Privacy Policy

Who operates Basis

Basis Fantasy is a service of Ambrette Technologies LLC, which is responsible for the personal information described in this policy. For any privacy question, request, or concern, email support@basisfantasy.com.

What we collect

• Account and authentication data — your email address and sign-in identifiers, handled through Supabase Auth (magic-link email and, where enabled, Google sign-in).
• Purchase and entitlement records — confirmation that a purchase succeeded, the subscription plan and billing period it covers, and identifiers Stripe provides for that transaction. Checkout itself is hosted by Stripe: Basis does not receive or store your full card number, and payment details are entered on Stripe’s own page, not ours.
• Product settings and roster inputs — the scoring configuration and any team or roster selections you enter into Basis.
• Product usage events — Basis records first-party product usage events to measure trial and weekly use: event type, time, account ID when signed in, a random first-party visitor ID kept in a Basis cookie (so visits before sign-in can be joined to the account afterwards), how you arrived (campaign tags and referring site), and limited event properties that may identify a player or league. Events are deleted after 90 days. No engagement analytics vendor receives them.
• Email preferences and delivery — Basis stores your Basis Weekly choice for the life of your account. Basis Weekly is on by default for every account; you can turn it off in email preferences or through the one-click unsubscribe link in each message. Resend processes the email address and message needed to deliver email from Basis.
• Notification records when alerts are enabled — preferences can include per-alert choices, push consent, thresholds, age attestation, and time zone for quiet hours. A temporary outbox can hold an account-specific alert and delivery target before sending; it may skip an alert if consent or relevance changes. Delivery records hold the channel, alert type, send or open status, and timestamps to prevent duplicates, enforce caps and backoff, and troubleshoot delivery, without full message bodies. If you opt in to browser push, Basis stores its endpoint and public encryption keys for delivery; you can turn push off and remove the endpoint. The push transport provider will be identified when push launches.
• Operational logs — standard server and application logs used to run, secure, and troubleshoot the service.

Basis does not currently run advertising or analytics tracking through external vendors, and does not sell personal information.

Basis sends application errors to Sentry, an error-monitoring service, not an analytics service; Sentry is not used to measure your product activity or advertising engagement.

Why we collect it

To create and authenticate your account, process your payment and grant the entitlement it pays for, run the product against the settings you choose, respond to support and refund requests, and keep the service secure and working.

Who else sees it

Basis uses Resend to deliver Basis email, Stripe for payment processing and Checkout, Supabase for authentication and data storage, and Vercel to host and deliver the site and handle its associated operational request logs. If you choose Google sign-in, Google also processes the authentication data needed for that sign-in. Messages sent to support@basisfantasy.com are received and forwarded through Cloudflare Email Routing, and the mailbox provider for the private destination address processes those messages so we can read and respond to them. Each provider processes data for its stated function under its own privacy and security terms. Basis does not sell personal information.

How long we keep it

We retain account, purchase, and entitlement records for as long as needed to provide the service, resolve disputes or refund requests, and meet legal and tax obligations, and delete or anonymize data we no longer need for those purposes.

Identifiable product-use events are deleted after 90 days; Basis may keep aggregate counts without account IDs. Notification preferences are kept for the account life and deleted with the account. Once notification delivery is enabled, terminal queued alerts are kept for 30 days, pending alerts until resolved, and delivery attempts for 90 days. Push endpoints are kept while consent and the endpoint remain valid, revalidated at least every 90 days, and removed on revocation, unsubscribe, permanent failure, or account deletion.

Your choices

You can ask us to access, correct, or delete your personal data, or to close your account, by emailing support@basisfantasy.com. We will respond to verified requests within a reasonable time and may need to retain certain records where the law requires it.

Security

We use reasonable technical and organizational measures to protect your information, and we rely on Stripe and Supabase’s own security practices for the functions they perform. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Children’s privacy

Basis is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact support@basisfantasy.com and we will address it.