Privacy Policy

Privacy Policy

日本語

Effective date: 2026-10-22

This policy explains what personal information Hidworks LLC handles for the Basho app, the website basho.one, the waitlist and the Supporter subscription, why, who helps us, and what you can ask of us.

1. Who we are

• Operator: Hidworks LLC (ヒッドワークス合同会社)
• Address: Grand-K Kyoto Ekimae Bldg. 201, 85-2 Koinari-cho, Shimogyo-ku, Kyoto 600-8208, Japan
• Representative Member: Hidekazu Shikata
• Contact: support@basho.one

We are the controller of the data described here under the EU and UK GDPR, and the business operator handling personal information (個人情報取扱事業者) under Japan's Act on the Protection of Personal Information (APPI).

2. The Basho app

Basho works on files on your Mac. The app sends none of your notes anywhere. If you bring your own model into the terminal, what you send to it is governed by that provider, not by us.

Sync is not available yet. Before it is, we will update this policy to say what it stores, where, and for how long.

Showing web pages and videos inside a note is off by default. Only if you turn on "web" in the settings and allow a site does Basho show content from that site in place (YouTube videos are shown through youtube-nocookie.com). When it does, that site receives the address you wrote in the note (including its path and query), your IP address and browser information, but never your note text; that site's own privacy policy applies, and it may use its own cookies and scripts.

3. What we collect and why

a) The waitlist

If you join the waitlist, we collect your email address and the date and time you signed up and confirmed (double opt-in: nothing is sent until you open the confirmation mail and press the button; the button expires after 48 hours). We use it to write when a build is ready and for occasional product updates.

• Legal basis (GDPR): your consent, which you can withdraw at any time with the unsubscribe button in any email or by writing to support@basho.one.
• Provider: Resend (Resend, Inc., United States) sends these emails as our processor and stores the data in the United States.
• We do not use open or click tracking in our emails.
• If you do not confirm, we aim to delete the sign-up after about 30 days.

b) Payments

Supporter is not on sale yet. When it is, payments will be processed by Stripe. Stripe collects your card details, your name, email and billing address, and the location information needed to work out tax. We never see or store your full card number. From Stripe we receive your email address, country, what you bought and when, the payment status and the last four digits of your card.

• Why: to provide Supporter, issue receipts and invoices, handle refunds and chargebacks, and meet tax and accounting duties.
• Legal basis (GDPR): performance of our contract with you, and our legal obligations.
• Provider: Stripe (Stripe, Inc. and its affiliates), which processes data in the United States, India and other countries. Stripe's own privacy policy applies to the data it handles for itself: https://stripe.com/privacy

c) Account emails

If you are a Supporter, we email you about your subscription: receipts and failed payments (sent by Stripe), and renewal reminders, notice of price changes and confirmation when you cancel (sent by us through Resend, United States). These are part of the service and are sent even if you have unsubscribed from product updates.

• Legal basis (GDPR): performance of our contract with you, and our legal obligations.

d) When you email us

If you write to support@basho.one, we keep your email address and message so that we can reply. Our inbox is Gmail on Google Workspace (Google LLC, United States). Your messages to us do not pass through Resend.

• Legal basis (GDPR): our legitimate interest in answering you, or our contract with you if you are a Supporter.

e) This website

basho.one is hosted on Vercel (Vercel Inc., United States); the static pages are delivered from Vercel's global network. To deliver and protect the site, Vercel processes technical data such as IP addresses, browser type and request time. We use it only for security and operations, and the server logs are kept for a short time (about one day). For example, the waitlist form uses your IP address to limit repeated sign-ups; it is held only in memory and never stored.

No analytics, no tracking cookies, and no third-party scripts. Fonts for the text on the home page are loaded from Google Fonts (Google LLC, United States), so Google receives your IP address and the usual request information when you open that page.

4. Service providers and countries

We use these providers only to run Basho. We do not sell your personal information or share it for advertising, and we do not give it to anyone to train machine-learning models.

