Basepedia is operated as a hosted application on the Base44 backend-as-a-service platform. For the purposes of data protection law, the entity that determines the purposes and means of processing your personal data (the “data controller”) is the organisation that publishes and administers the Basepedia application. When this policy refers to “we,” “our,” or “us,” it refers to that controller. Where the controller engages the Base44 platform provider or other sub-processors to store, transmit, or process data on its behalf, those parties act as data processors (or sub-processors) and are bound by written contracts that require them to protect your data to a standard no lower than that described in this policy and to process it only on the controller's documented instructions.

If you need to know the precise legal name, registered address, or contact details of the controller — for example, because you wish to lodge a complaint or exercise a data-protection right — you may request them through the contact channel described in the final section of this policy. We will provide that information without undue delay and in any event within the time limit required by applicable law. We do not reproduce a registered corporate address in this public document in order to avoid it being used for unsolicited marketing, but we will supply it to any verified data subject who asks.

Where we act jointly with another organisation to determine the purposes and means of processing — for example, when we launch a co-branded feature with an educational institution or a content partner — we will tell you, at or before the point of collection, who the joint controllers are, what each is responsible for, and how you can exercise your rights against each of them, in accordance with Article 26 of the GDPR.

This policy covers every channel through which Basepedia is delivered: the web application accessed through a browser; any native mobile application built from the same code base and distributed through app stores; any embedded widget, share link, or preview surface that displays Basepedia content; and the public model context protocol (MCP) server that exposes Basepedia data to AI assistants that you connect to your account. It also covers the administrative and back-office processing that supports those user-facing surfaces, such as account provisioning, billing, security monitoring, and abuse prevention.

This policy does not cover the practices of third-party services that Basepedia links to or integrates with — for example Wikipedia, Wikimedia Foundation, AI model providers, image services, analytics vendors, or the AI assistant clients that connect through our MCP server. Each of those services has its own privacy policy, which governs how it handles any data you send to it or that it collects about you when you interact with it. We provide a list of the principal third parties in the “Third-Party Services and Sub-Processors” section below, but the existence of that list does not make us responsible for their practices. We strongly encourage you to read their policies before using their services.

If you are under the age of 13 (or the equivalent minimum age in your country of residence), you may not use Basepedia, and we do not knowingly process the personal data of children below that threshold. The “Children's Privacy” section below explains what happens if we discover that we have inadvertently collected data from a child.

We collect only the personal data that is necessary for the specific features you choose to use — a principle known as data minimisation. The table below sets out, category by category, what we collect, the source from which we collect it, and whether providing it is mandatory or optional. “Mandatory” means the feature cannot function without it; “optional” means the feature will work without it and providing it is your choice.

3.1 Account and Identification Data (mandatory for registered users, optional for guests): When you register, we collect your email address (used as your login identifier and for account-recovery communications), your display name, and a role assignment (administrator or user) that determines which administrative actions your account may perform. Guests who never register do not provide this data, but they may still use the search, reading, and offline-caching features that operate entirely within their browser's local storage.

• Email address — used as the unique account identifier and for security notifications and account recovery.
• Full name or display name — shown on your profile and alongside notes and annotations you author.
• Role (admin or user) — determines whether you may invite other users, manage workspace membership, or perform administrative actions.
• Account creation date and last-updated date — system-generated timestamps used for auditing and support.
• Profile photo — optional; if you do not supply one, a generated placeholder is used.

3.2 Reading and Research Data (collected when you use the Service): This is the body of data that makes Basepedia useful to you — your saved articles, workspaces, notes, highlights, flashcards, quiz results, reading history, search history, reading goals, streaks, and achievement badges. This data is associated with your account so that it syncs across your devices and persists between sessions.

