Privacy Policy — DecideBase
How DecideBase handles your data.
This Privacy Policy describes how DecideBase collects, uses, and protects your data. By using DecideBase, you agree to the practices described here.
Data We Collect
Account information (email, name), tenant configuration, billing details processed by Paddle (we never store full card numbers), usage analytics generated by our self-hosted analytics, and system logs for security audits.
Anonymous Analytics
With your consent, we measure anonymous page views and interaction statistics to improve the site. No personal profiles are built: analytics identifiers are random IDs stored only in your browser, never linked to your identity, and tracking respects Do Not Track / Global Privacy Control automatically. When you leave a page, the browser transport gives no acknowledgement for the final delivery; the tracker keeps such events queued and reports them as undelivered rather than marking them delivered. The send queue holds at most 500 events and retries with backoff; undelivered events are kept only while the page lives. Withdrawing consent drops queued events immediately and purges stored identifiers; granting again afterwards mints a fresh visitor identity, so returning visits after re-consent count as new visitors. You can change or withdraw this choice anytime via "Cookie settings" in the footer.
Newsletter
If you subscribe to our newsletter, we store the email address you provide, the language of the sign-up, and its source so we can send you product insights and DecideBase updates. We use it only for that purpose and never sell it. You can unsubscribe at any time from any message or with the unsubscribe link; after unsubscribing, an address is retained only as long as needed to keep it suppressed and is then removed by our retention sweep.
How We Use Your Data
To provide the service, process payments, prevent abuse, create aggregated analytics, and fulfill legal obligations. We do not sell your data to third parties.
Data Retention
Tenant data is retained for the lifetime of your account. After account termination, data is deleted within 30 days, unless legal retention requirements apply. Analytics data is aggregated and anonymized after 90 days.
Payment Processing (Paddle)
Payments are processed by Paddle, our Merchant of Record. Paddle collects and processes payment data (card numbers, billing address) under their own privacy policy. DecideBase receives only a transaction reference and subscription status — never raw card data.
Sub-processors
Paddle (payment processing), your configured SMTP provider (transactional emails), and your configured SAML identity provider (SSO). All sub-processors are governed by their respective privacy policies.
Security
Data is encrypted at rest with ChaCha20-Poly1305 tenant-aware encryption. TLS secures data in transit. Tenant isolation is enforced through single-writer serialization and per-tenant key scoping.
Your Rights
You can request export, correction, or deletion of your data at any time. EU/UK users have GDPR rights including portability and the right to object.
Contact
Questions about this policy? Email privacy@decidebase.com or use our contact page.