1. Introduction

Basepoint Pte. Ltd. (UEN 202600514Z), a company incorporated in Singapore ("Basepoint",
"we", "us", or "our"), operates Praxic, an AI agent platform available at
https://praxic.io and its subdomains (the "Service").

This Privacy Policy governs your use of the Service and explains how we collect, use,
safeguard and disclose information. By using the Service, you agree to the collection and
use of information in accordance with this policy.

Where you have entered into a separate written agreement with us for the Service, that
agreement governs your use of it and this Privacy Policy forms part of it. If any term of
that agreement conflicts with this Privacy Policy, the agreement prevails.

Our two roles. Praxic is sold to businesses, and it is important to understand which
hat we are wearing:

For Account Data (the information you give us to create and pay for an account, and
the data we collect about how you use the Service) we act as a Data Controller.
For Customer Data (the documents, messages, records and other content that you or
your AI employees process through the Service) we act as a Data Processor, handling
that data on your instructions and on your behalf. If you are an end user whose personal
data was uploaded to Praxic by one of our customers, the customer is the controller of
that data and you should direct your requests to them.

2. Definitions

SERVICE means the Praxic platform operated by Basepoint Pte. Ltd., including
https://praxic.io, the Praxic web application, and our APIs.

PERSONAL DATA means data about a living individual who can be identified from that data,
or from that data and other information in our possession or likely to come into our
possession.

ACCOUNT DATA means the personal data you provide to register, authenticate, and pay for
the Service, plus the operational data we generate about your account.

CUSTOMER DATA means the content you submit to the Service or that your AI employees
retrieve, generate or process on your behalf: knowledge base documents, conversations,
agent memories, workflow inputs and outputs, files, and data pulled from tools you connect.

USAGE DATA is data collected automatically, generated either by your use of the Service
or by the Service infrastructure itself (for example, the duration of a page visit or the
number of tokens consumed by an agent run).

COOKIES are small files stored on your device.

DATA CONTROLLER means the person who determines the purposes for which and the manner in
which personal data is processed.

DATA PROCESSOR means any person who processes data on behalf of a Data Controller. We use
a number of Sub-processors in order to deliver the Service; they are listed in section 13.

AI EMPLOYEE (or "agent") means an autonomous assistant you configure inside Praxic, which
can hold conversations, read from knowledge bases, and call connected tools on your behalf.

THE USER is the individual using the Service.

3. Information Collection and Use

We collect several different types of information for various purposes, all in service of
providing and improving the Service for you.

We collect only what we need to run the Service, bill for it, keep it secure, and support
you when something goes wrong.

4. Types of Data Collected

Personal Data

While using our Service, we may ask you to provide certain personally identifiable
information that can be used to contact or identify you ("Personal Data"). This may
include, but is not limited to:

Email address
Name and job role
Organisation or company name
Billing details and billing address (payment card details go directly to our payment
processor and are never stored by us)
Phone number, where you choose to connect a messaging channel
Cookies and Usage Data

We may use your Personal Data to contact you with product updates, newsletters, marketing or
other information that may be of interest to you. You may opt out of any or all of these
communications by using the unsubscribe link in the message or emailing us at
support@praxic.io.

Customer Data

The Service exists to act on your business data, so by design your AI employees process
content you provide or connect. This includes:

Knowledge base documents you upload or that we crawl from URLs you nominate, together
with the vector embeddings we derive from them so agents can search them.
Conversations between you, your team, your end users and your AI employees, including
messages that arrive through connected channels.
Agent memory: facts an agent records about a user or a task so that it can be useful
across sessions.
Tool and workflow data: records read from or written to the third-party tools you
connect, plus the inputs and outputs of workflow runs.
Files produced or consumed during an agent run.

Customer Data may contain personal data about your employees, customers or other
individuals. You remain responsible for having a lawful basis to submit that data to
Praxic and for informing the individuals concerned.

Usage Data

We also collect information that your browser or client sends whenever you use the Service
("Usage Data"). This may include your IP address, browser type and version, the pages of
the Service you visit, the time and date of your visit, time spent on those pages, unique
device identifiers and other diagnostic data.

