Privacy Policy

1. Who we are

Baseform is a South African university application co-pilot designed to help Grade 12 students discover universities and bursaries, track applications, and never miss a deadline. We are operated by Lumen AI (Pty) Ltd, registered in South Africa.

2. Information we collect

• Your name, email address, and password when you create an account
• Academic information: school name, grade, subjects, and marks
• Guardian/parent contact details you provide during signup
• Application and bursary tracking data you enter in the app
• Documents you upload to the Vault (stored securely)
• Email account access if you choose to connect Gmail for application scanning
• Usage data: pages visited, features used, error logs

3. How we use your information

• To provide and personalise the Baseform service
• To match you with universities and bursaries based on your APS and profile
• To send deadline reminders and application status updates
• To notify your guardian about your applications (with your consent)
• To improve the platform and fix bugs using aggregated, anonymised data
• To respond to support requests

4. Data storage and security

Your data is stored on Supabase infrastructure hosted in secure data centres. We use row-level security so your data is only accessible to you and authorised Baseform staff. Passwords are hashed and never stored in plain text. Documents in the Vault are stored in private, access-controlled buckets.

5. Sharing your data

We do not sell your personal information. We share data only with:

• Supabase (database and auth infrastructure)
• Google (if you connect your Gmail for email scanning)
• Resend (for sending transactional emails)
• Sentry (for error monitoring — no personally identifiable data is sent)

6. Google API Limited Use Disclosure

Baseform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only request read access to scan for university and bursary-related emails, and this data is never used to serve ads or sold to third parties.

7. Your rights (POPIA)

Under the Protection of Personal Information Act (POPIA), you have the right to access, correct, or delete your personal information. To exercise these rights, email us at [email protected].

8. Data retention

We retain your data for as long as your account is active. If you delete your account, your personal data is removed within 30 days. Anonymised, aggregated usage data may be retained indefinitely.

9. Contact

Questions about this policy? Contact us at [email protected].