Draft pending legal review. Items in square brackets are still to be completed or verified.
Bassotto Privacy Policy
Last updated: 2026-10-25
Bassotto is a personal assistant powered by artificial intelligence. It reads the sources you connect (mail, calendar, contacts, documents), remembers what you ask it to remember and, when you authorise it, acts on your behalf: for example it drafts emails, creates events or books a flight. This policy explains what data we process, why, who we share it with and what rights you have. Section 11 is for people who do not use Bassotto but appear in a user's content (for example someone who emails one of our users).
1. Controller
GRADIENTLABS S.R.L., Via Candia 350F, 60131 Ancona (AN), Italy, VAT IT03002060428, REA [REA].
Privacy contact: privacy@gradientlabs.it. Data Protection Officer: [appointed, with contact details / not appointed — assess under GDPR art. 37].
2. Data we process
| Category | Examples | Source | Required? |
|---|---|---|---|
| Account | email, name, password (stored only as a hash), Google identity used to sign in, role, active sessions | you | yes, without it we cannot create the account |
| Conversations | messages, attachments, voice notes and their transcripts, assistant replies, history of actions and approvals | you, the assistant | yes, they are the service |
| Memory | facts, preferences and notes saved when you ask or when the assistant finds them useful [verify current behaviour: on request or automatic]; always visible and deletable |
you, the assistant | no |
| Google data | email (read and drafts), calendar events, contacts (read only), Drive files (read only) | Google, with your authorisation | no: without it, inbox and calendar features are unavailable |
| Other integrations | content from Telegram, Slack, Notion, Linear, GitHub that you connect | the services you connect | no |
| Travel | flight numbers, itineraries, passenger details for bookings you approve | you, booking emails | no |
| Credentials and payment (vault) | passwords for third-party sites; number, expiry and holder of cards you choose to save, encrypted on our servers. The card security code (CVV) is not saved: you enter it for each payment and it stays available for at most 10 minutes | you | no |
| Technical data | security and error logs, IP address, device identifier for push notifications, app version | your device | yes, for security and operation |
| Waitlist and applications | email, role, company, travel frequency, invite code, the share link you arrived with | you, on the website | yes to join the list |
The email, events and documents you connect contain data about other people (senders, attendees, contacts). We process it only to carry out the tasks you request (section 11).
Special categories (art. 9) and criminal-offence data (art. 10). We do not ask for them or use them to profile anyone, but they may appear in your mail or documents. [TO BE DECIDED WITH COUNSEL: legal basis under art. 9(2) — for example the user's explicit consent for their own data — and handling of third parties' data; measures: exclusion from memory, minimisation towards the model.]
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service: replying, remembering, drafting, carrying out approved actions | performance of the contract (art. 6(1)(b)) |
| Reading Google data and the other integrations you connect | performance of the contract (art. 6(1)(b)); connecting uses your OAuth authorisation, revocable at any time |
| Proactive messages (reminders, flight alerts, briefs) | performance of the contract (art. 6(1)(b)); you can switch them off |
| Service security, abuse prevention, action log | legitimate interest in protecting the service and its users (art. 6(1)(f)) |
| Retention required by law (e.g. invoices, requests from authorities) | legal obligation (art. 6(1)(c)) |
| Processing third-party data contained in your accounts | your and our legitimate interest in managing your correspondence (art. 6(1)(f)), with the safeguards in section 11 [confirm with counsel] |
| Waitlist, invitations and design-partner interviews | pre-contractual steps at your request (art. 6(1)(b)) |
| Promotional communications unrelated to the waitlist | consent (art. 6(1)(a)), separate and optional, revocable |
| A team member accessing your content for a specific task (support, Executive plan) | explicit consent for that task (art. 6(1)(a)) |
We do not use your content to train artificial intelligence models, ours or anyone else's. We do not sell personal data and do not use it for advertising.
4. Google user data (Limited Use)
Bassotto's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, for Google data and data derived from it:
- we use it only to provide or improve user-facing features that require it and are visible in the app (reading and summarising mail, drafting replies, managing your calendar, finding contacts and documents);
- we transfer it to others only as needed to provide or improve those features and with your consent (for example to the AI model provider that processes your request, which may not use it for training), to comply with law, or as part of a merger, acquisition or sale of assets with your explicit prior consent;
- we do not use it for advertising, including retargeting, personalised or interest-based advertising;
- we do not use it to develop, improve or train generalised AI or machine-learning models;
- no human reads it unless you give explicit consent for specific content, it is needed for security purposes (such as investigating abuse), to comply with law, or the data is aggregated and anonymised for internal operations.
You can revoke access at any time from Bassotto's settings or at https://myaccount.google.com/permissions.
5. Actions on your behalf and automated decisions
- Emails and messages to third parties: the assistant sends them after your approval, or without asking only if you created an "always allow" rule for that recipient, domain or type of action. Rules are visible and revocable; they never apply to background tasks.