• Saved and bookmarked articles — the list of articles you have flagged for later reading, including the article title, summary, category, and a reference to the underlying content.
• Workspace records — named collections you create, each containing references to articles, shared notes, highlights, focus-time totals, and a colour label.
• Notes and annotations — free text you write, optionally linked to a specific article or paragraph, including any highlighted quotation you attach.
• Flashcards — question-and-answer pairs you generate or edit, together with spaced-repetition metadata (ease factor, interval, repetitions, next-review date, last quality).
• Quiz results — scores and answer patterns from quizzes you take on articles.
• Reading history — a chronological log of articles you have opened, used to support the resume-where-you-left-off feature and to generate recommendations.
• Search history — the most recent search queries you have entered, stored both locally and, for registered users, on our servers to power quick-repeat searches.
• Reading goals and streaks — your daily article goal, the days on which you have read, your current and longest streak, and the list of articles marked as finished.
• Achievement badges and statistics — derived metrics such as total articles read, categories explored, and focus time accumulated.

3.3 Preference and Configuration Data (collected when you configure the Service): These are the settings that personalise your experience, such as theme (dark or light), font family and size, line spacing, interface language (English or Hindi), AI search behaviour (whether to fall back to AI when Wikipedia has no article, and how detailed AI-generated articles should be), and which optional features are shown (reading progress bar, related images, reading-time estimates).

3.4 Technical and Usage Data (collected automatically): When you interact with Basepedia, our infrastructure and our hosting platform automatically record technical data that is necessary for security, reliability, and capacity planning. This includes your IP address, browser type and version, operating system, screen resolution, the pages or screens you visit within the Service, the timestamps of those visits, the referring URL, and aggregated counts of feature usage. We use this data principally in an aggregated, de-identified form; IP addresses are retained only for as long as necessary for security and abuse-prevention purposes and are then truncated or deleted.

3.5 Content You Submit to AI Features (processed on demand): When you use a feature that calls an AI model — for example asking for an article summary, generating flashcards, taking a quiz, requesting an insight, or translating an article — the article content and any prompt you supply are transmitted to the AI model provider for processing. The provider processes that data to return a result and may retain it for a limited period in accordance with its own policy. We do not control the provider's retention, but we select providers that offer reasonable data-handling commitments and we do not send data to providers we have not assessed.

3.6 Communication Data (collected when you contact us): If you contact support, report a problem, or send feedback, we keep a record of your message, our reply, and any associated metadata (such as timestamps and the account to which the message relates) so that we can resolve your issue and maintain a continuity record of your support history.

3.7 Special Categories of Data (we do not ask for these): We do not knowingly collect special categories of personal data — such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation. If you include such data in a note, a search query, or a message to support, we will not deliberately process it for any purpose and will delete it on request. We do not use special-category data for any automated decision-making.

We process each category of personal data only for specified, explicit, and legitimate purposes that are connected to delivering, securing, and improving the Service. The list below pairs each purpose with the categories of data that are necessary for it, so that you can see exactly what feeds what. We do not use your data for any purpose that is incompatible with the purposes for which it was originally collected, in accordance with the purpose-limitation principle.

4.1 To create and operate your account: We use your email address, name, and role to authenticate you, maintain your session, display your profile, and grant or restrict access to administrative functions. This processing is necessary to perform the contract of service that you enter into when you register.

4.2 To deliver the reading and research features you request: We use your saved articles, workspaces, notes, highlights, flashcards, and quiz results to display them back to you, sync them across your devices, and power features such as the knowledge graph, the read-next recommendations, and the spaced-repetition flashcard scheduler. This processing is necessary to perform the contract of service.

4.3 To personalise your experience: We use your preference data, reading history, and search history to remember your settings, surface recently read articles, and recommend topics you might find interesting. This processing is necessary to perform the contract of service and, where you have enabled a specific personalisation feature, is also carried out on the basis of your consent.

4.4 To provide AI-assisted features: When you invoke an AI feature, we transmit the relevant article content and your prompt to an AI model provider and return the result to you. This processing is necessary to perform the contract of service. You can disable AI fallback in Settings; doing so stops the Service from sending article content to an AI provider when Wikipedia has no article, but it does not affect features you invoke explicitly.

4.5 To provide offline access: We cache article content in your browser's local storage so that you can read it without an internet connection. This processing is carried out on your device and is necessary to perform the contract of service.

