Your data, briefly.

01Who we are

basenode.ventures (“basenode”, “we”) runs this website and is the controller of the personal data you send through its forms. For anything about your data, write to hi@basenode.ventures.

02What we collect

Only what you type into a form, plus the minimum needed to run it safely:

• Waitlist: your email, what you want to do (build, back or both), the site language, the campaign tags of your visit (utm_source, utm_medium, utm_campaign) and the page you sent the form from.
• Builders (/join/build): name, email, country, city (optional), the kind of builder you are, the fields you care about, what you want to build, its stage, links (GitHub, LinkedIn, ORCID / Lattes, website — optional), hours per week (optional) and what you are looking for (optional).
• Backers (/join/back): name, email, country, whether you are an individual, company, foundation or fund, organization (optional), the fields you care about, how you would like to support, a range (optional) and how you heard about us (optional).
• With every form: a record of your consent (the version of the consent text, the date and the language), whether you confirmed your email, and when.
• Security: to limit abuse we keep a salted, one-way hash of your IP address — never the address itself — for 24 hours. Cloudflare Turnstile checks that a form is sent by a person; it processes your IP address and browser signals for that purpose only.

We do not use advertising or analytics cookies. The waitlist form keeps the campaign tags of your visit in your browser’s session storage until you close the tab.

03Why, and on what basis

We use your details to confirm your email, to contact you about the platform — your application as a builder, your interest as a backer, news when the first initiatives go public — and to understand who wants to build or back what.

The legal basis is your consent (LGPD art. 7, I · GDPR art. 6(1)(a)), given with the checkbox on each form. You can withdraw it at any time, as easily as you gave it; that does not affect what was done before. The anti-abuse checks above rely on our legitimate interest in keeping the forms safe (LGPD art. 7, IX · GDPR art. 6(1)(f)).

We never sell your data, and we do not use it to make automated decisions about you.

04How long we keep it

• Confirmation links expire after 7 days and work once.
• If you never confirm your email, we delete the submission within 12 months.
• Confirmed details are kept while basenode is being built and you want to hear from us. Ask us to delete them and we will.
• IP hashes used against abuse: 24 hours.

05Who processes it for us

A few providers run parts of the service on our behalf, under contracts that bind them to our instructions:

• Vercel — hosting of the website and of the API that receives the forms (including request logs).
• Supabase — the database where submissions are stored.
• Resend — delivery of the confirmation email.
• Cloudflare — Turnstile, the anti-bot check on forms.

Some of them may process data outside Brazil or the European Economic Area. Where that happens, transfers rely on the safeguards these providers offer, such as standard contractual clauses.

06Your rights

Under the LGPD and the GDPR you can ask us to confirm whether we hold your data, to access it, to correct it, to delete it, to receive a copy in a portable format, to know who we shared it with, to restrict or object to its use, and to withdraw your consent.

To exercise any of them, write to hi@basenode.ventures from the address you used, or tell us how to verify it is you. We answer within 15 days. You can also complain to the ANPD (Brazil) or to the data protection authority where you live.

07Under 18?

Please ask a parent or guardian before sending a form. If you think a child sent us data, write to hi@basenode.ventures and we will delete it.

08Changes

When this notice changes we update the date at the top. If a change affects what you consented to, we will ask again before relying on it.