1. Introduction
This Privacy Policy describes how Baseten Labs, Inc., 560 Davis St., Suite 250, San Francisco, CA 94111 ("Baseten," "we," "us," or "our") collects, uses, and discloses your information when you use our website at https://www.baseten.co (the "Website") or Baseten's services and applications (the "Platform"), and through other interactions you have with us, such as our marketing activities, our sales, event, and support interactions ("Engagement" and collectively with the Platform and the Website, the "Services"), and explains your privacy rights and how the law protects you. Please don't hesitate to reach out to us if you have any questions.
We use your personal data as described in this Privacy Policy. If you do not agree with this Privacy Policy, do not use the Services.
2. How This Privacy Policy Applies to You and Our Customers
This Privacy Policy applies to personal data that we collect through our Services and does not apply to:
The models, model weights, inference requests and outputs, datasets, code, and other content that our customers and their authorized users use, submit to or request through the Baseten platform ("Customer Content"). Our processing of Customer Content is governed by our agreement with that customer, including our data processing addendum https://www.baseten.co/dpa ("Customer Agreement").
The models, model weights, applications, software, and other products that are developed, owned, or controlled by a third party and are hosted on or interoperate with the Services ("Third-Party Products"). Third-Party Products provide services to Customers under their own separate terms.
If you use the Service through your employer or another organization, that organization controls its instance of the Service and the associated Customer Content. Please direct requests to access or delete Customer Content, and other questions about Customer Content, to that organization.
3. Baseten's and Our Customers' Role Under Privacy Laws
Under data protection laws, there are two types of entities that play a role in processing data:
A "controller" (or a "business") is primarily responsible for controlling personal data and ultimately decides how and why personal data is processed.
A "processor" (or a "service provider") processes personal data on behalf of a controller and only processes personal data pursuant to the instructions of the controller.
Baseten is a processor of Customer Content and data from any Third-Party Products, which we process on behalf of and at the direction of the customer that controls the relevant account in accordance with the Customer Agreement.
Baseten is the controller of the information described in this Privacy Policy, such as Contact Information, Financial Information, and Inquiry and Support Data.
4. Information We Collect and Receive
Baseten collects the following information through your use of the Services and through other interactions with Baseten:
Customer Content and Third-Party Products. Customers and their authorized users process Customer Content and data from Third-Party Products when using the Services. Baseten processes Customer Content and data from Third-Party Products as a processor pursuant to a Customer Agreement.
Other Information. Baseten also processes other personal data through your use of the Services ("Other Information"):
Account Information:
Contact Information: We may collect your name, email address, phone number, title, role, and company name.
Authentication Information: If you create an account, or a customer creates an account on your behalf, on our Services, we will collect your authentication information such as username and credentials.
Financial Information: When you purchase or subscribe to our services, we may collect personal data related to that transaction such as payment card number, bank account number, transaction amount and dates, and purchase history.
Usage and Technical Information:
Technical metadata. When you interact with the features and functionality of the Platform and Website, we will collect and process information about your use or interaction with the Platform and Website. For example, we will collect information about your most frequently visited pages, duration of a page visit, or most used functionalities. We may also collect technical and operational logs and telemetry relating to the use and performance of the Platform and Website. This may include information relating to error rates, timestamps, Internet Protocol (IP) address, browser information and configuration, and language preferences.
Device information. We collect information about the devices accessing the Platform and Website, including unique identifiers, device information, operating system information, and other information about your device. We also receive information from you that helps us approximate your location. We also use cookies and similar tracking technologies, such as beacons, tags, and scripts, to track activity on our Service, store certain information, and improve and analyze our Service.
Inquiry and Support Data: When you contact us to inquire about our services or to seek support during your use of the Services, we may collect and process personal data related to such inquiry, including Contact Information, unique identifiers or IP addresses, and any other personal data that you include in your correspondence.
Third-Party Sources: We may receive information about you from third parties such as partners, resellers, event sponsors, publicly available sources, or others. We use this information to support the Services including to identify new customers and keep our records up to date.