For AI employee activity we additionally record operational metadata such as which model
was used, token counts, step counts, run duration, credits consumed, and whether a run
succeeded or failed. We use this to bill accurately, to keep runs inside their limits, and
to debug failures.

Cookies

We do not use analytics cookies, advertising cookies, or third-party tracking of any
kind. Our website and application load no analytics scripts, no advertising pixels, and
no session-recording tools, and we do not build advertising profiles about you.

The only cookies we set are the ones the Service needs in order to work:

Session cookies to authenticate you and keep you signed in.
Preference cookies to remember your settings, such as your theme and active workspace.
Security cookies to protect against cross-site request forgery and detect abuse.

Because all of these are strictly necessary to deliver a service you have asked for, we do
not show a cookie consent banner. You can instruct your browser to refuse cookies, but if
you do, you will not be able to sign in.

5. Use of Data

Basepoint uses the collected data for the following purposes:

to provide, operate and maintain the Service;
to run the AI employees, workflows, knowledge searches and integrations you configure;
to authenticate you and secure your account;
to notify you about changes to the Service;
to provide customer support;
to meter usage, calculate credits, and process billing and collection;
to send you account and subscription notices, including low-balance, renewal and
expiration notices;
to monitor usage of the Service and gather aggregate analysis so that we can improve it;
to detect, prevent and address technical issues, errors and outages;
to detect, prevent and address fraud, abuse and security incidents;
to comply with our legal obligations and enforce our agreements;
to send you news, offers and information about our products, unless you have opted out;
for any other purpose we describe at the point you provide the information, or with your
consent.

We do not sell your personal data, and we do not share it with third parties for their own
advertising purposes.

6. Retention of Data

We retain Personal Data only for as long as necessary for the purposes set out in this
Privacy Policy, and to comply with our legal obligations, resolve disputes, and enforce our
agreements.

Customer Data is retained for as long as your account is active. You can delete
individual documents, conversations, agent memories and knowledge bases at any time from
within the product. Deletions take effect on our live systems immediately. Because we keep
encrypted database backups so that we can restore your data after an incident, deleted
content can persist in those backups until they expire on their ordinary rotation, which is
at most three months; we do not restore deleted content from a backup except as part of
recovering an entire database.

When an account is closed, we delete or anonymise the associated Customer Data within 90
days, unless we are legally required to retain it.

Usage Data is retained for internal analysis, billing accuracy and security. Billing
records are retained for the period required by Singapore tax and accounting law.

7. Transfer of Data

Basepoint Pte. Ltd. is incorporated in Singapore. Your information, including Personal
Data and Customer Data, may be transferred to and maintained on computers located outside
Singapore and outside your own state, province or country, where data protection laws may
differ from those of your jurisdiction.

In particular, our hosting infrastructure and several of our Sub-processors operate in the
United States and the European Union. If you are located outside those regions and choose
to use the Service, please note that we transfer data there and process it there.

Where we transfer personal data out of the European Economic Area or the United Kingdom, we
rely on the European Commission's Standard Contractual Clauses (and the UK International
Data Transfer Addendum where applicable) with the receiving party.

We take all steps reasonably necessary to ensure that your data is treated securely and in
accordance with this Privacy Policy, and no transfer takes place to an organisation or a
country unless adequate controls are in place.

8. Disclosure of Data

We may disclose personal information that we collect, or that you provide, in the following
circumstances:

(a) Disclosure for law enforcement. We may be required to disclose your Personal Data if
compelled to do so by law or in response to a valid request by a public authority. Where we
are legally permitted to do so, we will notify you before disclosing Customer Data in
response to such a request.

(b) Business transaction. If Basepoint is involved in a merger, acquisition or asset
sale, your data may be transferred. We will notify you before your Personal Data becomes
subject to a different privacy policy.

(c) Other cases. We may also disclose your information:

to our Sub-processors and service providers, as listed in section 13, strictly to deliver
the Service;
to professional advisers such as auditors and lawyers, under a duty of confidentiality;
to fulfil the purpose for which you provided it;
with your consent, in any other case.

