Basicrum Public Beta Privacy Notice

Who operates Basicrum

Tsvetan Stoychev operates Basicrum and is responsible for beta invitations and hosted accounts. Contact us about your information at tsto@basicrum.com.

More contact details are in our Legal Notice.

Requesting a beta invitation and using an account

The beta form asks for an organization name and work email address. A self-hosted security check verifies the submission; its one-time challenge identifier and expiry are held temporarily in Netlify Blobs. The website forwards the name and email to the hosted application, which creates an organization and invitation. AhaSend is used to send the invitation email.

The signup server also records the submitted email and limited request details in operational logs. These can include connection or visitor IP addresses where available, request identifiers, browser-supplied headers and the signup outcome. We use these records to investigate delivery problems and abuse.

Accepting the invitation requires a first and last name, email address and password. The application stores a password hash, not the password itself, along with organization, user and connected-site settings. Authentication uses cookies and tokens. We use this information to provide access, administer the beta and protect accounts.

We may send account and beta service messages, including invitations and notices about changes or the end of access. Providing an email address is needed to create and use an account; providing an organization name is needed to set up its workspace.

Measurements from connected websites

When an organization enables the Basicrum beacon on its website, the collector receives performance measurements from visitors' browsers. The data can include page URLs and their query strings and fragments, resource names and timings, page and session identifiers, browser and device details, user agent, and performance metrics. The collector uses a visitor's IP address to estimate country and city. Network and service logs may also process the IP address.

The organization using Basicrum chooses which websites to connect and when to load the beacon. It is responsible for its own visitor information and consent choices. Basicrum uses the received measurements to provide that organization's dashboards. URLs and resource names can contain personal data; website operators should avoid sending sensitive values in those fields.

Optional AI features

If your organization supplies an AI provider key and uses an AI feature, the application sends the prompt and relevant monitoring context to the provider selected by the organization. The available integrations include OpenAI, Anthropic, Google Gemini and Mistral. The organization should review that provider's terms and privacy information before enabling it.

Service providers and locations

We use Cloudflare and Netlify to deliver and protect the beta signup page; Netlify Blobs for one-time signup challenges; Hetzner for the hosted application and databases; AhaSend for invitations; and Google Workspace for replies to beta inquiries. An AI provider receives data only when an organization configures and uses its integration.

Our hosted application and monitoring databases are hosted in the EU, on servers in Germany and Finland. Other providers involved in signup, email and network delivery may process related information outside the EU. Contact us for information about the providers and transfer arrangements relevant to your data.

Keeping and deleting data

• One-time signup challenge identifiers expire and are removed by a scheduled cleanup process.
• Unless an organization expressly chooses to continue under separate terms, we delete its beta account and associated monitoring data within 14 days after its participation ends, whether it leaves early or beta access ends.
• Technical and security logs are held according to the operational and provider settings that apply to them. Information that must be retained by law is handled separately.

Disabling a monitoring integration on your website stops it sending new measurements. To end participation or request deletion, email tsto@basicrum.com.

Your rights

Subject to the GDPR's conditions, you may request access, correction, deletion, restriction or portability of your personal data; object to processing based on legitimate interests; and lodge a complaint with a data-protection supervisory authority. Contact tsto@basicrum.com to make a request. For measurements from another organization's website, you may also contact that website's operator.

The supervisory authority for private-sector organizations in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht. You may also contact the authority where you live or work.

Changes to this notice

We update this notice when our services or data handling change. The current version is available on this page.