5. How We Use Other Information and Our Legal Bases
Baseten acts as a processor for Customer Content and data from Third-Party Products in accordance with the Customer Agreement.
Baseten processes Other Information as a controller to operate the Services, including the Platform and the Website, and we rely on varying legal bases to process the personal data as described in this Policy.
Performance of a Contract
We will process personal data in performance of a contract with you. We rely on performance of a contract for the following purposes:
Legitimate Interest
We will rely on our legitimate interests or the legitimate interests of a third party to process personal data where such interests are not outweighed by your interests or fundamental rights or freedoms:
Consent
We may process Other Information with your consent. We rely on consent for the following purposes:
Legal Obligation
We will process information when we comply with a legal obligation such as processing to ensure compliance with sanctions and export control laws or responding to a valid legal request from law enforcement or other government agencies.
6. How We Share and Disclose Information
6.1 Categories of Recipients
We may share your information in the following situations:
With Service Providers and Processors. We will share information with Service Providers and Processors that are unaffiliated with us to support the data processing purposes set forth in this Privacy Policy, including to monitor and analyze the use of our Services, for payment processing, and to contact you.
For business transfers. We may share information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
With affiliates. We may share information with our corporate affiliates, parents, or subsidiaries. Affiliates include joint venture partners, or other companies that we control or that are under common control with us.
With event sponsors and partners. If you attend an event or webinar that is hosted or sponsored by Baseten, we may share your Contact Information with various sponsors when you register or attend.
With business partners. We may share your information with third party business partners, such as resellers or referral partners, who are involved in providing content or helping us keep our records up to date.
Aggregated or De-Identified Data. We may disclose or use aggregated or de-identified Other Information for any purpose.
With professional advisers. We may share information with professional advisers acting as either controllers or processors, including lawyers, bankers, auditors, and insurers who provide us with banking, legal, insurance, and accounting services.
With law enforcement or regulators. We may disclose information about you to government authorities, law enforcement, or regulators if we reasonably believe disclosure is required by applicable law or may be required to protect the security or integrity of Baseten or its Services.
With your consent, for any other purpose disclosed to you.
7. Data Retention
Baseten will retain Customer Content in accordance with a customer's instructions and as required by applicable law. Baseten retains Other Information for as long as necessary for the purposes described in this Privacy Policy. In determining the appropriate retention period for each category of Other Information, we evaluate criteria including the following:
Notwithstanding the criteria above, we may retain information for longer periods where necessary to comply with our legal obligations, resolve disputes, or enforce our agreements, and we may retain aggregated or de-identified information for any period.
8. Security of Your Personal Data
The security of your information is important to Baseten. Baseten implements safeguards designed to protect your information from loss, misuse, and unauthorized access or disclosure. To learn more about our current practices and policies regarding security, please visit our Trust Center and review the Baseten Security Practices available at https://www.baseten.co/security-practices.
9. International Data Transfers
In connection with providing the Services, including providing the compute across varying infrastructure regions around the world, information may be transferred to, and processed in, jurisdictions located outside of your state, province, country, or other governmental jurisdiction, where the data protection laws may differ from those of your jurisdiction.
For Customer Content and Third-Party Products, we transfer personal data in accordance with the terms and protections of the Customer Agreement.
For Other Information, Baseten will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. When we transfer Other Information originating in the European Economic Area, the United Kingdom, or Switzerland to countries that have not received an adequacy decision, we rely on appropriate safeguards recognized under applicable law, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
10. Your Rights and Choices
10.1 Marketing Communications
We may use your Personal Data to contact you with newsletters, marketing or promotional materials, and other information that may be of interest to you. You may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or instructions provided in any email we send or by contacting us.
10.2 Rights
Depending on where you reside, you may have some or all of the following rights with respect to Other Information for which Baseten is the controller. These rights are subject to conditions and exceptions under applicable law.
