment of members and their roles. If you invite another person, we process that person's email address to deliver the invitation. Changes to clusters, users and settings are recorded in an activity log (acting person, action, time) so that the organization can trace what happened. The legal basis is Art. 6 (1) (b) and (f) GDPR.

Emails concerning the contract

We send you the emails that are necessary for using the service: confirmation of the email address, password reset, security notices, invitations, and notifications about clusters, backups and credit. The legal basis is Art. 6 (1) (b) GDPR. We do not send promotional newsletters.

5. Billing and payments

For billing we process the usage data of your clusters (type, size, running time), the balance and movements of your credit, and the details required for invoicing. Payments are handled by the payment service provider Mollie B.V., Amsterdam, the Netherlands. You enter payment details such as card or account numbers directly with Mollie; we only receive information about the payment itself (amount, time, status, payment method). The legal basis is Art. 6 (1) (b) GDPR, and for retention Art. 6 (1) (c) GDPR in conjunction with commercial and tax law.

6. Operating your database clusters

Infrastructure

Clusters we provide for you run on servers of Hetzner Online GmbH (Gunzenhausen, Germany) or UpCloud Oy (Helsinki, Finland) in the location you select when creating the cluster. Backups are written to object storage; the hostnames of the clusters are published through a DNS service. If you select a location outside the European Union, the data of that cluster is processed there on your instruction.

If you run clusters in your own cloud account or on your own servers, we store the credentials required for this in encrypted form and access those systems solely for the purpose of operating the clusters.

Content of your databases

We process the data you store in your databases exclusively on your behalf and on your instruction. Where this is personal data, you are the controller and we are the processor within the meaning of Art. 28 GDPR. We provide the data processing agreement required for this on request.

7. Recipients

We pass on personal data only to the extent necessary for the purposes stated. Recipients are:

• hosting and infrastructure providers on whose systems the website, the console and the clusters run,
• the service provider that delivers our emails,
• the payment service provider,
• the providers of third-party sign-in, if you use it,
• tax advisers and authorities, where we are legally obliged.

Data processing agreements pursuant to Art. 28 GDPR are in place with service providers that process data on our behalf.

8. Transfers to third countries

As a rule, we process personal data within the European Union. Data is transferred to third countries only if you select a cluster location outside the European Union or use sign-in through a provider based in the USA. In these cases the transfer is based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.

9. Retention

• We store account data until you delete your account.
• We keep billing and payment data for the statutory retention periods (up to ten years under § 147 AO and § 257 HGB).
• The servers of a cluster are deleted when you delete the cluster.
• Otherwise we delete personal data as soon as the purpose of the processing has ceased to apply and no retention obligations prevent it.

10. Your rights

Under the GDPR you have the following rights:

• access to the data stored about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on Art. 6 (1) (f) GDPR (Art. 21),
• withdrawal of consent with effect for the future (Art. 7 (3)).

To exercise your rights, a message to hi@basepilot.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI), Erfurt.

11. Obligation to provide data

Providing the data requested during registration and billing is necessary to conclude and perform the contract. Without this information we cannot make the console available to you.

12. Changes to this policy

We update this policy when our services or the legal situation change. The version published on this page applies. The contractual terms for using BasePilot are set out in ourterms of service.