Privacy Policy

SoloBase is operated by Đỗ Hồng Hải (Harris Do), an individual, until a company is formed to take it over; we will tell you by email before that happens. In this policy, “SoloBase”, “we” and “us” mean the Service and its operator. This policy covers solobase.org, app.solobase.org, and the Studios we host at solobase.me addresses and on custom domains (the “Service”). It takes effect on October 1, 2026.

We play two roles. For our own visitors and account holders (“owners”), we decide how personal information is used. For the information owners bring into their Studios about their own clients, we act as a service provider: we process it on the owner’s behalf and under the owner’s instructions.

We collect only what we need to run the Service:

• Account information: your name, email address and profile photo, and the sign-in method you choose (email, Google, Notion or GitHub). We receive your basic profile from the sign-in provider, not your password there.
• Your card and Studio: the name, role, city, photo, status and pages you publish. These are public by design, to anyone with the address.
• Client Hub content: briefs, notes, files, comments and messages in your Client Hubs. These are private to you and the people you let in.
• Payment information from your own Stripe account: when your client pays you, Stripe tells us about the payment (such as the amount, currency, status, checkout identifiers, and the client’s name and email) so we can open the right Client Hub and send a receipt. We never receive card numbers. We store the restricted key you give us, and the webhook secret, encrypted.
• Plan billing: when you buy a plan, Paddle processes the payment and tells us your plan, its status and renewal dates. Paddle, not SoloBase, receives your card details.
• Visit counts on Studio pages: through Vercel Web Analytics, the pages viewed, the referring page, country, device and browser, counted without cookies and without identifying the visitor. If an owner adds their own Google Analytics or Plausible to their Studio, that service measures visits for the owner, under the owner’s own terms.
• People who come through your door: the email address and name of each person who subscribes to your posts, sends you an inquiry, books a service, buys from you, joins one of your Client Hubs or is invited to one, with how and when each came in. We keep this list for you, so you can see it, export it and remove anyone from it. It is never used to decide who may enter a Client Hub.
• Email subscriptions: when someone asks to receive an owner’s new posts by email, we record the address, when they asked, when they confirmed and, if they leave, when they unsubscribed. Nothing is sent until they confirm: with the link we email them or, when they are signed in with a verified email, with their own tap. Visiting a page never subscribes anyone, and every email has a one-click unsubscribe. If an owner moves an existing subscriber list from another service, such as Substack or Medium, they confirm that the people on it asked to receive their emails there. Anyone who had unsubscribed, or whom the owner removed, is left out, and every email still has a one-click unsubscribe.
• Messages you send us, and emails we send you, including whether they were delivered.
• Technical information: our hosting providers record standard request information, such as IP address, browser type and time, to deliver and protect the Service.
• Usage information on solobase.org and app.solobase.org: through Google Analytics, the pages you visit, the link that brought you, your approximate location, device and browser, and whether you requested an invite or opened the app, tied to a random identifier in a cookie.

When you try the card builder on our homepage, we suggest your city using the approximate location our hosting provider derives from your IP address. We use it once to fill in the field and do not store it. A photo you add there stays in your browser and is not uploaded.

• To provide the Service: host your card and Studio, open Client Hubs to the right people, deliver messages and files, and record payments to your Stripe account.
• To apply your plan: count what you have earned through SoloBase, from the payment records Stripe sends us, to know when the Free plan’s limit is reached.
• To send service emails: sign-in emails, invitations, receipts, notices about your account, and changes to these policies.
• To keep the Service secure: prevent fraud and abuse, verify payment events, and investigate problems.
• To show owners how their own Studio is doing, and to understand and improve the Service in aggregate.
• To comply with the law and enforce our Terms.

• We do not sell personal information, and we do not share it for targeted advertising.
• We do not run ads on your Studio.
• We do not list you or your clients in a public directory, feed or marketplace, and we do not show your clients to other owners.
• We do not use your Client Hub content or your clients’ information to train AI models.

Pi, the assistant inside your Studio, and our other AI features help you draft and organize your own material. When you use them, what you ask and the material needed to answer it are sent to an AI provider to produce a result for you: OpenAI by default, or Anthropic or Google (Gemini) if you add your own key for one of them in your settings. AI works for you, the owner; it does not answer your clients on your behalf.

