Legal Things
We take data security very seriously, and we're committed to providing a service that is safe and accessible to all of our customers.
Last updated: November 2026
This Privacy Policy describes how Moonshot Ventures Inc. ("Basin", "we", "our", or "us") collects, uses, and shares personal data in connection with usebasin.com and the Basin service (the "Service").
For processor roles, named subprocessors, and how to submit a rights request, see ourGDPR page. For cookies, see ourCookie Policy. OurData Processing Agreement (DPA) is published at usebasin.com/dpa and forms part of our Terms of Service.
1. Controller and Processor
When you create a Basin account, we are the data controller for your account, billing references, analytics, and related service data.
When you collect form submissions or run a chat widget, Basin is the data processor, except for the few uses of our own described in Section 4. You are the controller for that end-user data and must have a lawful basis and a privacy notice for your submitters. We process it on your instructions under ourTerms of ServiceandDPA.
2. Data We Collect as Controller
We collect:
- Account: your name, email address, password (stored hashed) or sign-in provider ID, account settings, and your answers to the optional onboarding questions.
- Billing: your plan and billing details. Stripe handles payment cards; we don't store card data.
- Team, integrations, and AI assistants: the people you invite, credentials for integrations you connect, and a log of requests from AI assistants you connect.
- SMS: the number you verify for SMS alerts, stored encrypted.
- Support and chat: your support tickets and correspondence, and messages you send in our website chat.
- Site previews: the business description you give us, the page we build from it, and the campaign or link that brought you to it.
- Testimonials: your name, email address, title or company, quote, rating, photo, and a record of your consent. We publish your name, title or company, quote, rating, and photo, and you can withdraw consent at any time.
- Technical data: IP addresses, browser details, sign-in times, error reports, and your cookie choices.
Most of this data comes from you. Some comes from others: your name, email address, and any profile photo from the provider you sign in or sign up with (Google, GitHub, Facebook, or Webflow), and an invitee's email address from the person who invited them.
You must give us an email address (and a payment method for paid plans) to create and use an account. Everything else is optional, but some features may not work without it.
3. Legal Bases for Processing (Controller Activities)
| Activity | Legal Basis |
|---|---|
| Your account, billing, sign-in, team access, SMS alerts you enable, transactional email, and support requests (including AI-drafted replies and AI-assessed account verification) | Art. 6(1)(b): performance of our contract with you |
| Keeping Basin secure and working: spam and abuse prevention (including account screening and bot checks on our sign-up, password reset, email confirmation, and testimonial pages), error monitoring, logs of server requests, AI assistant (MCP) requests and staff changes to accounts, SMS message records, and encrypted backups | Art. 6(1)(f): protecting the Service, our customers, and our email and SMS sending, investigating misuse, and recovering from data loss |
| Understanding and improving Basin: optional onboarding answers, aggregate usage statistics, why accounts close, and which campaign or link brought you to a site preview | Art. 6(1)(f): understanding who uses Basin and why customers leave, improving the Service, and measuring our marketing |
| Invitations, and support, website chat, and site previews for people without an account | Art. 6(1)(f): answering your request, letting account owners share access, and letting you try Basin before signing up |
| Complying with laws and lawful requests from public authorities, keeping resolved support tickets (Section 7), and establishing, exercising, or defending legal claims | Art. 6(1)(f): complying with the laws that apply to us, including tax and accounting record-keeping, handling follow-up questions, and protecting our legal rights |
| Onboarding emails and product updates | Art. 6(1)(f): helping customers use the Service and telling them about changes to it; opt out in your notification settings or from any such email |
| Publishing testimonials (including AI-assisted formatting), and newsletter and promotional emails | Art. 6(1)(a): consent, given when you submit a testimonial or tick the box at sign-up (or turn emails on in your notification settings); withdraw at any time |
| Showing our cookie banner and recording your choice. Google Tag Manager, which loads the banner, runs on every page before you choose, so Google receives your IP address, browser details, and the page address. No analytics or advertising tag runs before you consent where consent is required. | Art. 6(1)(f): asking for your cookie choices, applying them, and being able to show that consent was given |
| Analytics, advertising, and attribution cookies on our website and in the Basin dashboard | Art. 6(1)(a): consent, wherever the law requires it, including in the EU, the UK, California, and Quebec. In the rest of the United States and Canada, these cookies are on by default and you can turn them off at any time; in Canada we rely on your implied consent. Manage in the Cookie Policy. |
| Measuring OpenAI ads using an ad click reference and your first paid Basin subscription's time, plan, amount, currency, and event reference. These events contain no email address, IP address, or form submissions. | Art. 6(1)(a): explicit Marketing consent in every region. We use the click reference for up to 30 days, link it to your account, and may share the conversion with OpenAI through its server-side Conversions API. Expired references are cleared during daily cleanup. Withdraw through Cookie Settings to stop future events and clear our stored click reference. OpenAI is an independent controller of the conversion data we send it and may also use it for its own purposes, including building audiences for our campaigns and improving its products and services, under its privacy policy. |
4. Data We Process as Processor
Form submissions include the fields you configure, plus metadata such as IP address, approximate location derived from it, user agent, and referrer.
