Privacy Policy

Last updated: 22 October 2026

This policy explains what personal data baseray processes, why, on what legal basis, who receives it, how long we keep it and how you can use your rights. It covers baseray.tech, app.baseray.tech and api.baseray.ai, our API, our MCP server and the emails we send.

baseray is a business-to-business data service. It describes every building in Romania and Czechia and the registered businesses whose registered office is at a building’s address. It is built for companies; anyone, consumers included, can buy a one-off report on a building (section 4.9).

1. Who we are

The controller of your personal data is the company that provides the baseray service (“baseray”, “we”, “us”):

• Company: ASTRAQ VENTURES S.R.L.
• Registered office: Strada Cireșului, Satul Fundeni, Comuna Dobroești, Județul Ilfov, Romania
• Trade register number: J2025037487002 (EUID: ROONRC.J2025037487002)
• Tax identification number: CUI 51856351
• Privacy questions and requests: privacy@baseray.ai
• General contact: hello@baseray.ai

2. Summary

• We collect what we need to run your account, bill you, deliver a report you bought and keep the service secure.
• Product analytics runs on servers in the EU. We record every visit to baseray.tech and the app, with everything you type masked. We keep an analytics cookie in your browser only if you accept it in our cookie banner. Advertising cookies are set only while we advertise, and only if you accept them.
• Building data describes buildings, not people. We do not link buildings to private individuals. We do not show who lives in a building or who holds title to it.
• Business data comes from public business registers. Where a business belongs to a person, such as a sole trader, this is personal data. Section 7 explains these persons’ rights. Our removal page takes such a business out of baseray.
• You can access, correct, export or delete your data. Write to privacy@baseray.ai. We answer within one month.

3. Our role: controller or processor

We are the controller for:

• account, workspace, billing, analytics, log and email data about our customers and visitors;
• the building and business data we compile and publish in the app, the API, exports and public pages.

We are a processor under Article 28 GDPR only for personal data that customers put into the service themselves, such as the names and content of lead lists and the email addresses of people they invite. For that data the customer is the controller and we act on the customer’s instructions. Our data processing addendum sets out the terms of that processing.

4. Data we process about customers and visitors

4.1 Account

When you create an account we process your first and last name, email address, password (stored only as a one-way hash), optional phone number, language, two-factor authentication settings, and a record of your consents (terms, privacy policy, and marketing emails if you opt in) and of whether you switched session recordings off. We record whether your email address is verified. For each browser session we keep the IP address, user agent and time of last activity, so you can see your sessions and sign out other devices.

During onboarding we ask for your job function, how you heard about us, company size, industry, use cases and target countries. We use the answers to set up your workspace and to understand who uses baseray.

Legal basis: performing our contract with you or your company (Article 6(1)(b) GDPR). Onboarding answers and session records also rest on our legitimate interest in tailoring and securing the service (Article 6(1)(f)).

4.2 Workspace

A workspace holds its name, the company name and website, members and their roles, invitation emails, lead lists and saved buildings, API keys (stored only as hashes, so we cannot read them back), daily API usage counts, a log of the requests made with the workspace’s API keys (time, path and query, status, IP address and user agent), the credit ledger (which buildings were opened in full or exported, and when), and connected AI assistants (OAuth clients and tokens).

Legal basis: performing the contract (Article 6(1)(b)); enforcing plan limits and preventing abuse (Article 6(1)(f)).

4.3 Billing

Payments run through Stripe. We store your Stripe customer id, subscription, plan, invoices and, if you give it, your tax or VAT id. You enter card data directly with Stripe. It never reaches our servers.

Legal basis: performing the contract (Article 6(1)(b)) and keeping accounting and tax records as the law requires (Article 6(1)(c)).

4.4 Sign-up attribution

When you sign up we store with your account the campaign parameters of the link you arrived with (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the referring website and the first page you landed on. This tells us which channels bring customers.

Legal basis: our legitimate interest in measuring our marketing (Article 6(1)(f)). You can object at any time (section 14).

4.5 Product analytics and session recordings

We use PostHog Cloud EU, hosted in Frankfurt, Germany, to understand how baseray is used and what to improve. Analytics reaches PostHog through our own domains.