4.6 To secure the Service and prevent abuse: We use technical and usage data, including IP addresses and log data, to detect unauthorised access, defend against attacks, investigate suspicious activity, and enforce our acceptable-use rules. This processing is necessary for our legitimate interests in protecting the Service and our users, and in some cases is necessary to comply with our legal obligations.

4.7 To maintain and improve the Service: We use aggregated, de-identified usage data to understand which features are used, how the Service performs under load, and where we should invest in improvements. This processing is necessary for our legitimate interests in operating and developing our business, and we ensure that any data used for this purpose cannot be linked back to an identified or identifiable individual.

4.8 To communicate with you: We use your email address and your in-app communication settings to send you account-recovery messages, security alerts, reading reminders (if you have enabled them), and important notices about changes to the Service or to this policy. This processing is necessary to perform the contract of service and, for marketing-type communications, is carried out on the basis of your consent, which you may withdraw at any time.

4.9 To comply with legal obligations: We may process personal data where necessary to comply with a legal obligation — for example retaining records for tax or audit purposes, responding to lawful requests from competent authorities, or preserving evidence in the context of litigation. The specific obligation will determine the scope and duration of processing.

Under the GDPR and similar laws, we may only process your personal data if we have a valid legal basis for doing so. The table below sets out, for each processing activity, the legal basis on which we rely, so that you can understand and, where relevant, exercise your rights against each basis.

• Performance of a contract — we rely on this when processing is necessary to provide the Service you requested at registration, including account operation, content delivery, syncing, offline caching, and AI features you invoke.
• Legal obligation — we rely on this when processing is necessary to comply with a law or regulation that binds us, such as retaining billing records or responding to lawful requests from authorities.
• Legitimate interests — we rely on this for security monitoring, abuse prevention, service improvement using aggregated data, and recovery of costs for clearly abusive use. We have assessed these interests against your rights and freedoms and concluded that they are not overridden.
• Vital interests — this basis would apply only in a narrow situation where processing were necessary to protect someone's life, for example where we were required to disclose data in an emergency; we have not relied on this basis to date.
• Consent — we rely on this for any processing that is not necessary for the Service and that you have expressly opted into, such as optional reading reminders or, where applicable, certain personalisation features. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Public interest — we would rely on this only where processing were necessary for a task carried out in the public interest or under official authority; we have not relied on this basis to date.

Where we rely on consent, you may withdraw it at any time through the Settings page or by contacting us using the details in the final section. Withdrawing consent does not affect the lawfulness of any processing that took place before the withdrawal, but it will stop that processing from continuing. Where we rely on legitimate interests, you may object to the processing on grounds relating to your particular situation; we will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.

Basepedia uses automated processing in two ways that touch your data: personalisation and recommendation. The recommendation engine analyses your reading history, saved articles, and search history to suggest topics you might want to read next. This is a form of profiling, but it produces no legal or similarly significant effect on you — it only influences which articles we suggest — and it is not shared with third parties. You can reset the recommendations at any time by clearing your reading history and search data in Settings, which removes the inputs the engine uses.

The spaced-repetition flashcard scheduler uses a published algorithm (SM-2) to compute when to show each flashcard again based on your past recall quality. This processing is entirely automated, runs on data you have created, and has no effect beyond the order in which your flashcards are presented. You can delete any or all flashcards at any time, which removes them from the scheduler.

We do not use automated decision-making that produces legal or similarly significant effects on you — for example we do not use automated processing to decide your eligibility for credit, employment, insurance, housing, or government benefits. If we ever introduce any such processing, we will do so only with an appropriate legal basis, will provide you with meaningful information about the logic involved, and will give you the right to obtain human intervention, to express your point of view, and to contest the decision, as required by Article 22 of the GDPR.

Reading-streak and goal-tracking features are automated and produce achievement badges and statistics, but these are presented to you for motivational purposes only and have no consequence outside the Service. You can disable reading-goal tracking in Settings.