Right of access. You may request confirmation that we process your information and a copy of the Other Information we hold about you.
Right to rectification. You may ask us to correct your information.
Right to erasure. You may ask us to delete your information.
Right to restriction of processing. You may ask us to restrict the processing of your information.
Right to data portability. You may request to receive the information you provided to us in a structured, commonly used, and machine readable format.
Right to object. You may object to the processing of your information.
Right to withdraw consent. Where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Rights related to automated decision making. You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.
You may exercise these rights by contacting us at privacy@baseten.co. We may need to verify your identity before acting on your request, and we will respond within the time periods required by applicable law. We will not discriminate or retaliate against you for exercising any of these rights.
If your request concerns Customer Content, Baseten acts as a processor and will refer your request to the relevant customer, and will support that customer's response as required by the applicable Customer Agreement. In such cases, please direct your request to the organization that controls the account through which you use the Services.
11. Contacting Your Data Protection Authority
If you have concerns about our processing of your personal data, we encourage you to contact privacy@baseten.co so that we can try to resolve the matter. However, you also have the right to lodge a complaint with a data protection supervisory authority at any time. If you are located in the European Economic Area, United Kingdom, or Switzerland, you may lodge a complaint with the supervisory authority in the EEA member state of your habitual residence, your place of work, or the place of the alleged infringement, with the UK Information Commissioner's Office, or with the Swiss Federal Data Protection and Information Commissioner, as applicable.
12. California Privacy Rights
This section supplements the information contained elsewhere in this Privacy Policy and applies solely to visitors, users, and others who reside in the State of California. For purposes of this section, Business, Consumer, and Sale have the meanings given in the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").
12.1 Categories of Personal Information Collected
We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or Device. The following is a list of categories of personal information that we may collect, or may have collected from California residents, within the last twelve months. The categories and examples are those defined in the CCPA and reflect our good faith belief rather than a representation that every example was in fact collected.
Identifiers/contact information such as name or email address.
California Customer Records information such as name, address, or financial information.
Commercial information such as purchase history.
Internet or similar network activity such as interaction data.
Under the CCPA, personal information does not include publicly available information from government records, deidentified or aggregated consumer information, or information excluded from the CCPA's scope, such as health or medical information covered by HIPAA and the California Confidentiality of Medical Information Act, or personal information covered by certain sector specific privacy laws, including the Fair Credit Reporting Act, the Gramm Leach Bliley Act, the California Financial Information Privacy Act, and the Driver's Privacy Protection Act of 1994.
12.2 Sources of Personal Information
We obtain the categories of personal information listed above from the following categories of sources:
Directly from you, for example from forms you complete on our Service, preferences you express or provide through our Service, or your purchases on our Service.
Indirectly from you, for example from observing your activity on our Service.
Automatically from you, for example through cookies we or our Service Providers set on your Device as you navigate through our Service.
From Service Providers, for example third party partners and vendors that monitor and analyze the use of our Service, process payments, keep records current, or otherwise help us provide the Service to you.
12.3 Use of Personal Information for Business or Commercial Purposes
We may use or disclose personal information we collect for business purposes or commercial purposes as defined under the CCPA, for the purposes described in the How We Use Other Information and Our Legal Bases section above.
12.4 Disclosure, Sale, and Sharing of Personal Information
We may use or disclose, and may have used or disclosed in the last twelve months, the following categories of personal information for business or commercial purposes: identifiers, California Customer Records information, commercial information, and Internet or other similar network activity. When we disclose personal information for a business purpose or a commercial purpose, we enter a contract that describes the purpose and requires the recipient to keep that personal information confidential and not use it for any purpose except performing the contract.
As defined in the CCPA, "sell" and "sale" mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for valuable consideration. This means that We may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.
Please note that the categories listed below are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact sold, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been shared for value in return. We may sell and may have sold in the last twelve (12) months the following categories of personal information: identifiers, California Customer Records information, commercial information, and Internet or other similar network activity.