Session recordings. We record every visit to baseray.tech and to the app: page views, clicks, scrolling, mouse movement and the pages as they are displayed. Everything you type into any field is masked: a recording shows asterisks in its place. Parts of a page that we mark as personal are hidden as well, such as an email address you entered when the page shows it back to you, and in the app other people’s email addresses and names and API keys. Recordings in the app also hold the errors and console messages the app runs into.

Nothing kept in your browser without your consent. Unless you accept analytics cookies in our cookie banner, analytics sets no cookies and keeps nothing in your browser’s storage. A random visitor id and session id then exist only in the memory of the open page. When you follow a link to another page of baseray.tech or to the app, the link carries them in the parameter br_ph, so that one visit reads as one session. The parameter is valid for 30 minutes, and the page it opens removes it from the address bar at once.

If you accept analytics cookies. PostHog keeps the visitor id and session id in a cookie on baseray.tech, which baseray.tech and the app share, and in your browser’s storage, for up to 365 days after your last visit. Your visits on different days, and from baseray.tech to the app, are then linked to one pseudonymous visitor, so we can see how people come back and what leads them to sign up. We ask on your first visit; your answer counts for baseray.tech and the app for 180 days, then we ask again. You can withdraw at any time under “Cookie settings” at the bottom of every page of baseray.tech, or in the app: we then delete the cookie and the stored ids at once and go back to keeping them only in the open page. Our cookie notice lists the cookie.

What we collect: a pseudonymous user id (a one-way hash, never your email address), a pseudonymous id of your workspace, page views and page addresses with everything you typed removed (search text, map position and place names are stripped; only campaign tags and the id of the building open on the map are kept), referrer, campaign parameters, product events (which features are used, for example searches, buildings opened, filters, lists, exports, solar analyses and settings changes; for a search we record only its length, never its text), page-load speed, browser and device type, and an approximate location that PostHog derives from your IP address. Sign-in, credit, checkout, trial and subscription events and calls to our API and MCP server are sent from our servers. For each call an AI assistant makes through our MCP server we also record the tool, whether the call worked and, if not, the type of error (never the error message), how long it took, and the assistant’s name and version, so we can see which tools work and where they fail. Of the inputs the assistant sent we keep the names, but a value only when it is a yes/no flag or one of the tool’s fixed choices; every other value is replaced by its type (for example “string”), so we record no addresses, places, names of businesses or people, registration numbers, ids or coordinates. Of our answer we keep no content, only its size in characters, how many buildings and registered businesses it contains and whether it offers a next page. On baseray.tech we also collect clicks on links and buttons, how far you scroll, and errors.

If you are signed in. Your analytics profile is keyed by a pseudonymous id and holds your email address, your name and your workspace’s name, so we can follow up on problems you hit. Our servers also report your account and billing moments to it: your sign-up and where you first came from (the first page you saw, the referring website, the campaign parameters and the sign-up link you followed), credits spent, your trial, plan and payments, and your stage as a customer.

Legal basis: our legitimate interest in understanding and improving the service and its sign-up journey (Article 6(1)(f) GDPR). We weighed this interest against yours. Our safeguards: everything you type is masked and what we mark as personal is hidden, nothing is stored on your device unless you accept analytics cookies, the data stays in PostHog’s EU cloud, we keep session recordings for 30 days and analytics events for 24 months (section 12), and we never use analytics to make decisions about you. Keeping the ids in a cookie on your device rests on your consent (Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive), which you can withdraw at any time without affecting what happened before.

Your right to object (Article 21 GDPR). If your browser sends the Global Privacy Control signal, we do not record your visits; page views and other events are still counted. We also take the signal as a refusal of analytics and advertising cookies, so the banner does not ask, unless you accept them yourself under “Cookie settings”. If you are signed in, you can switch recordings off in your profile in the app, which also removes your email address and name from your analytics profile. Anyone can object by writing to privacy@baseray.ai; if you have an account, we then exclude it from analytics.

What we do not do: we do not use analytics for advertising and we do not sell analytics data.

4.6 Server logs and security

Our servers log the IP address, user agent, requested path and time of each request. We use logs to run the service, find faults, enforce API limits and detect attacks.

Legal basis: our legitimate interest in a secure, working service (Article 6(1)(f)).

4.7 Emails and correspondence

We send transactional emails (email verification, password reset, workspace invitations and the link to a building report you bought) through Resend. They are part of the service. We send marketing emails only if you opted in. Every marketing email has an unsubscribe link, and you can opt out at any time by writing to privacy@baseray.ai. We keep sales and support correspondence to answer you and to keep a record of what was agreed.