We do not sell your personal data, and we do not rent it to third parties for their own purposes. We share your data only with the categories of recipients described below, and only to the extent necessary for the purpose for which the data was collected. Each category is bound by contractual obligations to protect your data and to process it only for the purpose for which it was shared.

7.1 Hosting and infrastructure provider: The Base44 platform provider hosts the Service and stores your account data, workspaces, notes, flashcards, and reading metadata. The provider acts as our sub-processor under a written agreement that requires it to protect your data to a standard consistent with this policy and to process it only on our instructions.

7.2 AI model providers: When you use an AI-assisted feature, the relevant article content and prompt are sent to an AI model provider. We select providers that offer reasonable data-handling commitments and rotate providers as the platform's available models change. The provider processes the data only to return a result and may retain it for a short period in accordance with its own policy.

7.3 Content sources: When you search for or open an article, your search query is sent to the relevant content source — principally the Wikipedia/Wikimedia API servers — so that the article can be retrieved. Wikimedia receives your query and may log it under its own privacy policy.

7.4 Image services: When an article has no Wikipedia image, or to enrich the gallery, we may request images from Unsplash, Picsum, or similar services. These services receive a search query and may log it.

7.5 Analytics providers: We may use analytics services to understand aggregated usage patterns. Where we do, we configure them to minimise the personal data collected and to rely on de-identified or pseudonymised data wherever possible.

7.6 Professional advisers and authorities: We may share data with our legal advisers, auditors, and insurers, and with competent authorities, where we are required to do so by law, court order, or regulation, or where we need to establish, exercise, or defend a legal claim.

7.7 Successors in a corporate transaction: If we are involved in a merger, acquisition, reorganisation, or sale of assets, your data may be transferred to the acquiring entity. We will take reasonable steps to ensure the recipient honours this policy, and we will notify you before your data is transferred to a different entity that is not bound by our policies, giving you the opportunity to review the recipient's policy and, where applicable, to object.

We do not share your data with third parties for their own marketing purposes, and we do not allow third parties to use the data we share with them to build profiles about you for their own commercial ends. A current list of the principal sub-processors we rely on is available on request through the contact channel in the final section; we will update you if we add or replace a sub-processor that materially changes where or how your data is processed.

Basepedia is delivered globally, and your personal data may be processed in countries other than your own, including countries that have not been recognised as providing an adequate level of data protection. When we transfer personal data to such a country, we put a transfer mechanism in place that is intended to ensure your data is protected to a standard equivalent to that in your home jurisdiction.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been granted an adequacy decision by the relevant authority, we rely on Standard Contractual Clauses adopted by the European Commission (and the equivalent under the UK GDPR), together with any supplementary measures that are necessary to ensure a level of protection essentially equivalent to that in the source jurisdiction. Where we rely on a different recognised mechanism — such as binding corporate rules, an approved certification, or a derivative legitimate-interest assessment — we will identify it on request.

Because our hosting platform and AI model providers operate globally, the data we send to them may be stored or accessed from several countries. We have assessed these arrangements and concluded that, with the safeguards we have in place, they provide an adequate level of protection. If you would like a copy of the relevant Standard Contractual Clauses or more detail about the supplementary measures, please contact us through the channel in the final section.

By using Basepedia, you acknowledge that your data may be processed in countries whose data-protection standards differ from your own, and you consent to the transfers described in this section to the extent that consent is the appropriate legal basis. Where a transfer relies on a different legal basis, your acknowledgement does not affect the safeguards we have put in place.

We retain your personal data only for as long as is necessary to fulfil the purpose for which it was collected, unless a longer period is required by law or for the establishment, exercise, or defence of legal claims. The table below sets out, by category, how long we keep each type of data and what triggers deletion.

