Privacy policy

1. Operator

The personal data operator is BASIS AI SYSTEMS, tax ID (BIN/IIN) 950802301411, registered in Republic of Kazakhstan, Almaty. The operator's full registered name and contact details are shown in the Operator details section at the end of this Policy; further registration data is available on request.

2. Categories of personal data we process

Depending on the features you use we may process the following categories:

• registration data — username or display name, email address, password stored as a cryptographic hash (we never have access to the plaintext);
• subscription data — selected plan, status (active / canceled / expired), period start and end dates, payment history for the subscription. Card details and other payment credentials are never stored by the Service; they are handled directly by payment providers;
• chat content — text of your messages, attached files (images, documents) and AI model responses. Stored within your account until you delete them or close the account;
• technical data — IP address, browser and device type, API request logs (model name, token counts, timestamps), session identifiers;
• support — content of your conversations with our support team and any attachments.

The Service is not intended for processing special categories of data (medical, biometric, political and so on). Please do not place such data in the Service unless strictly necessary.

3. Purposes of processing

We process personal data exclusively for the purposes listed below:

• registration and authentication;
• providing access to Service functionality and proxying your requests to the AI models within your subscription plan;
• subscription management — tracking your active plan, periods, limits and payment history;
• providing technical support;
• protecting the Service and users from fraud, abuse and unauthorised access;
• compliance with Kazakhstan law, including tax obligations;
• anonymised analytics to improve service quality.

4. Legal basis for processing

Processing is based on:

• your consent given at registration (Article 8 of the Law);
• performance of the offer contract (Terms of Service) entered into between you and the operator upon registration;
• compliance with obligations imposed on the operator by Kazakhstan law (Article 9 of the Law), including tax and anti-money laundering legislation.

5. Disclosure to third parties

To deliver the Service some data may be disclosed to the following categories of recipients:

• AI model providers — your request content (message text and attached files) and the chosen model identifier are forwarded to that model's provider (Anthropic, OpenAI, Google and others) to execute the request. The catalogue of models and their providers is available in the Service. Processing on the providers' side is governed by their own policies;
• Payment providers — payment details are passed to your chosen payment provider to complete the transaction;
• Hosting and infrastructure providers — data is stored and processed on servers and object storage we use;
• Authorised state bodies — upon a reasoned request in the procedure established by Kazakhstan law.

We do not disclose your personal data for third-party advertising or marketing purposes and we do not sell it.

6. Cross-border transfer

AI model providers and hosting providers may be located outside the Republic of Kazakhstan, including in the United States, the European Union and other countries. Such transfer is performed in accordance with Article 16 of the Law and on the basis of the consent you gave at registration, only in the volume needed to execute the relevant request.

7. Retention

Retention depends on the data category:

• registration data — for the lifetime of the account and up to 30 calendar days after its deletion;
• chat history and attached files — until you delete them or the account is closed;
• financial records and primary accounting documents — no less than 5 years, as required by the Tax Code of the Republic of Kazakhstan;
• technical logs — up to 12 months;
• backups — up to 90 days, after which they are automatically deleted.

8. Security

We use organisational and technical measures to protect personal data, in particular:

• all data is transmitted between your device and the Service over secure channels using TLS/HTTPS;
• user passwords are stored only as cryptographic hashes;
• staff access to data is restricted on a least-privilege basis;
• regular backups and infrastructure access control.

No internet service can guarantee absolute security of transmitted information; by accepting this Policy you confirm that you are aware of this.

9. Your rights

Under Articles 24–25 of the Law you have the right to:

• obtain information about whether we hold your personal data, its composition and processing purposes;
• demand correction and supplementation of the data;
• demand blocking or deletion of the data when you withdraw consent or the processing purposes have been achieved;
• withdraw consent previously given (in which case we will stop processing, save for cases expressly provided by law);
• lodge a complaint with the Kazakhstan authority responsible for personal data protection.

Send requests to the email shown in the Operator details section. The response time is 10 working days.

10. Cookies and similar technologies

The Service uses strictly necessary cookies for session identification and correct interface operation. The Service cannot function without them.

Where enabled in the operator's settings, third-party analytics services (e.g. Yandex.Metrica, Google Analytics) may be loaded for anonymised usage analysis. You can manage analytics through your browser settings; opting out does not limit Service functionality.

11. Use by minors

The Service is not intended for persons under the age of 18. Registration and use by minors is permitted only with the consent of their legal representatives and at their responsibility.

12. Changes to this Policy

The operator may update this Policy. The current version and its effective date are always available on this page. Material changes will be additionally notified to the email you provided at registration.