Legal basis: contract for transactional emails (Article 6(1)(b)); consent for marketing emails (Article 6(1)(a)), which you can withdraw at any time without affecting earlier processing; legitimate interest for correspondence (Article 6(1)(f)).

4.8 Country requests

When you ask for baseray in a country it does not cover yet, on baseray.tech/countries or through our API, we store the country, your email address, your company and what you need the data for if you give them, the language of the page, when you agreed to be emailed, and the same first-touch details as at sign-up (campaign parameters, the referring website and the first page you saw).

We use them only to email you when baseray covers that country and to decide which countries to add next. A request does not sign you up for marketing emails, and we do not share your address. Product analytics count the country only, never your email address. We keep each request for up to 24 months and then delete it automatically. To delete it sooner, write to privacy@baseray.ai from that address: we delete every request made with it.

Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time without affecting earlier processing.

4.9 Building reports bought without an account

When you buy a report on a building without an account, Stripe takes the payment and passes us the email address you give at checkout. With the order we store that email address; the building; the price, currency and time of payment; Stripe’s references for the checkout and the payment; the language of the page; the record that you asked for immediate delivery, acknowledged the loss of your right of withdrawal and accepted our terms, and when; the same first-touch details as at sign-up (campaign parameters, the referring website and the first page you saw) and that you came from the report offer; and, if your browser sent them, the analytics visitor and session ids of your visit. We keep the private link that opens the report only as a one-way hash and in encrypted form, so that we can find your order and email you the link. Your card details go to Stripe directly and never reach our servers.

We use this data to deliver the report and email you its link, to answer your questions and refund requests, to keep accounting records and to be able to show the request and acknowledgement you gave. Our servers also record the checkout and the purchase in product analytics (section 4.5), with the building’s country and the amount; your analytics profile then holds the email address you gave at checkout. We keep the order as long as tax and accounting law requires, up to 10 years; the link to the report works for 12 months from payment.

Legal basis: performing the contract (Article 6(1)(b)); keeping accounting and tax records as the law requires (Article 6(1)(c)); our legitimate interest in being able to show your request and acknowledgement and in measuring our sales and marketing (Article 6(1)(f)). You can object to the analytics at any time (section 14).

4.10 Advertising cookies (only while we advertise)

While we advertise baseray with Google Ads, our cookie banner also offers advertising cookies. Only if you accept them does your browser load Google’s tag (gtag.js). It sets Google Ads cookies, such as _gcl_au, on baseray.tech and sends Google the page you visit, the ad you clicked if you came from one, your IP address and your browser and device type, so that we can see which of our ads bring visitors. Until you accept, Google’s tag is not loaded at all. While we do not advertise, the banner does not offer advertising cookies and nothing is sent to Google Ads.

You can withdraw at any time under “Cookie settings”: we then tell Google’s tag on the page that you withdrew and delete its cookies.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive), which you can withdraw at any time without affecting what happened before.

4.11 Questions on building pages

A building’s page on baseray.tech may ask you an optional question; we store your answer, including any text you type, without anything that identifies you, and keep it to improve the service (our legitimate interest, Article 6(1)(f)).

5. Cookies and similar technologies

Some cookies and browser storage are strictly necessary to provide the service, or remember a choice you made, such as your language or your answer to our cookie banner. The law does not require consent for them. Everything else is set only if you accept it in the cookie banner, which asks on your first visit to baseray.tech or the app: the analytics cookie (section 4.5) and, only while we advertise, advertising cookies (section 4.10). Rejecting is as easy as accepting. Your answer counts for baseray.tech and the app for 180 days, then we ask again, and you can change it at any time under “Cookie settings” at the bottom of every page of baseray.tech, or in the app. If your browser sends the Global Privacy Control signal, we take it as a refusal and do not ask, unless you accept yourself. Our cookie notice lists each cookie, with its purpose and duration.

The map in the app loads its images from the tile server of the map style you choose, and the 3D view, address suggestions and address lookup come from Google Maps Platform. Your browser connects to these services directly. They receive your IP address and the area you view, and Google also receives the addresses you type.