• Transfers out of the EEA, UK or Switzerland: we rely on the EU Standard Contractual Clauses (and the UK Addendum) in each provider's data processing terms, and on the EU-U.S. Data Privacy Framework where the provider is certified.
• Under APPI: we entrust these providers with processing under contracts that require them to protect the data to a standard equivalent to APPI. On request, we will tell you what they do to protect it and about the data-protection laws of the countries involved.

We sometimes use software assistants to help answer your email. When we do, the content of your email is sent to that service, which processes it for us as our processor; for example, Cursor (Anysphere, Inc., United States) and the model providers it uses.

We may record a summary of your inquiry, with anything that could identify you removed, in our internal work-tracking tools (such as GitHub, Slack and Notion).

5. How long we keep data

• Waitlist: until you unsubscribe or ask us to delete it. After you unsubscribe, we keep only your address and the fact that you unsubscribed, so we never write to you again. Unconfirmed sign-ups: we aim to delete them after about 30 days. Resend keeps sending logs for 30 days.
• Website server logs: about one day.
• Payment records and emails about payments, refunds or invoices: 7 years from the end of the business year they belong to (10 years in a year with a tax loss carried forward), as Japanese tax law requires.
• Other emails to support@basho.one: 3 years after our last exchange, unless you ask us to delete them sooner.
• Records of privacy requests (what was asked, when, and what we did): 5 years after the request is closed.

6. Your rights and how to make a request

Depending on where you live, you can ask us to:

• tell you what personal information we hold about you and why, and give you a copy of it
• correct it
• delete it, or stop using it
• stop sending it to others
• give it to you in a portable format
• restrict or object to how we use it

You can also withdraw consent at any time. We handle requests the same way wherever you live.

How to ask: email support@basho.one from the email address your data is tied to, and say what you would like. You can also write to our postal address above. To stop emails right away, use the unsubscribe button in any email.

• Cost: free.
• Checking it is you: we act on requests sent from the email address the data is tied to, and send any copy of your data to that address. We do not ask for ID documents. Before we delete a Supporter's payment details, we will ask you to confirm by email.
• Someone asking for you: we need a signed authorization from you, and we will confirm with you directly before acting.
• When: we reply to confirm we have your request within 3 business days, and complete it within 28 days of receiving it. If a request is complex, we may need up to two more months; if so, we will tell you why within those 28 days.
• What we may have to keep: if the law requires us to keep something, such as payment records for tax, we will tell you what and why.

7. How we protect your data

• Rules: we have written down how we collect, use, keep and delete personal information, and who handles it.
• People: only the operator and the people and tools we authorize can see the data, and only for the purposes in this policy.
• Technology: our providers encrypt data in transit and at rest, and the website is served only over HTTPS.
• Foreign countries: your data is processed in the countries listed in section 4. We check the data-protection laws of those countries (for example, the United States and India) and choose providers with recognized security practices and data processing terms.

No method of transmission or storage is completely secure. If a breach could harm you, we will tell you and the authorities as the law requires.

8. Questions and complaints

If you have a question or complaint about how we handle your personal information, please write to support@basho.one first, or to our postal address above. We will reply within 3 business days.

You can also contact a data protection authority:

• Japan: Personal Information Protection Commission (個人情報保護委員会), PPC consultation line: +81 3-6457-9849 (weekdays 9:30–17:30 JST, in Japanese). https://www.ppc.go.jp/personalinfo/pipldial/
• EU/EEA: the authority in the country where you live or work.
• UK: the Information Commissioner's Office (ICO), https://ico.org.uk/

9. Children

Basho is not directed to children under 13, or under 16 in the EEA, and we do not knowingly collect their data.

10. Changes

If we change this policy, we will post the new version here with a new effective date. If a change is significant, we will also tell waitlist members and Supporters by email.

11. Contact

Hidworks LLC (ヒッドワークス合同会社)
Grand-K Kyoto Ekimae Bldg. 201, 85-2 Koinari-cho, Shimogyo-ku, Kyoto 600-8208, Japan
support@basho.one

Last updated 2026-10-22