We will only use your company name or logo as a customer reference with your prior written
permission.

9. Security of Data

The security of your data matters to us, but no method of transmission over the Internet or
method of electronic storage is 100% secure. While we strive to use commercially acceptable
means to protect your data, we cannot guarantee its absolute security. Our specific
technical controls are described in sections 21 and 22.

10. Your Rights under the Singapore Personal Data Protection Act (PDPA)

If you are in Singapore, the Personal Data Protection Act 2012 gives you the right to:

Access the personal data we hold about you and information about how it has been used
or disclosed in the past year;
Correct personal data that is inaccurate or incomplete;
Withdraw consent to our collection, use or disclosure of your personal data, on
reasonable notice. Withdrawing consent may mean we can no longer provide the Service to
you.

To exercise these rights, or to reach our Data Protection Officer, email support@praxic.io.
We will respond within 30 days, or tell you when to expect a response. You may also lodge a
complaint with the Personal Data Protection Commission of Singapore.

If you are a resident of the European Union, the European Economic Area, or the United
Kingdom, you have certain data protection rights under the GDPR and the UK GDPR. See
the full regulation for detail.

In certain circumstances you have:

the right of access: to be told what personal data we hold about you and to obtain a copy;
the right of rectification: to have inaccurate or incomplete information corrected;
the right to erasure: to have your personal data deleted;
the right to object to our processing of your personal data;
the right of restriction: to ask us to restrict the processing of your personal data;
the right to data portability: to receive your personal data in a structured,
machine-readable and commonly used format;
the right to withdraw consent at any time, where we rely on your consent.

Our lawful bases. We process Account Data to perform our contract with you, to comply
with legal obligations such as tax record-keeping, and for our legitimate interests in
securing and improving the Service. We process marketing data on the basis of consent or
soft opt-in. We process Customer Data on the documented instructions of our customer, as a
processor.

To exercise any of these rights, email support@praxic.io. We may ask you to verify your
identity before responding. Please note that we may not be able to provide the Service
without some necessary data.

You also have the right to complain to a supervisory authority. In the UK this is the
Information Commissioner's Office; in the EU it is your local data protection authority.

If you are a business customer subject to the GDPR and require a Data Processing Addendum,
contact support@praxic.io and we will put one in place.

12. Your Rights under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you are entitled to learn what data we collect about you,
to ask us to delete it, and to opt out of its sale or sharing. You can ask us:

(a) What personal information we have about you. If you make this request, we will tell
you:

the categories of personal information we have collected about you;
the categories of sources from which we collected it;
the business or commercial purpose for collecting it;
the categories of third parties with whom we share it;
the specific pieces of personal information we have collected about you.

You may make this request up to twice in a rolling twelve-month period.

(b) To delete your personal information. We will delete the personal information we hold
about you as of the date of your request and instruct our service providers to do the same.
In some cases deletion may be achieved through de-identification. Deleting your personal
information may mean you can no longer use parts of the Service.

(c) To correct inaccurate personal information that we hold about you.

(d) To opt out of the sale or sharing of your personal information. We do not sell or
share your personal information, and we have not done so in the preceding twelve months.
We also do not knowingly sell or share the personal information of anyone under 16.

We will not discriminate against you for exercising any of these rights. To exercise them,
email support@praxic.io.

Do Not Track. We do not load analytics or advertising trackers at all, for any visitor,
whether or not a Do Not Track signal is present. There is nothing for a Do Not Track signal
to switch off.

13. Sub-processors

We use the following third parties to deliver the Service. Each is bound by a written
agreement requiring them to protect your data and to process it only on our instructions.

AI model providers. These process prompts, conversation content and knowledge base
excerpts in order to generate agent responses. Which one receives a given request depends on
the model you select for that AI employee:

Anthropic (Claude models)
Google (Gemini models, and the optical character recognition we run on uploaded documents)
xAI (Grok models)
OpenAI (used for the vector embeddings that make knowledge bases searchable)
OpenRouter, which routes requests to the model host that serves your chosen model. The
models we offer through it are served by DeepSeek, Moonshot AI and Z.ai. See section 14
for how we constrain that routing.