Your conversation with Pi is kept for you on SoloBase’s chat service. Your clients never see it, and you can clear it.

Pi remembers your prices, your writing voice and how you work, so its drafts fit you better. You can see, edit or delete each line in your Studio, and it is never shown to your clients.

When you connect Google, Pi reads your calendar’s upcoming events and searches your Gmail for the emails you ask about (sender, date, subject and a short snippet), only to help you in your Studio. Pi never sends, changes or deletes anything in your Google account, and you can disconnect at any time. SoloBase’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you ask Pi a question on solobase.org, the question is sent to our AI provider to answer it. SoloBase doesn’t store it.

When you ask Pi to design your card, pictures of the drafts it made are sent to the AI provider that runs Pi (yours, if you added your own key) so it can check them. SoloBase doesn’t keep them.

We share information with service providers only as needed for them to provide their service to us, under agreements that limit how they may use it:

• Supabase: our database and sign-in.
• Cloudflare: storage, cached copies of pages so they load quickly, and audio and video for calls.
• Vercel: hosting for our website and servers, and cookieless visit counts on Studio pages.
• Stripe: payments your clients make to you, under your own agreement with Stripe.
• Paddle: our reseller and merchant of record for plan purchases.
• Resend: sending email.
• OpenAI: Pi and the AI features you choose to use.
• Anthropic and Google (Gemini): Pi, only if you add your own key for them.
• Google (Calendar and Gmail): Pi, read only, only if you connect your Google account.
• Google, GitHub and Notion: signing in, only if you choose to sign in with them.
• Google Analytics: counting visits to solobase.org and app.solobase.org, with Google’s advertising features turned off.
• Pexels: the photo of a city shown on a card and on our homepage.
• Open-Meteo and MET Norway: the weather shown on a card, looked up by city.

We use cookies and browser storage that the Service needs to work: to keep you signed in, to remember your settings, and to count visits without identifying the visitor by name. We do not use advertising cookies.

On solobase.org and app.solobase.org, Google Analytics sets cookies that tell us which pages help people find SoloBase. They are not used for advertising. You can block them in your browser settings or with Google’s opt-out browser add-on.

To stop abuse of subscription forms, we keep a one-way hash of the IP address that sent the form, for no longer than a day.

We keep your account and Your Content while your account is open. When you delete your account, or ask us to delete information, we delete it from the live Service within 30 days. Copies in backups are removed as the backups expire, within 30 days.

When an owner removes someone from their People list, or someone unsubscribes, they leave the list and all email at once. Our daily backups no longer contain them within 7 days, and our storage provider’s recovery copies within 30 days. To make sure they are not added back by mistake, we keep only a one-way hash of their email address, which cannot be turned back into the address.

We keep records we are required to keep by law, such as payment and tax records, for as long as the law requires.

We protect information with measures suited to what it is. Payment keys are encrypted before they are stored, payment events are verified by signature, and who may enter a Client Hub is decided on our servers. No system is perfectly secure; if we learn of a breach that affects your information, we will tell you as the law requires. Our Security page at solobase.org/security explains more.

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong;
• delete your information, subject to what the law requires us to keep;
• export Your Content in a portable format.

If you live in California or another state with a consumer privacy law, you have the rights above, the right to know the categories of information we collect and the purposes for which we use it (described in this policy), and the right not to be treated differently for using your rights. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.

You or an authorized agent can make a request by writing to us. We will verify your identity, usually by email, and respond within 45 days.

If you work with someone who uses SoloBase, that person decides what is kept in their Studio about you. Please send requests about that information to them first. If you cannot reach them, write to us and we will help pass it on.

If you subscribed to an owner’s posts, the unsubscribe link in any of their emails stops them at once; you can also ask the owner, or us, to remove you from their list.

The Service is for adults 18 and older running a professional practice. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, write to us and we will delete it.

SoloBase is operated from Vietnam. Our providers process information in the United States and in other countries where they operate. When information moves across borders, we rely on our providers’ safeguards for those transfers.

We may update this policy. If a change is material, we will tell you by email or in the Service before it takes effect, and we will update the date at the top of this page.

Privacy questions and requests: support@solobase.org.