Spam filtering runs on submissions by default, using our spam-checking service and, depending on the form's settings, third-party spam-filtering, bot-detection, and email or phone validation services (listed on our GDPR page). Depending on the form's spam settings, our spam checking sends submission content to OpenAI to check it. It also compares submissions with recent ones to other Basin accounts, without sharing them. If you correct a result, we may re-run the submission through newer versions of the form's spam checking to check their accuracy. No copies or individual results are kept, and you can turn this off for a form or for your whole account in settings.
AI features, such as chat, inbox reprocessing, lead scoring, and lead tags, send the relevant visitor or submission text to OpenAI.
SMS notifications: if you turn them on, we send alerts through our SMS provider to the number you verify. Depending on your settings, alerts can include the form name, submitted fields, attachment links, and a dashboard link. You may opt out at any time by turning SMS off, clearing the number, texting STOP where available, or emailing support@usebasin.com. Message and data rates may apply.
Integrations and AI assistants: if you connect an integration (such as Mailchimp, Slack, Google Sheets, Zapier, or webhooks) or an AI assistant through our MCP server, we send it submission data on your instruction, and its provider receives that data under your agreement with them. An AI assistant can read your forms and submissions and take the actions you switch on.
Hosted pages: if you publish a hosted form or a Basin Sites page, we serve it to your visitors, and our servers and hosting providers log their requests (including IP address and user agent) for a short period. Hosted forms that use reCAPTCHA or Turnstile load that provider's script, and reCAPTCHA may set cookies. Hosted forms with a TrustedForm or Jornaya certificate field load that lead-certification service's script, which records the form-filling session. If you add them, your Google Tag Manager container and your address-autocomplete provider also load in your visitors' browsers; they receive the visitor's IP address, and the autocomplete provider receives what the visitor types into the address field. Our chat widget keeps a conversation identifier and a note that the chat has been opened in the visitor's session storage, so the chat continues across pages and doesn't open by itself again. Disclose these in your own privacy notice.
Form analytics: if you embed it on your site, it records page views and submissions with masked IP addresses, browser, and referrer, and sets first-party visit and visitor cookies on your domain (the visitor cookie lasts up to two years). You must disclose those cookies in your own privacy notice and, where the law requires consent for them (as it usually does in the EU), load the analytics script only after your visitors consent.
Our Own Uses of Form Data
We also use form, submission, and chat data for a few purposes of our own, as controller rather than processor: to keep the Service secure and working, including screening for phishing, fraud, and other abuse; to comply with laws that apply to us and to establish, exercise, or defend legal claims; and to produce aggregate statistics about use of the Service, such as submission and spam volumes by plan or country, that identify no one. Section 3 gives the legal bases, and ourDPAsets out these uses for customers. We use submission data for no other purpose of our own.
5. Recipients
We share personal data with infrastructure, email, SMS, spam-filtering, monitoring, mapping, and AI providers needed to run the Service. Named subprocessors that handle form-submitter data are listed on ourGDPR page.
The subprocessors on our GDPR page, such as our hosting, storage, email, and monitoring providers, also handle account data. Other vendors we use as controller:
- Calendly (US): Booking an intro call, if you choose to book one from the dashboard.
- Cookiebot (Usercentrics A/S) (Denmark, EU): Cookie consent management.
- Freshdesk (Freshworks) (US): Customer support ticket management.
- Google (US): Tag Manager, which loads our consent banner; analytics and advertising measurement, only with consent where required; and reCAPTCHA bot checks on our sign-up, password reset, email confirmation, and testimonial pages.
- Google, GitHub, and Facebook (US): Sign-in, if you choose to sign in with one of them.
- OpenAI (US): AI features you use, and AI assistance for Basin's own operations: website chat, support, abuse screening, account administration, and testimonials. Advertising conversion measurement using an ad click reference and paid subscription details, only with explicit Marketing consent. OpenAI is an independent controller of that conversion data and may also use it for its own purposes, including building audiences for Basin's campaigns and improving its products and services, under its privacy policy.
- OpenStreetMap Foundation (United Kingdom): Map tiles and place search on the spam settings map in your dashboard.
- Pexels (Canva Germany GmbH) (Germany, with processing in the US and other countries): Stock photos for generated sites, found with short search terms that can include words from your business description.