6. Building and address data in the product

baseray describes buildings: footprint, height and volume (each marked as measured or estimated), floors, dwellings and entrances where on record, construction year where on record, category, existing solar panels with the date of the check, roof solar potential, and climate and hazard facts. We compile this from public building and land registers, official statistics, and open map and aerial data.

This data is about buildings, not people. We do not link buildings to private individuals. We do not show who lives in a building or who holds title to it.

An address, especially that of a family house, can still relate to an identifiable person. We treat addresses with care. We process them on the basis of our legitimate interest, and that of our customers, in understanding buildings for energy, solar, insurance, construction and sales work (Article 6(1)(f)). If you believe a building record relates to you and you want to object, write to privacy@baseray.ai with the address. We will assess the request and, where your interests prevail, remove or limit the record in the product and on public pages.

7. Notice to persons whose business is in a public business register

This section is our information notice under Article 14 GDPR for natural persons whose business is registered in one of the public business registers below, and for the heirs and administrators of estates of deceased persons registered there. The name of such a business is often the person’s own name, and its registered address is often their home, so this data is personal data. Where this section says “your business”, it also means an estate you administer.

These registers are public by law, so that anyone can know who trades and where.

7.1 What data we process

• Business name, registration number (CUI and trade register number in Romania, IČO in Czechia, CVR number and P-numbers in Denmark), country, registered address, legal form, status (active or ceased) with start and end dates, registered activity, and employee range and turnover where the register publishes them.
• In Denmark, also whether the business is protected from advertising in CVR (reklamebeskyttet).
• We do not process national identification numbers (such as CNP, rodné číslo or CPR number), data on owners, managers or other participants, phone numbers or email addresses. We add nothing about you from other sources, such as websites or social networks, and we process no special categories of data.

7.2 Where we show it

• To signed-in customers: in the app, through the API, in the AI assistants they connect through our MCP server, and in exports.
• On our public pages on baseray.tech: only how many businesses are registered at an address, never a sole trader’s business or an estate by name. Our public lists of companies leave them out.
• Estates of deceased persons: only in the app and the API, labelled as estates, and only while they are active. Never in exports or on public pages.
• Advertising protection (Denmark): if a business is reklamebeskyttet in CVR, we mark it wherever we show or pass it on, leave it out of public lists and marketing exports, and never use it for our own marketing.

A registered office shows where a business is registered. It does not mean the business occupies the building or holds title to it, and we do not present it that way.

7.3 Purposes

• Letting our customers find and assess businesses for business-to-business sales, market analysis, and risk and insurance assessment of buildings.
• Showing, on public pages, how many businesses are registered at an address.

7.4 Legal basis and balancing

We rely on legitimate interest (Article 6(1)(f) GDPR): ours in offering a business information service, and our customers’ in finding and assessing businesses. We balanced these interests against yours:

• the data is already public, published by law so that others can know who trades and where, and the law allows it to be reused;
• it concerns you only in your business capacity;
• we add no contact data and no data from other sources;
• we do not show your business by name on public pages;
• we keep ceased businesses only for a limited time (section 7.6);
• we do not profile you in a way that produces legal or similarly significant effects, and we process no special categories of data;
• you can have your business removed at any time, without giving a reason (section 7.7).

We have documented this balancing, and an assessment of the risks of this processing for the persons concerned.

7.5 Recipients

Our customers, through the app, the API, the AI assistants they connect and exports; and our sub-processors (section 9). Visitors to our public pages see only counts.

7.6 Retention

• Active businesses: while the register lists them as active.
• Ceased sole proprietorships: at most five years after the end date the register gives, marked as ceased.
• Estates of deceased persons: removed within 30 days after the estate ceases.
• Businesses removed on request: deleted when we carry out the request; we keep only the suppression record (section 7.7).
• Data a register no longer publishes at all: removed within 30 days after it leaves the register.

7.7 Your right to object

You can object at any time to our showing your business or an estate you administer. Use our removal page, or email privacy@baseray.ai with the registration number (CUI or trade register number, IČO, CVR number or P-number).

• For a PFA, II or IF, an OSVČ, an enkeltmandsvirksomhed, a PMV or an estate, we remove it without asking for a reason or for proof of identity.
• We aim to do so within 7 days, and do it within one month at the latest.
• We remove it from the app, the API, AI assistants, exports, public pages and counts, and we ask customers who exported it in the past 24 months to delete it.
• We keep only a suppression record (the registration number, the date and what was removed), for as long as the register publishes the business, so that it is not imported again at the next register update.
• If you tell us your safety is at risk, for example because the registered address is your home, we remove it within 72 hours, without asking for proof.
• For other businesses, such as a company that carries your name, write to us: we decide case by case and remove it where the name is a person’s name.

