Last updated: 16 October 2026. Draft — have this reviewed by a lawyer before relying on it for real customers, particularly before serving EU/UK customers under GDPR.
When you connect an account (e.g. Gmail), we access only the data needed to provide the feature you've connected it for: reading and classifying inbox messages, drafting and sending replies you approve, and logging contact/CRM activity. We request the minimum scopes needed — for Gmail, read and send access, not full account control.
Connected-account credentials (OAuth tokens) are encrypted at rest. Email content and CRM data are stored in our database, scoped to your account only — other customers' data is never mixed with yours.
We do not sell your data. We do not use your email content or CRM data to train or improve AI models — ours or anyone else's. When our AI features read an email to classify it or draft a reply, the content is sent to our AI model provider only to produce that result for you, under terms that prohibit the provider from training on it. We do not share your data with third parties except the sub-processors listed below.
If you connect a Gmail account, BaseHelm requests two permissions: read your email (gmail.readonly) and send email on your behalf (gmail.send). We use them only to provide features you can see in your dashboard:
BaseHelm's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Gmail data only to provide and improve the user-facing features above; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with your notice; we do not use it for advertising; we do not use it to train generalized AI or machine-learning models; and no person at BaseHelm reads your Gmail data unless you ask us to for support, it is needed for security or legal reasons, or it has been aggregated and anonymized.
You can disconnect Gmail at any time from your dashboard or at myaccount.google.com/permissions. Deleting your BaseHelm account deletes the stored tokens and every email we stored.
If you connect Outlook, we request read, send and offline access to your mailbox and basic profile, and use them for the same features and under the same limits as Gmail above.
If you connect a mailbox on another mail host, you give us its server settings and password (or app password). We store them encrypted and use them only to read your inbox and send the emails you approve or schedule, under the same limits as Gmail above. Disconnecting deletes the stored password immediately.
If you connect Tally Prime, the BaseHelm Tally Connector on your PC sends us your customer and supplier ledgers (names, email, phone, outstanding balance) and stock items (quantities and values), and creates the Sales Orders you or your automations request. The connector only connects out to BaseHelm; it never opens your PC or Tally to the internet. Disconnecting deletes the synced Tally data from BaseHelm; nothing in Tally is changed.
If you connect Google Sheets, BaseHelm requests access to your spreadsheets (spreadsheets). This is a separate sign-in from Gmail. We use it only to add the rows your automations write, and to read new rows from the one sheet you choose to watch so they can start an automation. We store the sheet link and the number of rows already seen, not the sheet's contents. Google Sheets data is covered by the same Google API Services User Data Policy and Limited Use commitments as Gmail above. You can disconnect at any time from Connected apps or at myaccount.google.com/permissions; removing the connection deletes the stored tokens.
If you connect WhatsApp Business, you give us your WhatsApp Cloud API phone number ID, access token and app secret, stored encrypted. We use them only to send the messages your automations send, and to receive messages your customers send to your business number so they can start an automation. Message contents are passed to your automation and are not used for anything else. Removing the connection deletes the stored keys immediately.
If you connect Instagram, BaseHelm requests your account's basic profile (instagram_business_basic), permission to publish posts (instagram_business_content_publish) and permission to read and reply to direct messages (instagram_business_manage_messages). We use them only to publish the posts your automations publish, and to receive and reply to direct messages as your automations do. We store an encrypted access token and your account's id and username. We do not use Instagram data for advertising and do not sell it.
To delete what BaseHelm holds from any of these connections, remove the connection under Connected apps in your dashboard: the stored tokens and keys are deleted at once. To have everything else deleted (including messages that started your automations and the automation history), email help@basehelm.in from your account's email address; we complete deletion within 30 days. You can also remove BaseHelm's access from Instagram under Settings > Apps and websites.
Railway (application hosting), Supabase (database), Anthropic (AI model provider — email classification and drafting), Stripe (payments), Resend (account emails such as password resets). Each processes data only to provide its part of the service.
Data visible to employees you invite is governed by the capability permissions you (the account owner) set. We do not independently grant access beyond what you configure.
We retain your data for as long as your account is active. On cancellation, you may request full deletion of your account's data; we will complete this within 30 days. Some data may be retained longer where required for legal, tax, or fraud-prevention purposes.
Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data. Contact us at help@basehelm.in to exercise these rights.
We use encryption for stored credentials, rate limiting on outbound-send features, and audit logging of account actions. No system is perfectly secure; we will notify affected customers promptly in the event of a data breach affecting their data, as required by applicable law.
We will notify account owners of material changes to this policy before they take effect.
Questions about this policy: help@basehelm.in