- Prighter Group (Austria, United Kingdom, Germany): EU/UK representative, and tools for handling data-subject requests and breach notifications.
- Rewardful (US): Affiliate attribution, including your email when you subscribe, only with Marketing consent where required.
- Stripe (US): Payment processing. For purchases sold through Link, Stripe's reseller service, Link is the merchant of record and handles your payment details under its own privacy policy.
- Zoho (US): Company email, including support correspondence.
OpenAI and Google's reCAPTCHA also act as DPA subprocessors for your forms; the other vendors here are not DPA subprocessors.
We may disclose personal data to courts, regulators, law enforcement, or other public authorities where the law requires it, or where needed to establish, exercise, or defend legal claims. When an authority asks for data we process for a customer, we follow our DPA.
We do not sell or rent personal data.
6. International Data Transfers
Moonshot Ventures Inc. is in Canada. The EU, the UK, and Switzerland recognise Canada as providing an adequate level of protection. Where personal data goes to a country without an adequacy decision, we use the EU Standard Contractual Clauses (with the UK Addendum for UK data, and applied to Swiss data for Swiss transfers) or the recipient's EU–U.S. Data Privacy Framework certification and UK Extension, or its Swiss–U.S. Data Privacy Framework certification. Personal data stored outside Canada, such as in the United States, may be accessible to courts, law enforcement, and national security authorities there. Contact us for a copy of the safeguards.
7. Retention Periods
| Data Category | Retention Period |
|---|---|
| Account data | Lifetime of the account. We may close a free account that has had no sign-in and no form submissions for 12 months, after a warning email at least 30 days before. On deletion, live account data is permanently destroyed. A churn log entry (email, reason, and any feedback you provided) is retained for 6 months, then purged. If we close an account for phishing or other abuse, we keep its email address for 3 years so it can't be used to sign up again. |
| SMS notification settings and sent messages | Recipient number and per-form SMS settings are destroyed when the form or account is deleted. Our SMS provider keeps records of sent messages, including their text, for 7 days. |
| Billing records | Deleted when you close your account. If you have been invoiced or charged, your Stripe customer record, invoices, and payment records stay with Stripe for as long as tax law requires. |
| OpenAI ad conversion records | The ad click reference is used for up to 30 days and cleared in daily cleanup, or sooner if you withdraw Marketing consent. The rest of the record (consent details, invoice reference, plan, amount, and currency) is kept for the life of the account and deleted with it. OpenAI keeps the conversion data we send it under its own privacy policy. |
| Team and collaborator data | Lifetime of the account or until access is revoked, whichever is earlier. |
| Site previews | Deleted 30 days after they are created, unless you claim the preview by creating an account. Claimed sites last for the lifetime of the account. |
| Form submissions | Set by you for each form, within your plan's limits when you set it. When you upgrade, forms still on a free plan's retention period move to your new plan's maximum. When you downgrade, each form keeps the period it already has. You can delete submissions at any time. |
| Spam and trashed submissions | Permanently deleted no later than the earlier of the form's configured retention period and Basin's 60-day spam/trash retention cap. The 60 days count from when the submission was last changed, for example when it was marked as spam, moved to the trash, or first opened. |
| SMS message records | Deleted after 3 months, or immediately when the form is deleted, including when the account that owns the form is deleted. |
| Chat conversations | Active conversations, including in our own website chat: 365 days maximum. Trashed conversations: 30 days. When a conversation is deleted, we also delete the copy OpenAI holds. OpenAI may retain API inputs and outputs for up to 30 days, including in abuse-monitoring logs. |
| Form analytics (if you embed it) | Deleted with its form, including when you close your account, and otherwise automatically after 24 months. IP addresses are masked. |
| Encrypted disaster-recovery backups | Up to about five weeks. Data deleted from live systems may remain in a backup until that backup expires. |
| Support tickets | Up to 5 years for general tickets, or up to 7 years if the ticket is about billing. |
| Testimonials | Published testimonials are kept while they appear on our website, until you withdraw consent or ask us to remove them. Testimonials awaiting review are kept until we decide whether to publish them. For testimonials we decide not to publish, the name, title, quote, rating, photo, and record of consent, and any form submission they came from, are deleted 30 days after that decision. |
| AI assistant (MCP) request logs | Deleted after 6 months. If the account is deleted sooner, the logs are kept until then without the link to the account. |
| Email delivery suppressions | When an email to a notification address bounces or is reported as spam, we keep that address while delivery to it is blocked, and for 12 months after the block is lifted. |
| Short-lived operational copies | Email logs, error reports, server and hosting logs, browser security reports, orphaned file attachments, admin change logs, and our AI provider's copies of AI requests other than chat conversations (including abuse-monitoring logs) are deleted automatically, each within 6 months. |
We may keep data longer where the law requires it, or where we need it to establish, exercise, or defend legal claims or to investigate fraud or abuse, and only for as long as that need lasts.