• Account data (email, name, role) — retained while your account is active. Deleted or anonymised within 30 days of account closure, except where a longer period is required by law.
• Reading and research data (saved articles, workspaces, notes, highlights, flashcards, quiz results) — retained while your account is active. Deleted within 30 days of account closure.
• Reading history and search history — retained while your account is active and, for unregistered guests, stored only on the device. You can clear both at any time from Settings.
• Preference and configuration data — retained while your account is active and, for guests, stored on the device. Deleted on account closure or when you clear browser data.
• Offline article cache — stored on your device until you clear it or clear browser data. Not retained on our servers.
• Technical and usage logs — retained for up to 24 months for security and reliability analysis, then truncated or deleted. IP addresses are truncated or deleted as soon as they are no longer needed for the purpose for which they were collected.
• Communication data (support and feedback) — retained for up to 24 months after the last interaction so that we can maintain a continuity record and respond to follow-up queries.
• Billing and tax records — retained for the period required by applicable tax and company law, typically 6 to 10 years.

When the retention period for a category of data expires, we either delete the data securely or anonymise it so that it can no longer be associated with you. Anonymised data may be retained indefinitely for statistical and research purposes, in accordance with the principle that truly anonymous data falls outside the scope of data-protection law. If you close your account and later reopen one with the same email, we will not be able to restore your previously deleted data, because it will have been permanently removed.

We implement a layered set of technical and organisational measures designed to protect your personal data against unauthorised or unlawful access, accidental loss, alteration, or disclosure. The measures described below are appropriate to the sensitivity of the data we hold and the state of the art, and we review them regularly as both technology and threats evolve.

10.1 Encryption in transit: All data exchanged between your device and our servers is encrypted using Transport Layer Security (TLS) with strong cipher suites. We enforce HTTPS for all connections and reject insecure protocols.

10.2 Encryption at rest: Data stored on our hosting platform is encrypted at rest using industry-standard algorithms managed by the platform provider. Encryption keys are managed by the provider under its own security controls and are rotated in accordance with its policies.

10.3 Access control: Access to systems that store or process personal data is restricted to authorised personnel who need access to perform their duties, and is granted on the principle of least privilege. Access is reviewed periodically and revoked promptly when no longer required. Administrative access is protected by multi-factor authentication.

10.4 Application security: We follow secure-development practices, including input validation, output encoding, parameterised queries, and protection against common web vulnerabilities such as cross-site scripting (XSS) and cross-site request forgery (CSRF). Where we use HTTP-only, Secure, and SameSite cookie attributes, we do so to reduce the risk of session theft and cross-site attacks.

10.5 Row-level isolation: The Service enforces row-level security so that one user's workspaces, notes, and flashcards are not visible to other users, except where you have explicitly shared a workspace or where an administrator acts within the scope of their role.

10.6 Monitoring and logging: We monitor systems for suspicious activity and maintain logs of security-relevant events. Logs are reviewed for anomalies and are themselves protected against tampering.

10.7 Incident response: We maintain an incident-response plan that defines roles, escalation paths, and communication procedures in the event of a security incident. The plan is tested periodically and updated based on lessons learned.

10.8 Supplier due diligence: Before engaging a sub-processor, we assess its security practices and require it to enter into a written agreement that includes confidentiality, security, and sub-processing commitments consistent with this policy.

10.9 Data-locality controls on the device: A significant proportion of your data — your reading preferences, reading history, search history, and offline cache — is stored in your browser's local storage on your device, where it is not transmitted to our servers unless you sync an account. You can clear this data at any time.

Despite these measures, no system can be guaranteed to be completely secure. We cannot guarantee that unauthorised access, hacking, or other breaches will never occur. In the event of a personal data breach, we will act in accordance with the breach-notification section below.

A “personal data breach” is a security incident that leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, personal data. We maintain procedures designed to detect, contain, investigate, and remediate such incidents promptly.

Where a breach is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay and, where the GDPR applies, in any case within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to those rights and freedoms. Our notification will describe, to the extent we are able: the nature of the breach; the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures we have taken or propose to take to address the breach and mitigate its possible adverse effects.

Where it is not possible to provide all of that information at the same time, we may provide it in phases as further information becomes available. We will document every breach, including its facts, effects, and remedial action, so that the supervisory authority can verify compliance with the notification obligation.