12.5 Your Rights Under the CCPA
If you are a California resident, you have the following rights:
The right to notice. You have the right to be notified which categories of personal information are being collected and the purposes for which the personal information is being used.
The right to request. You have the right to request that we disclose to you the categories of personal information we collected about you, the categories of sources for that information, our business or commercial purpose for collecting or selling it, the categories of third parties with whom we share it, the specific pieces of personal information we collected about you, and, if we sold or disclosed your personal information for a business purpose, the categories of personal information sold and disclosed.
The right to opt out of sale or sharing. You have the right to opt-out of the sale of Your personal information. Once We receive and confirm a verifiable consumer request from You, we will stop selling Your personal information. To exercise Your right to opt-out, please contact uss. The Service Providers we partner with (for example, our analytics or advertising partners) may use technology on the Service that sells personal information as defined by the CCPA law. If you wish to opt out of the use of Your personal information for interest-based advertising purposes and these potential sales as defined under CCPA law, you may do so by following the instructions below.
The right to correct. You have the right to request that we correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing.
The right to delete. You have the right to request deletion of your personal information, subject to certain exceptions. Once we receive and confirm your request, we will delete, and direct our Service Providers to delete, your personal information from our records unless an exception applies, for example where retention is necessary to complete a transaction, detect security incidents, debug products, comply with a legal obligation, or make other internal and lawful uses compatible with the context in which you provided the information.
The right not to be discriminated against. You have the right not to be discriminated against for exercising any of your rights, including by denying you goods or services, charging different prices or rates, providing a different level or quality of goods or services, or suggesting that any of those things will occur.
12.6 Exercising Your CCPA Rights
To exercise any of your rights under the CCPA, California residents can contact us by email at privacy@baseten.co. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable request related to your personal information. Your request must provide sufficient information to allow us to reasonably verify that you are the person about whom we collected personal information, or an authorized representative, and must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it.
We will disclose and deliver the required information free of charge within 45 days of receiving your verifiable request. The time period may be extended once by an additional 45 days when reasonably necessary and with prior notice. Any disclosures we provide will cover only the twelve month period preceding receipt of the verifiable request. For data portability requests, we will select a format that is readily usable and should allow you to transmit the information from one entity to another without hindrance.
12.7 California Shine the Light Law
Under California Civil Code Section 1798.83, California residents with an established business relationship with us can request information once a year about the sharing of their Personal Data with third parties for those third parties' direct marketing purposes. To request more information under the California Shine the Light law, California residents can contact us using the contact information provided below.
12.8 California Privacy Rights for Minor Users
California Business and Professions Code Section 22581 allows California residents under the age of 18 who are registered users of online sites, services, or applications to request and obtain removal of content or information they have publicly posted. To request removal of such data, California residents can contact us using the contact information provided below and include the email address associated with the account. Please be aware that such a request does not guarantee complete or comprehensive removal of content or information posted online, and the law may not permit or require removal in certain circumstances.
12.9 Do Not Track Signals
Our Service does not respond to Do Not Track signals. However, some third party websites do keep track of your browsing activities. If you visit such websites, you can set preferences in your web browser to inform websites that you do not want to be tracked, by visiting the preferences or settings page of your web browser.
13. Children's Privacy
Our Services are not directed to anyone under the age of 16. We do not knowingly collect personally identifiable information from anyone under the age of 16. If you are a parent or guardian and you are aware that your child has provided us with their Other Information, please contact us. If we become aware that we have collected Other Information from anyone under the age of 16, we take steps to remove that information from our servers.
14. Links to Other Websites
Our Services may contain links to other websites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third party sites or services.
15. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We will also let you know of any material changes via email and/or a prominent notice on our Services prior to the change becoming effective, and we will update the Last Updated date at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
16. Contact Us
If you have any questions about this Privacy Policy, you can contact us:
By email: privacy@baseten.co
By mail: Baseten Labs, Inc., 560 Davis St., Suite 250, San Francisco, CA 94111
Questions? Contact privacy@baseten.co.