Baste

Privacy policy

Last updated 18 October 2026

Draft. This text has not yet been reviewed by a lawyer and may change before launch.

Baste is a tool for fashion brands: a designer records a sample review by talking and taking photos, and Baste turns it into a correction sheet for the factory. This policy explains what information Baste handles, why, who helps us process it, and the choices you have. Baste is operated by Northstar Engineering Ltd, 597 Bernardin de St Pierre, Vallée des Prêtres, Port Louis, Mauritius (“we”, “us”).

The short version

• Your recordings, photos and corrections belong to you and your brand. We use them only to provide Baste to you.
• We do not sell personal information, show ads, or use your content to train AI models, and we ask our providers not to either.
• The microphone and camera are used only while you are recording a review you started.
• You can export your data and delete your account from inside the app at any time.

Information we handle

Account and studio

Your email address and sign-in details (or the identifier from Sign in with Apple or Google), the role and sample volume you choose during onboarding, your studio’s brand name, logo, sheet footer, units and factory languages, and the team members you invite (their email address and role).

Your review content

Audio recordings of sample reviews, photos taken during a review and any markup you draw on them, the transcript of each recording, the corrections and measurements produced from it and your edits, tech packs you import and the points of measure read from them, styles, sample rounds and correction sheets. Recordings and photos are stored on your device first and uploaded when you finish a review. Recordings can include anything said nearby during a review, so please let people in the room know you are recording.

Factories

Factory names, cities and languages, and the names and email addresses of factory contacts you add. When you send a sheet, anyone with the link can open it. Factory staff do not need an account; what they submit through the link (marking items done, questions and replies) is stored and shown to your studio.

Subscriptions

If you subscribe, payment is handled by Apple or Google. We never see your card details. We receive the subscription status (plan, trial, renewal) through RevenueCat, linked to your studio.

Device and technical information

A push notification token if you allow notifications, your device platform, and standard server logs kept by our hosting providers (such as IP address, time and request details) for security and troubleshooting. Baste does not currently include advertising, analytics or tracking SDKs. If we add crash reporting or product analytics, we will update this policy first.

How we use it

• To provide Baste: store your work, transcribe recordings, pull corrections and measurements out of them, check them against your tech pack, translate sheets for factories, render PDFs, send sheets and deliver factory replies.
• To run your account, team and subscription, and to send you service notifications (for example “corrections ready” or a factory question).
• To keep Baste secure, prevent abuse, and fix problems.
• To meet legal obligations.

We rely on our contract with you (providing the service you asked for), our legitimate interest in keeping Baste secure and working, your consent where we ask for it (such as notifications, microphone and camera), and legal obligations.

AI processing

Transcripts and review photos are sent to Anthropic’s Claude API to identify corrections, read tech packs and translate sheets. Recordings are sent to Deepgram for speech-to-text. We have opted out of Deepgram’s model improvement program, and Anthropic does not train its models on data sent through its commercial API. AI output can be wrong: Baste shows every correction to you for review before anything is sent to a factory, and measurement arithmetic is done by our code, not by the AI.

Who we share it with

We use these service providers to run Baste. They process information on our behalf and only as needed to provide their service:

• Supabase: database, sign-in and file storage (servers in Frankfurt, Germany).
• Fly.io: runs our processing service and the factory web page (Frankfurt, Germany).
• Deepgram: speech-to-text (United States).
• Anthropic: AI extraction and translation (United States).
• RevenueCat: subscription status (United States).
• Apple and Google: app distribution, payments and optional sign-in.
• Expo: delivery of push notifications.
• Our email delivery provider: sending sheets to the factory contacts you choose.

Inside Baste, your content is visible to members of your studio according to their role, and sheets you send are visible to anyone with the link until you withdraw it. We may also disclose information if required by law, to protect people’s safety, or as part of a merger or sale of the business (with this policy continuing to apply).

International transfers

Some providers process data outside Mauritius and the European Economic Area, mainly in the United States. Where required, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses.

How long we keep it

• Your account, studio and review content: for as long as your account exists, or until you delete the item.
• Audio recordings: until you delete the review or your account. Your studio owner can choose in Settings to delete recordings as soon as their sheet is sent, or 90 days after it is sent; transcripts, photos and sheets are kept either way.
• Recordings not yet uploaded stay on your device and are removed when you discard the review or sign out.
• When you delete your account, we delete your studio data and files immediately from our live systems; copies in backups are removed within 30 days.
• Server logs: kept by our hosting providers for a limited period for security.

Your choices and rights

You can see and edit your information in the app, export all of your studio’s data (Studio → Export all data), and delete your account (Studio → Delete account). Depending on where you live, you may also have the right to access, correct, delete or port your information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email privacy@getbaste.app. You can also complain to a data protection authority, such as the Data Protection Office in Mauritius or the authority where you live.

If your studio added you as a team member or a factory contact, your studio decides what is stored about you in its workspace; we will help them respond to your request.

Security

Data is encrypted in transit, access is restricted to your studio by database rules, AI and service keys are kept on our servers and never shipped in the app, and factory links use long random tokens that you can withdraw. No system is perfectly secure; if we learn of a breach affecting your information, we will notify you and the authorities as the law requires.

Children

Baste is a business tool and is not directed to children. You must be at least 16 to use it.

Changes

We will post any change to this policy here and update the date above. If a change is significant, we will tell you in the app or by email before it takes effect.

Contact

Northstar Engineering Ltd, 597 Bernardin de St Pierre, Vallée des Prêtres, Port Louis, Mauritius. Email privacy@getbaste.app.