You also have the other rights listed in section 14.

7.8 Why you did not receive an individual notice

We hold the registered address of each business, but no contact person, phone number or email address. Writing to the more than two million persons concerned would take an effort out of proportion to the impact of this processing: the data are already public, we show them by name only to business customers, and you can remove your business at any time. We therefore publish this notice under Article 14(5)(b) GDPR, in the language of each country concerned, and we have documented this assessment.

7.9 Customers who contact you

A customer who uses baseray to contact a business is an independent controller for its own outreach. Our terms require customers to comply with the GDPR and with the direct-marketing laws of each country, such as Romanian Law No. 506/2004, Czech Act No. 480/2004 Coll. and, in Denmark, section 10 of the Marketing Practices Act (markedsføringsloven) and section 19 of the CVR Act (CVR-loven) on businesses protected from advertising. If a customer contacts you, you can exercise your rights directly with that customer, and you can tell us at privacy@baseray.ai.

8. Legal bases at a glance

9. Sub-processors and other recipients

We use these sub-processors. Each processes personal data only on our instructions and under a data processing agreement. Our sub-processors page keeps the current list, with the data each one receives.

Stripe is also an independent controller for its own fraud prevention and regulatory compliance processing, under its own privacy policy. Google is also an independent controller for its own advertising purposes, under its own privacy policy.

We also disclose personal data when the law requires it (for example to tax authorities or courts), to professional advisers bound by confidentiality, and to a buyer or successor if our business is transferred, who must then honour this policy. We do not sell personal data.

10. Transfers outside the EU

Our main hosting is in the EU. Some providers are based in the USA or run global networks. Where personal data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework for certified providers and on Standard Contractual Clauses approved by the European Commission. You can ask for a copy of these safeguards at privacy@baseray.ai.

11. AI assistants you connect

Through our MCP server you can connect an AI assistant, such as Claude or ChatGPT, after signing in with OAuth. The assistant acts with your account and receives the data you ask it to fetch. You choose the assistant. Its provider handles that data under its own terms and privacy policy, and it is not our sub-processor. You can disconnect an assistant at any time in your settings; we then revoke its tokens.

12. How long we keep data

You can delete your account in Settings at any time.

13. Security

• All connections to our sites and API are encrypted in transit (HTTPS/TLS).
• Passwords and API keys are stored only as one-way hashes.
• Access to our internal admin panel is limited to a short list of named staff accounts.
• Two-factor authentication is available for every account.
• Our hosting is in EU data centres (Microsoft Azure, Poland Central).

Our security page describes these measures in more detail.

If a personal data breach is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it and inform you where the law requires.

14. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• receive the data you gave us in a structured, machine-readable format (portability);
• object to processing based on legitimate interest, and at any time to direct marketing;
• withdraw consent at any time, without affecting processing before the withdrawal;
• lodge a complaint with a supervisory authority (section 15).

To exercise a right, email privacy@baseray.ai. We may ask you to confirm your identity, for example by writing from the email address of your account. We answer within one month. For complex or numerous requests we may extend this by two further months and will tell you why. Requests are free unless they are manifestly unfounded or excessive.

We make no decisions about you based solely on automated processing that produce legal or similarly significant effects.

15. Complaints

You can complain to the supervisory authority of the EU member state where you live, where you work or where the alleged infringement took place. In the countries whose registers section 7 lists:

• Romania: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro
• Czechia: Úřad pro ochranu osobních údajů (ÚOOÚ), www.uoou.gov.cz
• Denmark: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk

We are established in Romania, so ANSPDCP is our lead supervisory authority. An authority you complain to in another country works with it on your complaint.

We would appreciate the chance to resolve your concern first at privacy@baseray.ai.

16. Children

baseray is a business service and is not meant for anyone under 18. We do not knowingly collect personal data of children.

17. Changes to this policy

We will update this policy when our processing changes. For material changes we will notify customers by email or in the app before they take effect. The date at the top shows the latest version.

18. Contact

• Privacy: privacy@baseray.ai
• Everything else: hello@baseray.ai