Privacy policy

Personal data in Basketly is the responsibility of STORM INTERNATIONAL SP. Z O.O., ul. Wołodyjowskiego 52, 02-724 Warsaw, Poland, tax ID (NIP) 5213682658, which operates the app and its Meta integration. The service contract and payments are handled by ITWorks Katarzyna Bańcer, ul. Sikorskiego 9a, 02-864 Warsaw, Poland, tax ID (NIP) 1231178164. For anything about personal data, write to kontakt@basketly.io.

The roles depend on the kind of data:

• For your own account data (such as name, email, sign-in) we are the controller.
• Leads and people you add or connect (Meta lead forms, Google Sheets, shop orders, the CRM) belong to your business. You are their controller and we process them on your behalf as a processor.

A data processing agreement (DPA) is available on every plan. Write to kontakt@basketly.io.

• Account: name, email, a password hash (never the password itself) and sign-in sessions.
• Organisations and team: organisation names, members and their roles.
• A connected Meta account (Facebook Login for Business): access tokens, and the ad accounts, Pages, lead forms and datasets you choose.
• A connected Google account: only the openid, email and drive.file scopes. Access covers only the Google Sheets files you pick in the Google Picker. We read the rows of those sheets.
• A connected Figma account (when you import an ad template): the file_content:read and current_user:read scopes. We store an encrypted access token and the Figma account email. We read only the frame whose link you paste, at the moment of the import.
• Orders your shop sends us (for example Shoper).
• SMS accounts you connect: SMSAPI, Twilio, an HTTP gateway, smsportal.app.
• Leads from Meta Instant Forms: name, email, phone and every form answer. Submission content is stored encrypted.
• People in the CRM: contact details, stage, history, notes, tasks and owner.
• Campaign spend and ad data (campaigns, ad sets, ads) read from Meta.
• Automation runs: steps, results and the data needed to carry them out.

We process account data to provide the service you ask for (Art. 6(1)(b) GDPR) and to keep the service secure (Art. 6(1)(f) GDPR).

We process leads and people only to do what you set up in the panel: fetch submissions, keep the CRM, send events to Meta, send an SMS or a webhook, build the campaign report. We do this on your instructions, under the data processing agreement.

We do not sell data, use it for advertising or build profiles from it.

Basketly’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google data only to import the rows of the sheets you choose into your own organisation.
• We never use it for advertising and never sell it.
• People do not read this data, except with your consent for support, or when security or the law requires it.

From Meta we read the resources you choose after signing in with Facebook Login for Business: leads from Instant Forms, Page and form details, ad spend and ad data.

We send events to the Meta Conversions API only when you create a flow. Email and phone are normalised and hashed with SHA-256 before sending. Meta Platforms Ireland Ltd then receives this data under Meta’s terms.

• We read a Figma file only when you paste a link to a frame and click “Import”. The layers and images of that frame are saved as a template in your organisation.
• We show the Figma account email only so you know which account is connected. We never change anything in Figma and never share file content with anyone.
• You remove the connection with “Disconnect” in the import dialog, which deletes the token. You can also revoke access in Figma: Settings → Security → Connected apps.

• Contabo GmbH: the provider of the server the service runs on (data centre in France).
• Meta Platforms Ireland Ltd: events from the flows you create.
• The SMS provider you connect (SMSAPI, Twilio, your HTTP gateway or smsportal.app): the number and text of automation messages.
• The addresses you enter in automation webhooks: the data you set up in them.
• Stripe Payments Europe Ltd: billing details when you pay for a plan (company name, email; card details are handled by Stripe only).
• MiniMax (api.minimax.io, processing outside the European Economic Area): only the ad texts from your ad account, to give them descriptive labels in Creatives. We never send lead or contact data there.
• PostHog Inc. (data in the EU) and Google Ireland Ltd: visit statistics on the site and in the panel, only after your consent in the banner (section "Cookies and statistics"). We never send lead or contact data there.

We share data with no one else unless the law requires it.

The service runs on our own server in the European Union (Contabo GmbH, data centre in France). Data lives in an SQLite database on that server.

Secrets, OAuth tokens and lead and form content are encrypted with AES-256-GCM.

We take a backup every night and keep it for 14 days on the same server.

• Contact details stored on a lead are erased after 30 days. The lead ID and its stages stay, so the lead is never counted twice.
• People in the CRM are erased after the organisation’s retention period (6 to 120 months, default 24) since their last activity.
• Automation run data is erased after 30 days.
• You can erase a person in the panel at any time.
• We delete an account on request sent to kontakt@basketly.io, within 30 days.

Necessary cookies: the panel sign-in session (HttpOnly), protection against forged requests (CSRF) and baskety_consent, which remembers your choice in the consent banner for 180 days. One choice applies on basketly.io and in the app.basketly.io panel.

After you click "Accept" in the banner we use two statistics tools. The legal basis is your consent (Art. 6(1)(a) GDPR):

• PostHog (PostHog Inc., data stored in the European Union, in Frankfurt): page views, clicks, where the visit came from, approximate location (country, city) worked out from the IP address, without storing the IP address itself, and a recording of how the visit went (scrolling, clicks, cursor movement). Form field contents are hidden in the recording. In the panel PostHog links events to your account ID, so we know which features you use. Cookies and browser storage: ph_* (up to 1 year). We keep events for up to 12 months and recordings for 30 days.
• Google Analytics 4 (Google Ireland Ltd): page views and clicks, in Google Consent Mode with only statistics granted. Advertising signals and Google Signals are off. Cookies: _ga and _ga_* (up to 2 years). We keep the data for up to 14 months. Google may transfer it to Google LLC in the USA under the EU-US Data Privacy Framework.

Without consent we load neither tool. You can withdraw consent at any time: click "Cookie settings" in the site footer, then "Reject". We then remove these tools' cookies from your browser.

Under the GDPR you have the right to:

• access your data,
• have it corrected,
• have it erased,
• restrict processing,
• data portability,
• object to processing,
• complain to the Polish supervisory authority, the President of the Personal Data Protection Office (PUODO).

Write to kontakt@basketly.io. If you are a person in one of our customers’ CRMs, contact the business that collected your data first. We will help them handle your request.

When we change this policy, we update the date at the top of the page.