Privacy policy

BaseBlock is a business platform: you design your own tables and run your CRM, inventory, billing, payroll, and public website on top of them. This policy covers the BaseBlock web app, the BaseBlock mobile app, and websites published through BaseBlock, and explains what data we handle and why.

BaseBlock is operated by Colour Nepal Pvt. Ltd., a company registered in Nepal (registration number 361973/81/82), at Sinamangal-9, Kathmandu, Nepal. That company is responsible for the data described in this policy, and it is who you are contracting with when you use BaseBlock. Write to support@baseblock.io with any question about it, including a request to see or delete what we hold.

Your account: an email address and a password. Passwords are handled by our authentication provider (Supabase Auth) and stored only as salted hashes — BaseBlock never sees or stores a plaintext password.

Your business data: the tables, rows, files, chat messages, and settings your workspace creates. This data belongs to your business. It is isolated per workspace by database-enforced row-level security, and BaseBlock does not sell it, mine it for advertising, or share it with other workspaces — ever.

Provider credentials your business chooses to connect: if you connect your own payment gateway (eSewa, Khalti, Fonepay), courier (NCM, Pathao), or email/SMS provider, those credentials are stored for your workspace only and used server-side only, to act on your behalf. BaseBlock holds no shared merchant account and never processes card data itself.

Sign-in session tokens (kept in cookies on the web and secure storage in the mobile app) keep you logged in. Operational records — an append-only audit log of significant actions in your workspace, and delivery logs for automations you configure — exist so your business can see who did what.

The BaseBlock marketing site and app do not run third-party advertising or cross-site tracking. If your business adds its own Google Analytics id to a website you publish through BaseBlock, analytics for that site are collected by Google under your own Google account and Google’s terms.

BaseBlock runs on established infrastructure providers acting as processors: Supabase (database, authentication, file storage — encrypted in transit and at rest) and Vercel (application hosting). Payment, courier, and messaging providers your business connects process the data you send them under their own terms, using your own accounts.

Your data is never locked in: any table can be exported to CSV at any time. Deleting a workspace permanently removes all of its rows across every table through database cascades. To delete your account entirely, use the account-deletion option in the app or contact us through the support contact shown on the app-store listing you installed BaseBlock from — deletion removes your login and the memberships tied to it.

If your business publishes a website or storefront through BaseBlock, visitors’ form submissions, wholesale-access requests, and orders on that site are collected for that business and land in its workspace tables. The business you’re buying from or contacting is responsible for how it uses that information; this policy governs BaseBlock’s handling of the underlying platform data.

BaseBlock is a business tool and is not directed at children under 13, and we do not knowingly collect their data.

If this policy changes materially, the change will be visible on this page with an updated effective date. Continued use of BaseBlock after a change means the updated policy applies.