Privacy Policy

1. Who We Are (Data Controller)

Base44 ("Platform", "we", "us", "our") is a social networking service. For the purposes of the General Data Protection Regulation (GDPR), the UK GDPR, and other applicable privacy laws, Base44 is the data controller of your personal information.

Contact: For all privacy matters, data requests, or complaints, email us at: privacy@base44.app

EU/EEA and UK users may also contact our designated representative at the same address.

2. Information We Collect

Information you provide directly:

• Account registration data: name, email address, date of birth (for age verification)
• Profile information: display name, bio, avatar, cover photo, interests, mood, social links
• User-generated content: posts, comments, wall messages, stories, music preferences
• Communications: direct messages, room messages, group posts
• Payment information (processed by our payment providers — we do not store full card details)

Information collected automatically:

• Technical data: IP address, browser type, operating system, device identifiers
• Usage data: pages visited, features used, session duration, click patterns
• General geographic location derived from IP address
• Cookies and similar tracking technologies (see Section 8)

Information from third parties: If you connect third-party services (e.g., Spotify), we receive data as authorized by you on that platform.

3. Legal Basis for Processing (GDPR / UK GDPR)

We process your personal data under the following lawful bases:

• Contractual necessity (Art. 6(1)(b)): To provide you with the Platform and its features
• Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, improving services, and analytics
• Consent (Art. 6(1)(a)): Marketing communications, optional features, third-party integrations — which you may withdraw at any time
• Legal obligation (Art. 6(1)(c)): Compliance with applicable laws, responding to lawful requests
• Vital interests (Art. 6(1)(d)): Safety-critical situations involving risk of harm

4. How We Use Your Information

• To create and manage your account and profile
• To enable social features: friends, messaging, posts, groups, and live features
• To send transactional emails (verification codes, account alerts, security notices)
• To process payments and fulfil digital product purchases
• To enforce our Terms of Service and Community Guidelines
• To detect, investigate, and prevent fraudulent or illegal activity
• To improve, personalise, and develop new features
• To comply with legal obligations and respond to lawful requests from authorities
• To send promotional communications (only with your explicit consent; unsubscribe anytime)

5. Data Sharing & Third Parties

We do not sell your personal information. We may share data with:

• Service providers: Cloud infrastructure, email delivery, payment processors, analytics — bound by data processing agreements
• Business transfers: In the event of a merger or acquisition, your data may transfer to the successor entity
• Law enforcement: When required by law, court order, or to protect user safety and platform integrity
• Other users: Public profile information and posts you choose to share are visible to other users per your privacy settings

We require all third-party processors to maintain appropriate security and only process data for specified, lawful purposes.

6. International Data Transfers

Your data may be transferred to and processed in countries outside your home country, including the United States. When transferring data from the EU/EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms. By using the Platform, you acknowledge this transfer.

7. Data Retention & Deletion

We retain your personal data only as long as necessary for the purposes described in this policy, or as required by law:

• Active account data is retained while your account is active
• Upon account deletion, personal data is removed within 30 days
• Backup copies may persist for up to 90 days before complete purge
• Certain data (e.g., billing records, legal compliance logs) may be retained for up to 7 years as required by law
• Anonymised, aggregated data may be retained indefinitely

To request deletion, use Account Settings → Delete Account, or email privacy@base44.app.

8. Cookies & Tracking Technologies

We use cookies and similar technologies for authentication, session management, and basic analytics. You can control cookies through your browser settings. Disabling cookies may affect Platform functionality. We do not use cookies for cross-site behavioural advertising without your consent.

9. Children's Privacy (COPPA / GDPR-K)

Base44 requires users to be at least 15 years of age. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/EEA where applicable). We use age verification at registration. If we discover a user is under the minimum age, we will immediately delete their account and all associated data. Parents or guardians who believe their child has registered may contact us at privacy@base44.app.

10. Your Rights

Depending on your jurisdiction, you have the following rights:

• Access: Request a copy of the data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure ("Right to be Forgotten"): Request deletion of your data
• Restriction: Request that we limit processing of your data
• Portability: Receive your data in a machine-readable format (use the Data Export feature in Settings)
• Objection: Object to processing based on legitimate interests or for direct marketing
• Withdraw Consent: Withdraw consent at any time where processing is consent-based
• Non-Discrimination (CCPA): California residents will not be discriminated against for exercising privacy rights
• Opt-Out of Sale (CCPA): We do not sell personal data — no opt-out needed
• Canadian Rights (PIPEDA): Access, correction, and withdrawal of consent rights apply to Canadian users

To exercise any right, contact us at privacy@base44.app. We respond within 30 days.

