Privacy Policy

Your App is a knowledge infrastructure platform that helps teams find, understand, and use organisational knowledge. This policy explains how we handle personal data when you use the service at baobabcore.com.

Your App is the data controller for this service. We may update this policy over time, and we always show the latest revision date on this page.

When you sign in, we use your identity from our authentication provider to link you to your profile and organisation. This includes your name, email (where provided), and organisation membership details required for access control.

We also collect basic usage events such as page path and referrer so we can understand product usage, diagnose problems, and improve the service. We do not sell personal data or use your data for third-party marketing.

We process data only to deliver and secure Your App: authentication, authorisation, tenant access control, product operations, and support. Our legal bases include performance of contract and legitimate interests in running a secure, reliable service.

Data is stored in secure infrastructure used to operate Your App(such as database and object storage providers). Some subprocessors, including our AI provider, may process data outside your country. Where transfer frameworks apply, we use contractual safeguards.

We retain profile and organisation data while your account and tenant remain active. If access is removed or deletion is requested, we remove or anonymise personal data in line with operational and legal obligations.

Security and audit records may be retained for a limited period where required for lawful compliance, fraud prevention, or dispute resolution.

You have the right to request:

• Access to personal data we hold about you.
• Correction or deletion where applicable.
• Data export in a portable format.
• Restriction or objection to certain processing.

To exercise these rights, use our contact page or email support@example.com. We aim to respond within 30 days.

Signed-in users can export personal data (JSON) from Account settings in Privacy & data.

You can request account deletion from Danger zone in the same area. Your access is deactivated immediately; personal data is scheduled for deletion after a 14-day grace period. Organisation billing and legal records may be retained where required. Requests are subject to identity checks and lawful exceptions.

Your App indexes documents your organisation uploads so we can retrieve relevant excerpts for question answering. When you send a query, we send relevant context and your prompt to an AI provider via API to produce a grounded response.

We do not use your organisation's documents, prompts, or responses to train, fine-tune, or improve foundation or base language models.