If a breach affects your account specifically — for example if credentials may have been exposed — we will give you specific guidance, such as asking you to change your password and reviewing recent activity on your account. We may also take protective action on our side, such as invalidating active sessions or resetting affected tokens.

Depending on where you live and the law that applies to you, you may have some or all of the rights described below. We will respond to any valid request within the time limit set by applicable law — typically one month, extendable by two further months where the request is complex or numerous — and we may need to verify your identity before acting, to protect your data from unauthorised access.

• Right of access — you can ask for a copy of the personal data we hold about you and for information about how we are processing it.
• Right to rectification — you can ask us to correct inaccurate personal data or to complete incomplete data.
• Right to erasure (the right to be forgotten) — you can ask us to delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected or you withdraw the consent on which processing was based.
• Right to restriction of processing — you can ask us to limit our processing of your data in certain circumstances, for example while a request for rectification is being considered.
• Right to data portability — for data you provided to us that is processed on the basis of consent or contract and that is processed by automated means, you can ask for a copy in a structured, commonly used, machine-readable format, and you can ask us to transmit it to another controller where technically feasible.
• Right to object — you can object to processing based on legitimate interests or carried out for direct marketing, and we will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for legal claims.
• Right to withdraw consent — where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
• Rights in relation to automated decision-making and profiling — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to obtain human intervention, express your point of view, and contest the decision.

To exercise any of these rights, contact us through the channel in the final section, telling us which right you want to exercise and, if relevant, which data the request concerns. We will respond in writing. If you are not satisfied with our response, you may complain to your national data-protection authority; in the European Union that is your local supervisory authority, and in the United Kingdom it is the Information Commissioner's Office. We are committed to resolving your concerns directly wherever possible and would appreciate the chance to do so before you escalate.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights with respect to your personal information. This section explains those rights and how to exercise them. The terms “personal information,” “sale,” “share,” and “business” have the meanings given in the CCPA.

13.1 Categories of personal information we collect: We collect the categories described in the “Categories of Personal Data We Collect” section above: identifiers (email address, name), reading and research data, preference data, technical and usage data, and inferences drawn from these to provide recommendations.

13.2 The right to know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it. You may make this request up to twice in a 12-month period.

13.3 The right to delete: You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions (for example, where retention is necessary to complete a transaction, detect security incidents, or comply with legal obligations).

13.4 The right to correct: Under the CPRA, you have the right to request that we correct inaccurate personal information that we maintain about you.

13.5 The right to opt out of sale or share: We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Because we do not sell or share, there is nothing to opt out of; if we ever change this position, we will provide a clear “Do Not Sell or Share My Personal Information” link and honour opt-out signals such as the Global Privacy Control.

13.6 The right to limit use of sensitive personal information: We do not collect or process sensitive personal information as defined by the CPRA. If we ever do, we will provide a mechanism to exercise this right.

13.7 The right to non-discrimination: We will not discriminate against you for exercising any of these rights — that is, we will not deny you the Service, charge different prices, or provide a different level of quality.

13.8 Authorised agents: You may authorise an agent to make a request on your behalf. We will require the agent to prove they are authorised to act for you and may still need to verify your identity directly.

13.9 Shine the Light: Under California's Shine the Light law, California residents may request information about how we share personal information with third parties for direct marketing. We do not share personal information for third-party direct marketing.

We aim to provide a consistent set of rights to all users regardless of where they live. The rights described in the GDPR and CCPA sections above are available to you wherever you are, to the extent that local law permits. In addition, certain jurisdictions give additional or slightly different rights:

• Brazil (LGPD): Brazilian residents may confirm the existence of processing, access their data, correct incomplete or inaccurate data, anonymise or delete data, port data, obtain information about sharing, revoke consent, and be informed about the possibility of not providing consent and the consequences of refusal.
• Canada (PIPEDA): Canadian residents may access their personal information and challenge its accuracy, and may withdraw consent subject to legal or contractual restrictions.
• Australia (Privacy Act 1988): Australian residents may access and correct their personal information and make a complaint to the Office of the Australian Information Commissioner.
• India (Digital Personal Data Protection Act 2023): Indian residents may access information about their personal data, correct or complete it, request erasure, and nominate another individual to exercise rights in the event of death or incapacity.
• Other jurisdictions: If your local data-protection law grants you a right that is broader than what is described here, that right is preserved. Contact us and we will do our best to honour it.