Infrastructure and platform:

Railway, for application hosting and our PostgreSQL database, which also stores uploaded
files
Vercel, for hosting our website and web application
E2B, for isolated code execution sandboxes

Tools, channels and operations:

Composio, which brokers the OAuth connections between Praxic and the third-party tools you
connect
Resend, for transactional and notification email, and for the email address your AI
employees send and receive from
Telegram, Slack and Twilio (for WhatsApp), each only where you connect that channel
Stripe, for payment processing
Sentry, for error monitoring
Firecrawl and Exa, for the web search and page-retrieval tools available to agents
Sanity, for the content on our blog

Google also acts as an identity provider if you choose to sign in with a Google account.

We will give notice through this page before adding a new Sub-processor that processes
Customer Data. Business customers can request advance notification by emailing
support@praxic.io.

14. AI Models and Training

This is the section most of our customers care about, so we will be direct.

We do not use your Customer Data to train AI models. Your documents, conversations,
agent configurations, memories and workflow data are never used to train, fine-tune or
improve any generalised model, ours or anyone else's.
Our model providers do not train on your data either. We access Anthropic, Google,
xAI and OpenAI models through their commercial APIs, under terms that prohibit the use of
API inputs and outputs for model training. Our Google account is on paid billing, which is
the tier under which Google is contractually barred from using submitted content to
improve its products.
Routing through OpenRouter is constrained to hosts that do not store prompts. Every
request we send to OpenRouter carries a routing instruction that excludes any model host
which retains prompt data. Hosts that reserve the right to train on prompts are therefore
never used, regardless of which model you pick. This is enforced in our code, not by an
account setting.
Bring your own key. If you supply your own model provider API key, requests are sent
directly under your own account and your agreement with that provider governs them. The
OpenRouter routing constraint above still applies to your key.

Prompts and completions are retained by the model providers for a limited period for their
own abuse monitoring, typically around 30 days, and are not used for training during that
window. If you need a zero data retention arrangement, contact support@praxic.io and we will
tell you what we can put in place for your account.

Prompts and completions are retained in our own systems so that you can see your
conversation history, audit what an agent did, and so that we can debug failures. You can
delete conversations at any time.

15. Third-Party Integrations and Connected Accounts

When you connect a third-party tool such as Gmail, Slack, HubSpot or Notion, you authorise
Praxic to access that account on your behalf, within the scopes you grant.

Credentials are never exposed to AI models or to sandboxes. Access tokens and API keys
are stored encrypted and used only on our servers, at the moment a tool call is executed.
An AI employee can invoke a tool; it can never read the credential behind it.
Connections are scoped. A connection can be personal to you or shared with your team,
and each AI employee only has access to the tools you explicitly enable for it.
You choose what runs unattended. Individual tools can be set to run automatically, to
require your approval before each use, or to be switched off entirely.
You can revoke at any time, from Praxic and from the third-party provider. Revoking a
connection immediately stops all further access.

Data retrieved from a connected tool is treated as Customer Data under this policy. We do
not use data obtained through Google Workspace APIs to develop, improve or train generalised
AI or ML models, and we do not transfer such data to third-party AI tools for that purpose.

16. Code Execution and Sandboxes

Some AI employees can run code to complete a task. That code executes inside an isolated,
ephemeral sandbox provided by E2B, dedicated to a single user's session and destroyed when
the session ends.

Only the data required for the task is placed in the sandbox. Your stored credentials and
access tokens are never made available inside it: tool calls that need a credential are
executed on our servers, outside the sandbox.

17. Messaging Channels

You can make an AI employee reachable over Telegram, WhatsApp, Slack or email. Agents that
use email send and receive at an address on our praxicagent.com domain, so that agent mail is
clearly distinguishable from mail sent by a person. Where you connect any channel:

Messages sent to and from that channel are processed as Customer Data and stored so the
agent has conversation history.
We receive the identifiers the channel provides, such as a phone number, username or
chat ID, in order to route replies to the right conversation.
Channels are protected by a fail-closed allowlist: unless a sender is explicitly permitted,
the agent will not respond and the message is not passed to a model.
The channel operator (for example Meta for WhatsApp, or Telegram) also processes those
messages under their own privacy policy, which we do not control.