EU/EEA/UK users have the right to lodge a complaint with your local supervisory authority (e.g., ICO in the UK, your national DPA in the EU).

11. Security

We implement industry-standard security measures including encryption in transit (TLS), access controls, and regular security reviews. We will notify affected users and relevant authorities of any data breach as required by law (within 72 hours under GDPR).

12. User-Generated Content & Public Visibility

Content you post publicly is visible to other Platform users or the public depending on your privacy settings. You retain ownership of your content but grant Base44 a non-exclusive, worldwide, royalty-free licence to display it on the Platform for as long as you maintain your account.

13. Changes to This Policy

We will notify registered users of material changes via in-app notification and/or email at least 30 days before changes take effect. The date at the top of this page reflects the most recent update.

14. Contact & Data Protection

• Privacy inquiries & data requests: privacy@base44.app
• General support: support@base44.app
• Legal & DMCA: legal@base44.app
• Response time: Within 30 days of receipt

15. Minor Safety — KOSA & COPPA Expanded

OurSpace 2.0 fully complies with the Children's Online Privacy Protection Act (COPPA) and operates in alignment with the Kids Online Safety Act (KOSA) framework. We implement the following protections for minors:

• Minimum age of 15 enforced at registration with active age verification
• No targeted advertising directed at users under 18
• Default privacy settings for minor users are set to the most restrictive available configuration
• Dating/Connect features (OurSpace Connect) require users to be 18+ and are gated by a separate age verification check
• No dark patterns, addictive design, or engagement maximization mechanics targeted at minors
• Parental inquiry and minor account deletion requests are honored within 48 hours at privacy@ourspace.app
• No sale or sharing of minor user data with third-party advertisers under any circumstance

16. EU Digital Services Act (DSA) Compliance

As a platform accessible to EU/EEA users, OurSpace 2.0 complies with the EU Digital Services Act (Regulation (EU) 2022/2065):

• Users may report illegal content via the in-app Report feature or by emailing legal@ourspace.app
• We maintain a transparent content moderation policy with a user appeals process (see Terms of Service §5)
• We do not use profiling-based recommender systems that rely on sensitive personal data categories
• Our algorithmic feed dial is user-controlled and explainable — users may switch to pure chronological at any time
• Annual Transparency Reports will be published when required by applicable DSA thresholds

17. Federal Trade Commission (FTC) Compliance

OurSpace 2.0 complies with FTC regulations and guidelines including:

• FTC Act Section 5: No unfair or deceptive trade practices, misleading advertising, or hidden material terms
• Endorsement Guides: Any sponsored content or paid partnerships on the platform must be clearly disclosed by creators using the #ad or #sponsored tag
• Children's Advertising: No behavioral advertising directed at users under 18
• Data Security: We maintain reasonable data security practices as required under FTC authority
• To report an FTC-related concern about our platform, contact legal@ourspace.app

18. ADA / Accessibility Compliance

OurSpace 2.0 is designed to meet WCAG 2.1 Level AA accessibility standards in compliance with the Americans with Disabilities Act (ADA) and equivalent international accessibility laws:

• All interactive elements have minimum 44×44px touch targets on mobile
• Color contrast ratios meet WCAG 2.1 AA minimums
• Screen reader compatible markup across core navigation and content areas
• Calm Space mode available for users with sensory sensitivities — disables all animations
• Reduced motion support via prefers-reduced-motion media query
• Accessibility feedback: accessibility@ourspace.app

19. Communications Compliance (TCPA / CAN-SPAM)

All promotional communications sent via the Platform comply with the federal CAN-SPAM Act and the Telephone Consumer Protection Act (TCPA). You may opt out of marketing emails at any time using the unsubscribe link included in each email. We do not send unsolicited text messages to mobile devices without your prior express written consent.

20. VoIP & Real-Time Communications

Base44 provides voice and video calling features powered by WebRTC and third-party infrastructure (Twilio, Daily.co). These communications are not end-to-end encrypted by default. Do not use these features to transmit sensitive personal, financial, or medical information. Call metadata (duration, participants) may be logged for platform security and abuse prevention. We comply with applicable wiretapping and electronic surveillance laws including 18 U.S.C. § 2511 (federal) and applicable state equivalents. We will respond to lawful intercept orders from law enforcement as required by law.