Basepedia is not directed to children under the age of 13, and we do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without verifiable parental consent, we will delete that data as soon as possible. If you believe that a child under 13 has provided us with personal data, please contact us immediately so that we can investigate and take appropriate action.

For users aged 13 to 16 (or the equivalent age in their country), we recommend that a parent or legal guardian review and discuss this Privacy Policy with the minor before the minor uses the Service, and we will treat the minor's use of the Service as carried out with that guardian's consent. In jurisdictions that require parental consent for the processing of personal data of minors above a higher age — for example the GDPR's treatment of information-society services offered directly to children — we will obtain that consent where applicable.

Where we are required to obtain verifiable parental consent under the Children's Online Privacy Protection Act (COPPA) or an equivalent law, we will do so before collecting personal data from a child in the relevant age range. We do not knowingly market the Service to children or use behavioural advertising to target minors.

Basepedia displays and links to content from third parties — principally Wikipedia and other free-knowledge sources, image services, and AI model providers — and may link to third-party websites. This section explains the boundary between our responsibilities and theirs.

• Wikipedia and the Wikimedia Foundation provide the article content, images, and metadata that Basepedia displays. When you search for or open an article, your request is sent to Wikimedia's servers, and Wikimedia's privacy policy governs how it handles your request.
• AI model providers receive the article content and prompt you supply when you use an AI feature. Their privacy policies govern how they handle that data after they receive it.
• Image services such as Unsplash and Picsum receive a search query when an article has no Wikipedia image. Their policies govern how they handle that query.
• AI assistant clients that connect to Basepedia through our MCP server process data on their own systems under their own policies. The MCP server exposes only the data that your account is authorised to read, and we describe its scope in the Model Context Protocol section below.

We are not responsible for the privacy practices of these third parties and cannot control them. When you follow a link to a third-party website, you leave Basepedia and are subject to the terms and privacy policy of the destination site. We encourage you to read those policies before providing any personal data to a third party.

Basepedia exposes a public model context protocol (MCP) server that allows AI assistants to read your account's data — for example your saved articles and workspaces — when you connect the assistant to your account. The MCP server is a read-only interface: it does not allow the connected assistant to create, modify, or delete your data.

When you connect an AI assistant to Basepedia through the MCP server, you grant that assistant read access to the data your account is authorised to see. The assistant's handling of that data is governed by the assistant provider's privacy policy, not by this policy. We recommend that you connect only assistants whose privacy practices you trust and that you disconnect assistants you no longer wish to use.

The MCP server is designed to minimise data exposure: it serves only the records the connecting user's account is authorised to read, and it does not expose data belonging to other users. You can revoke an assistant's access at any time by disconnecting it; we describe how in the Connect page within the Service.

Basepedia uses cookies, local storage, and similar technologies to operate the Service and remember your preferences. The detail of which technologies we use, why, and how you can control them is set out in our Cookies Policy, which is incorporated into this Privacy Policy by reference. In summary: we use essential cookies for authentication and session management, preference and functionality storage for your settings and saved data, and limited analytics to understand aggregated usage. We do not use cookies for cross-site advertising tracking.

A large proportion of your data — your reading preferences, reading history, search history, and offline article cache — is stored in your browser's local storage on your device. This data is not transmitted to our servers unless you sync an account, and you can clear it at any time through the Settings page or your browser's controls.

We design our data-collection practices around two principles: we collect only the data that is necessary for a specific, articulated purpose (data minimisation), and we use the data we collect only for the purpose for which it was collected unless we identify a compatible new purpose and inform you of it (purpose limitation). Before we collect any new category of data, we ask whether it is necessary for an existing purpose; if it is not, we do not collect it.