8. Automated Processing and AI
Basin uses automated processing, including AI, in the Service, as described below. Where you configure a feature to act on a submission automatically (for example, setting a lead-score threshold that routes low-scoring submissions to spam), you decide that outcome, and you are responsible for assessing whether Art. 22 applies to your own process and for providing the safeguards it requires.
- Spam filtering: submissions are scored by default, which can include AI checks through OpenAI; form owners can correct the result (Section 4).
- AI features: such as lead scoring, lead tags, inbox reprocessing, and chat, which send the relevant visitor or submission content to OpenAI (Section 4).
- Site generation: if you build a site, your description, the changes you ask for, the page, and images you upload are sent to OpenAI to build, describe, improve, and check it (Section 2).
- Abuse screening: we automatically screen accounts, forms, pages, and email templates for phishing and other abuse, using rules and AI that assess an account's forms, pages, and the submissions it receives. This can flag an account for verification without prior human review, where needed to run the Service safely under our contract with you (Art. 22(2)(a)). Until it's verified, the account is paused: submissions are held, not delivered, and its hosted forms and Basin Sites pages are offline. We email you when this happens, with how to contest it, and our staff review every automatic flag and lift it if it was wrong. You can also contact support@usebasin.com to ask for a review and give your point of view.
- Internal AI assistance: we may use AI to draft support replies for our staff, to assess account-verification requests, to help administer accounts, to answer questions in our website chat, and to format testimonials for display.
9. Your Rights
Your Right to Object
You can object at any time to processing we base on legitimate interests (Art. 6(1)(f) in Section 3), such as aggregate statistics and measuring our marketing. We will stop unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or need the data to establish, exercise, or defend legal claims.
You can object to direct marketing at any time, and we will stop. Turn emails off in yournotification settingsor use the link in any of them. To object to anything else, email support@usebasin.com.
You can access, correct, or erase your personal data, restrict or object to its processing, receive a portable copy of it, and withdraw consent at any time (this doesn't affect processing done before then). Account holders can also close their account in account settings to erase live account, form, and submission data. These rights apply to anyone whose data we control, including site-preview guests, people who send testimonials, invitees, support contacts, and website visitors. Contact support@usebasin.com or submit a GDPR request. We respond within one month, or tell you if we need more time. You can also complain to us at support@usebasin.com, and to the data protection or privacy authority where you live.
Form submitters: the form owner is the controller of your submission, so please send requests about it to them. If you send one to us instead, by email or by submitting a GDPR request, we pass it to the form owner if we can tell which form it's about, and act on it only on their instructions or where the law requires. For our own uses of form data (Section 4), we answer your request ourselves.
10. Cookies
Strictly necessary cookies operate the Service, for example to keep you signed in. Analytics, advertising, and attribution cookies on our website and in the Basin dashboard are subject to consent where required. Details and withdrawal are in ourCookie Policy.
11. Promotional Communications
We email you onboarding tips and product updates unless you turn them off. We send our newsletter, offers and requests for a testimonial only if you ask for them, by ticking the box when you sign up with an email and password or by turning them on later. You choose which of these you receive in yournotification settings, and every such email has a link to change them. Messages about your account and the Service continue.
12. Security
We use HTTPS, hashed passwords, optional two-factor authentication, encryption of sensitive credentials at rest, role-based access, and filtered error reports. Stripe handles card data.
13. Business Transfers
If Moonshot Ventures Inc. transfers the Service to an affiliate, is acquired, or sells substantially all of its assets, personal data may transfer with the business. We will notify account holders by email and update this page.
14. Children
Basin accounts are for adults (see our Terms of Service), and our website and dashboard are not directed at children. If we learn that a child has given us personal data for an account, in our website chat, or in a testimonial, we delete it. Children's data in a form owner's submissions is processed on the form owner's instructions under our DPA, and the form owner is responsible for meeting the law's requirements for it, such as parental consent.
15. Changes to This Policy
We may update this policy. For material changes we will notify you by email or in the dashboard before they take effect. The "Last updated" date reflects the latest revision.
16. Contact Us
Privacy Officer
Moonshot Ventures Inc.
30060 Harris Road
Abbotsford, BC, V4X 1V6
Canada
support@usebasin.com
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
- European Union (EU): iuro Rechtsanwälte GmbH t/a Prighter
- United Kingdom (UK): Prighter Ltd
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website:https://app.prighter.com/portal/13823672021