BasenCloud Privacy Policy

The short version

• We use your data to run BasenCloud: to sign you in, to show you the batteries you link, and to send the notifications you choose.
• BasenCloud has no advertising, no analytics or tracking tools, and we do not sell your data.
• Battery data belongs to the battery. You see a battery's alarms and events from the time you link it, and its whole history at any time while it is linked to you.
• We never see your Google or Apple password. If you create your account with an e-mail address and a password, we store the password only as a one-way hash, never in readable form.
• You can delete your account in the app at any time (Profile › Delete account) or by e-mail to support@basengreen.com.

Who is responsible for your data

BasenCloud is provided by Shenzhen Basen Technology Co., Ltd. ("BasenGreen", "we", "us"), Shenzhen, China. BasenGreen decides why and how your personal data is used and is the controller of the data described in this policy.

LYNX Technology develops and maintains BasenCloud for BasenGreen. LYNX works on BasenGreen's instructions as a service provider and does not use your data for its own purposes.

For any question about this policy or your data, and to use any of your rights, write to support@basengreen.com.

Your account

You can look around the app in guest mode without an account. Guest mode shows sample data only and sends no account or battery data to our servers. Each time the app starts, also in guest mode, it asks Expo's update service whether a newer version of the app is available (see "Who receives your data"). When the app starts, and each time it returns to the screen, it asks our server whether its version is still supported and downloads the current store, legal and support links. These requests carry only the platform (iOS or Android), the app's version and build number, and no account data; they are also made in guest mode. Like any request, they reach the server with the device's IP address, which is used only to limit how often requests are made and is not stored with them. To use BasenCloud with your own battery, you sign in with Google or with Apple, or you register your e-mail address with a password, and we create a BasenCloud account that holds:

• your first name and family name, as Google or Apple provide them or as you enter them in the app;
• your e-mail address. With Sign in with Apple this can be a private relay address from Apple if you chose to hide your e-mail address;
• if you sign in with Google or Apple: the identifier that Google or Apple gives your account for BasenCloud (a code, not your password), whether they have verified your e-mail address, whether it is an Apple relay address, and, for a Google Workspace account, your organisation's domain name;
• if you created the account with your e-mail address: your password, stored only as a one-way hash (a scrambled form from which the password cannot be read back);
• your BasenCloud account ID, when the account was created, when you last signed in and when each sign-in method was last used.

We never receive or store your Google or Apple password, and we do not keep the sign-in tokens that Google or Apple give the app.

Information we receive from Google

If you choose Continue with Google, the app asks Google for your basic profile only (the "openid", "email" and "profile" permissions). Google then gives BasenCloud your name (first name and family name), your e-mail address and whether Google has verified it, the ID of your Google account, and, for a Google Workspace account, your organisation's domain name.

Google's answer also contains a link to your profile picture. BasenCloud does not store or use it. We do not ask for access to your Gmail, contacts, calendar, files or any other Google data.

How we use it: only to create your BasenCloud account, to sign you in, to show you which account you are signed in with, to show your first name and a shortened e-mail address on the display of a battery you link (see "Battery and display data"), and to contact you about your account when needed.

We do not sell Google user data, we do not use it for advertising, and we do not use it to build profiles. We transfer it only to the service providers named in this policy that help us run BasenCloud, or where the law requires it. People at BasenGreen and LYNX Technology see it only when they need to support you, to keep the service secure or to comply with the law.

BasenCloud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

The data is protected as described in "How we protect your data" and is deleted when you delete your account. Deleting your account in the app also removes BasenCloud's access to your Google account. You can remove that access yourself at any time at https://myaccount.google.com/connections. Removing it does not delete your BasenCloud account; to delete the account, see https://basencloud.com/account/delete.

Information we receive from Apple

If you choose Sign in with Apple (on iPhone and iPad), Apple gives BasenCloud the user ID Apple assigns to you for BasenCloud, your e-mail address or, if you chose Hide My Email, a private relay address that forwards to you, and whether the address is verified. Apple gives your name only the first time you sign in, and only if you share it.

We use this information only as described for your account above, and we never sell it or use it for advertising.

When you delete your account in the app, we ask Apple to revoke BasenCloud's Sign in with Apple authorization for your Apple Account. You can also stop using Sign in with Apple for BasenCloud at any time in your Apple Account settings.

Your account with an e-mail address

If you create your account with your e-mail address instead of Google or Apple, you enter your e-mail address, your first name and family name, and a password in the app. Before the account is created, we send a 6-digit code from no-reply@basencloud.com to that address, and you type the code in the app within 10 minutes to confirm that the address is yours. If you forget your password, you can ask the app for a code at the same address and choose a new password; every other phone signed in to your account is then signed out.