Where we discover that we have collected data that is no longer necessary for the purpose for which it was gathered, we delete it or anonymise it, unless we are required by law to retain it. We periodically review our data inventory to confirm that each category of data we hold is still necessary and proportionate. If you believe we are holding data that is no longer needed, please tell us and we will investigate.

We take reasonable steps to ensure that the personal data we hold about you is accurate and kept up to date. You can update your name, profile photo, and most preferences directly through the Service. If any data we hold about you is inaccurate or incomplete, you have the right to request correction, and we will correct it without undue delay.

Where we process data on the basis of your consent, you are responsible for ensuring that the information you provide when giving consent is accurate. If you change your email address, please update it in your account settings so that we can continue to send you account-recovery and security messages reliably.

You can close your account at any time through the Service. When you close your account, we will stop processing your personal data for the Service and will delete or anonymise it within 30 days, subject to the limited exceptions below.

We may retain certain data after account closure where we are required to do so by law (for example tax or accounting records), where retention is necessary for the establishment, exercise, or defence of legal claims, or where retention is necessary to comply with a legal obligation. In those cases we will retain only the data necessary for the specific legal purpose and will delete it when that purpose no longer applies.

If you close your account and later decide to return, we will not be able to restore the data we deleted, because it will have been permanently removed. You may, however, recreate workspaces, notes, and flashcards from scratch, and any articles you previously saved may be re-saved by searching for them again.

To exercise the right to erasure without closing your whole account — for example deleting a specific workspace or clearing your reading history — use the relevant control in the Settings page or contact us through the channel in the final section.

We may update this Privacy Policy from time to time to reflect changes in our practices, the features we offer, technology, legal requirements, or regulatory guidance. When we make material changes — that is, changes that affect what data we collect, why we collect it, who we share it with, or how long we keep it — we will notify you through the Service and, where you have an account, by email to the address on file, before the changes take effect where reasonably practicable.

The “Last updated” date at the top of this page indicates when the policy was last revised. Your continued use of Basepedia after a change takes effect constitutes acceptance of the updated policy. If you do not agree with the updated policy, you should stop using the Service and, if you have one, close your account in accordance with the procedure described above.

We maintain a record of material changes so that you can see how the policy has evolved. If you would like a copy of a previous version of this policy, contact us through the channel in the final section.

If Basepedia is involved in a merger, acquisition, reorganisation, bankruptcy, or sale of all or part of its assets, your personal data may be transferred as part of that transaction. In such a case, we will take reasonable steps to ensure that the receiving party honours this Privacy Policy, and we will notify you before your data is transferred to a different entity that is not bound by our policies, giving you the opportunity to review the recipient's policy and, where applicable, to object to the transfer.

If your data is transferred to a new entity following a corporate change, your continued use of the Service after the transfer constitutes acceptance of the new entity's privacy practices, to the extent they differ from ours. We will never transfer your data to an entity that does not provide a level of data protection comparable to that described in this policy, unless you consent to the transfer or it is required by law.

If you have any question, concern, or request regarding this Privacy Policy or the way we handle your personal data, please contact us. We will respond without undue delay and in any event within the time limit required by applicable law. The quickest route is through the in-app contact option in Settings; you may also use the official Base44 support channel, which we will provide on request and which we monitor during normal business hours.

• In-app: Navigate to Settings and use the contact or feedback option.
• Support channel: The official Base44 support channel, available through the platform's support interface.
• Data-protection requests: For access, rectification, erasure, portability, objection, or withdrawal of consent, use the same channel and mark your request as a data-protection request so that we can prioritise it.

If you are not satisfied with our response, you have the right to complain to your local data-protection authority. In the European Union, that is your national supervisory authority; in the United Kingdom, it is the Information Commissioner's Office (ico.org.uk); in California, the Attorney General (oag.ca.gov). We would, however, appreciate the opportunity to resolve your concern directly before you escalate.

Thank you for trusting Basepedia with your personal data. We are committed to maintaining the highest standards of privacy and data protection and to giving you clear, practical control over your information.