18. Analytics and Monitoring

We do not use a third-party analytics provider. Our website and application run no
Google Analytics, no product analytics suite, and no session recording. What we know about
how the Service is used comes from our own server-side records, described as Usage Data in
section 4.

We use Sentry to capture application errors. Error reports may incidentally include limited
personal data, such as a user identifier or a request path, which we use solely to diagnose
and fix the problem.

We host our own tracing stack for AI employee runs on our own infrastructure, rather than
sending prompt and completion content to a third-party observability vendor.

19. Payments

We provide paid products and services within the Service, and we use a third-party payment
processor to handle them.

We do not store or collect your payment card details. That information is provided
directly to Stripe, whose use of your personal information is governed by their own privacy
policy, available at https://stripe.com/privacy. Stripe adheres
to PCI-DSS as managed by the PCI Security Standards Council. We receive only the last four
digits of your card, its brand and expiry, and the billing details needed to issue invoices.

20. Links to Other Sites

Our Service may contain links to sites that are not operated by us, and your AI employees may
retrieve content from third-party websites when you ask them to. If you follow a third-party
link you will be directed to that party's site, and we strongly advise you to review the
privacy policy of every site you visit.

We have no control over, and assume no responsibility for, the content, privacy policies or
practices of any third-party site or service.

21. Access Control

Within Praxic, access is restricted by default and controlled by your own administrators:

Access to organisations, workspaces and spaces is granted per member. An AI employee, a
knowledge base or a connection lives in a space and is visible only to the members of that
space.
Administrators can remove members, which immediately revokes their access to every agent,
knowledge base and connection in the workspace.
Individual tools can be enabled, gated behind human approval, or disabled per agent.
Administrators can request deletion of a member's profile and data by emailing
support@praxic.io.

22. Security Practices

Encryption. All traffic to and from the Service is encrypted in transit with TLS. Data
at rest, including our database, object storage and backups, is encrypted.
Credential isolation. Third-party credentials are encrypted at rest and are never
exposed to AI models, to generated code, or to execution sandboxes.
Tenant isolation. Every query is scoped to the requesting organisation and space, and
cross-tenant isolation is covered by our automated test suite.
Backups. Our database is backed up automatically so that we can restore your data in an
emergency. Backups are encrypted and access-controlled.
Security testing. We test the Service against the OWASP API Security Top 10, covering
authentication, object and function level authorisation, injection, and resource
consumption, and we remediate findings before release.
Monitoring. Application errors and anomalous activity are monitored continuously, and
rate limits are enforced on the API.
Least privilege. Internal access to production data is restricted by default. Team
members are granted only the scopes necessary for their work.
Two-factor authentication is required on internal accounts with access to production
systems and source control.
Offboarding. When a team member leaves, their accounts are deactivated and their
devices are wiped.

23. Children's Privacy

The Service is not intended for use by children under the age of 13, and we do not knowingly
collect personally identifiable information from them. If you become aware that a child has
provided us with Personal Data, please contact us. If we learn that we have collected
Personal Data from a child without verified parental consent, we will take steps to remove
that information from our servers.

24. Data Protection Officer

Basepoint has appointed a Data Protection Officer responsible for overseeing compliance
with applicable data protection laws. The DPO is the point of contact for individuals, or
their authorised representatives, who have questions or requests about their personal data.

You can contact the DPO at support@praxic.io.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by
posting the new policy on this page and updating the effective date at the top.

If the changes are material, we will notify you by email or by a prominent notice within the
Service before they take effect. You are advised to review this Privacy Policy periodically.
Changes are effective when they are posted on this page.

26. Contact Us

If you have any questions about this Privacy Policy, or want to exercise any of the rights
described in it, contact us:

By email: support@praxic.io

By post: Basepoint Pte. Ltd. (UEN 202600514Z), 68 Circular Road, #02-01, Singapore 049422

Privacy Policy