Privacy Policy for Baserow
At Baserow, accessible from https://baserow.io, we take your privacy seriously. This Privacy Policy describes what information we process and how we use it.
If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us.
This policy applies to our website and Baserow Cloud, whether you use the web interface, an API, or an integration. It does not cover data processed in independently self-hosted Baserow installations; the organization operating such an installation is responsible for its privacy practices. This policy still applies if you use our website or Baserow Cloud separately.
Information we collect
The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.
If you contact us directly, we may receive additional information about you such as your name, email address, phone number, the contents of the message and/or attachments you may send us, and any other information you may choose to provide.
When you register for an account, we may ask for your contact information, including items such as name, company name, address, email address, and telephone number.
When you use Baserow Cloud, we process the information you and other authorized users store or send through the service. This includes workspace, database and table names, field definitions, records, files, and the data supplied in requests or returned in responses. Records may contain personal information, such as names, email addresses and any other information users choose to store. We also process account and connection identifiers and authentication information to manage access.
How we use your information
We use the information we collect in various ways, including to:
- Provide, operate, and maintain our website and services
- Store data and carry out authorized requests and changes
- Authenticate users and enforce access permissions
- Improve, personalize, and expand our website and services
- Understand and analyze how you use our website and services
- Develop new products, services, features, and functionality
- Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to our website and services, and for marketing and promotional purposes
- Send you emails
- Find and prevent fraud
Access and integrations
You can access Baserow Cloud through its web interface, APIs, and integrations. The web interface uses authenticated access to your account. API requests can use database tokens with configurable data permissions, or account authentication tokens (JWTs) with access based on the user's permissions.
Baserow also supports connections through the Model Context Protocol (MCP), including AI assistants. MCP clients can connect using OAuth authorization or an MCP endpoint key. Depending on the connection and permissions, they can list databases and tables, retrieve table structures and rows, and create, update or delete rows. OAuth users choose which workspaces and tools to authorize; MCP endpoint keys provide access to the enabled tools for their workspace.
API and MCP requests may contain search terms, database and record identifiers, field values and other data needed to carry out an action. Responses may return the requested database information, including personal data stored in records. Other configured integrations, such as webhooks and AI features, may also send selected data to external services.
Sharing your information
Information in Baserow Cloud can be accessed by other users according to your workspace permissions. When you authorize an external application or configure an integration, relevant data may be sent to that application or destination. This includes information retrieved through API or MCP requests, data sent by webhooks, and prompts or selected content sent to AI providers when AI features are used.
We also use providers for hosting, payments, security, communications, analytics and other services needed to operate Baserow Cloud and our website. Where enabled, advertising measurement services may receive website activity or conversion information. External services may process information under their own privacy policies. Revoking access does not remove information they have already received.
Data retention
We retain account information while your account is active and as needed for legal or operational obligations. Database content normally remains in Baserow Cloud until an authorized user deletes it. Deleted items can generally be recovered from trash for three days. Row change history is retained for 180 days, although the history users can access or recover depends on their plan and permissions. Where audit logging is available, audit records are retained for 180 days.
OAuth MCP access tokens expire after one hour and refresh tokens after 30 days; expiration does not necessarily mean immediate deletion of the associated records. Account deletion normally has a 30-day grace period. Where Baserow Cloud AI features store prompts and outputs for history, that history is retained for six months. Operational logs and backups are retained according to the applicable security and backup schedules.
Your controls
You can manage and delete data according to your workspace permissions, change or revoke database tokens, delete MCP endpoint keys, and revoke OAuth MCP connections under My settings > MCP Server. You can also manage configured integrations and request account deletion. Revoking an integration stops its future authorized access, but does not delete your Baserow data or copies already sent to another service.
Log Files
We process technical information such as IP addresses, browser types, request times, pages visited and error details when you use our website or Baserow Cloud, including its APIs and integrations. These logs help us maintain the service, investigate problems and prevent abuse. Some technical information may be associated with a user account.
Cookies and Web Beacons
Like any other website, Baserow uses 'cookies'. These cookies are used to store information including visitors' preferences, and the pages on the website that the visitor accessed or visited. The information is used to optimize the users' experience by customizing our web page content based on visitors' browser type and/or other information.
You can disable cookies through your browser settings. For more information, consult your browser's help documentation.
CCPA Privacy Rights (Do Not Sell My Personal Information)
Under the CCPA, among other rights, California consumers have the right to:
Request that a business that collects a consumer's personal data disclose the categories and specific pieces of personal data that a business has collected about consumers.
Request that a business delete any personal data about the consumer that a business has collected.
Request that a business that sells a consumer's personal data, not sell the consumer's personal data.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.
GDPR Data Protection Rights
We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:
The right to access – You have the right to request copies of your personal data. We may charge you a small fee for this service.
The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you believe is incomplete.
The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.
The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.
Children's Information
Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.
Baserow does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.