- Purchases and payments: always require your approval; no rule allows them.
- Messages sent to third parties state that they were written by an AI assistant (AI Act art. 50)
[PRECONDITION: disclosure implemented server-side]. - We keep a log of the actions taken and the approvals given.
The assistant sorts and summarises your mail and proposes actions, but makes no decisions producing legal or similarly significant effects on you or others without your involvement (GDPR art. 22) [check with counsel in light of "always allow" rules].
6. Who we share data with
Processors (GDPR art. 28), processing data on our behalf:
| Provider | Role | Data | Location / transfer safeguards |
|---|---|---|---|
| Hetzner Online GmbH | application server hosting | all service data | EU: Helsinki, Finland |
| DigitalOcean, LLC | managed database | account, conversations, structured memory, logs | EU: Amsterdam, Netherlands; US company: DPF/SCCs [verify] |
| OpenAI | AI models, voice-note transcription | the content each request needs | US: DPF/SCCs [verify]. API data is not used for training; it may be kept up to 30 days for abuse monitoring unless zero data retention is agreed [verify the contract] |
| Browserbase, Inc. | remote browser for web tasks you approve | pages visited, form data entered | US: DPF/SCCs [verify] |
| Notion Labs, Inc. | long-term memory store [if still used] |
stored notes and facts | US: DPF/SCCs [verify] |
| AeroDataBox (API.Market / RapidAPI) | flight status | flight number and date | [verify] |
[payment provider, e.g. Stripe] |
web subscription billing | billing and payment data | [verify] |
| our own servers (Hetzner, DigitalOcean, above); no separate CRM or analytics tool | waitlist, invitations | waitlist data | EU |
Independent controllers, receiving data to provide their own service under their own terms: Google (when you connect your account), Telegram, Slack, Notion, Linear, GitHub (when you connect them), Apple (push notifications via APNs and App Store purchases), Duffel Technology Ltd (when you approve a flight booking; the airline receives passenger details) [verify roles with counsel].
We disclose data to authorities only when the law requires it.
7. Transfers outside the European Economic Area
The application server (Helsinki, Finland) and the database (Amsterdam, Netherlands) are in the EU. The AI models, the remote browser and some other providers are based in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on the European Commission's Standard Contractual Clauses with supplementary measures. You can request a copy of the safeguards at privacy@gradientlabs.it.
8. Retention
| Data | Period [proposed; to be implemented where noted] |
|---|---|
| Account | while the account is active; deleted within 30 days of closure |
| Conversations, attachments, voice notes | until you delete them or close the account [consider a limit, e.g. 24 months] |
| Memory | until you edit or delete it |
| Google data read | we keep no copy of the mailbox: only what enters conversations, memory or drafts, with the periods above; access tokens until revoked or the account is closed |
| Inbound channel message queue | 30 days |
| Expired or revoked sessions | 7 days |
| Technical and security logs | [N] days |
| Action and approval log | [N] months, for disputes and security |
| Waitlist and applications | 12 months from the last contact |
| Billing records | 10 years (Italian Civil Code art. 2220) |
| Backups | [N]-day cycle [verify DigitalOcean backup retention] |
| Copies held by AI providers | under their terms (see section 6) |
9. Security
Encrypted connections (HTTPS/TLS); passwords stored only as hashes; vault credentials and integration tokens encrypted at rest; production secrets encrypted; administrative access restricted to the founders and logged; external content (emails, web pages) handled as data, never as instructions, to reduce prompt-injection risk; approval for purchases and, unless you set rules, for messages to third parties.
10. Your rights
You can request access, rectification, erasure, restriction and portability (GDPR arts. 15–20) and withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Right to object (art. 21): you can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, and always to processing for promotional purposes.
In the app you can already view and edit memory, disconnect integrations and delete conversations; self-service data export and account closure [ROADMAP: until then write to privacy@gradientlabs.it]. We reply within one month.
You can lodge a complaint with the Italian Data Protection Authority (https://www.garanteprivacy.it) or the authority of the country where you live or work.
11. If you are not a Bassotto user (GDPR art. 14)
If you write to one of our users, attend one of their events or appear in their contacts or documents, your data (name, address, message content, event attendance) may be read by the user's assistant to carry out the tasks the user asks for. Legal basis: the user's and our legitimate interest in managing their correspondence (art. 6(1)(f)). We do not profile you, do not contact you for other purposes and do not use your data for advertising or training. Messages you receive from the assistant say they were written by an AI. You can exercise the rights in section 10, including objection, by writing to privacy@gradientlabs.it. [TO BE DECIDED WITH COUNSEL: whether and how to provide this notice to third parties (art. 14(5)(b)) and the procedure for handling objections.]
12. Minors
The service is not intended for people under 18.
13. Changes
We will notify you in the app or by email at least 30 days before material changes.