Your password travels to our server only over an encrypted connection and is stored only as a one-way hash, a scrambled form from which the password cannot be read back. We never store it in readable form and never give it to anyone.

When someone asks for a code for an address that already has a BasenCloud account, we send no code but a short notice instead: that the account already exists, or that the address signs in with Google or Apple. An e-mail address that signs in with Google or Apple cannot also be used for an account with a password; the accounts are never joined. These e-mails contain no advertising and no tracking. If you receive one you did not ask for, you can ignore it.

Microsoft sends these e-mails for us (see "Who receives your data"). If you reply to one, your reply goes to support@basengreen.com.

Battery and display data

A BasenGreen battery has a touch display that connects to Wi-Fi and sends data about the battery to BasenCloud, whether or not the battery is linked to an account. This data belongs to the battery and is kept by BasenGreen, not in your account. It includes:

• identity: the model, serial numbers, hardware and firmware versions and manufacturing date of the display and the battery packs, the display's hardware ID and its Wi-Fi MAC address;
• readings: state of charge and state of health, voltages, currents, cell voltages, temperatures, cycle count, whether charging and discharging are allowed, and the protection settings of the battery management system (BMS);
• alarms and protection events, the counts of protections kept by the battery management system (the BMS log), and the firmware updates BasenGreen installs;
• connection details: whether the display is online and when it was last seen, the Wi-Fi signal strength, the name of the Wi-Fi network it uses (never the Wi-Fi password), its address on your local network, and the internet (IP) address it connects from, which is usually the internet address of your home. The address the display registered from and first connected from is kept in BasenGreen's security audit log, and our server logs also record the display's address when it registers or connects (see "Security records and technical logs").

When you link a battery, this data is connected to your account for as long as the link lasts. You always see the current live values. You see alarms, events and notifications only from the time you linked the battery; an alarm that was already active when you linked is shown as "Active since before you linked", without its start time. You can see the battery's history in the app at any time while it is linked to you, including the time before you linked it. The BMS log is read from the battery when you tap Read in the app, or when BasenGreen support reads it; you see the counts with the time they were read, and they cover the battery's whole life, including the time before you linked it.

While a battery is linked, its display shows the account's first name and a shortened e-mail address, for example "Linked to Anders (an•••@gmail.com)", so that anyone at the battery can see who it is linked to. The display never receives your full e-mail address. After an unlink the display no longer shows them.

Names you give your batteries

You can give each linked battery a name and a location label, for example "Home · Garage". They are shown only to you, and they are deleted when the battery is unlinked or when you delete your account. They also appear in the notifications we send you, and so pass through the notification services named below. Please keep them short and do not put sensitive details, such as your full street address, in them.

Notifications

If you allow notifications, the app registers a push token: a code from Apple or Google, obtained through the Expo push service, that lets us send notifications to BasenCloud on that phone. We keep the token with the phone's system (iOS or Android), the app version, a device name if the app provides one, and when it was registered.

We also keep your notification choices (protection events are always on; warnings, battery offline and firmware updates can be switched off in the app's settings) and a record of each notification we send you (its type, title, text, time and delivery status), so that a notification is not sent twice and a failed delivery can be retried.

Notifications name the battery and the alarm. They never contain measured values, e-mail addresses or people's names. You can turn notifications off at any time in your phone's settings.

Alarm acknowledgements and BMS log reads

• When you tap Acknowledge on an alarm, we record that you have seen it and when. This mark is only for your account; it does not change the alarm for BasenGreen.
• When you tap Read in a battery's BMS log, the app asks the battery's display to read the counts from the battery. We record the request (the battery, your account and the time) and keep the counts with the time they were read, as battery data. Reading changes nothing on the battery.

Security records and technical logs

• Audit log: BasenCloud records important actions, such as sign-ins, links and unlinks, BMS log reads, account changes and account deletion. For actions by or about a customer, these records hold account and battery IDs, times, action names and reasons. They never hold your name, your e-mail address, or your phone's IP address or software details.
• App sessions: to keep you signed in, the server keeps a record of each app session (a scrambled form of the session token, when it was issued and when it expires) together with the IP address and the software description that your phone sent when the session was started or renewed. Apart from the short-lived abuse-protection counters below, these session records are the only place where we keep your phone's IP address.
• Abuse protection: to stop repeated sign-in, code and linking attempts, the server counts attempts per IP address, per account and per e-mail address for short periods of at most one hour.
• Server logs: our servers log each request with its time, the address requested (which can contain a battery ID) and the result. They do not log your phone's IP address. When a battery's display registers or connects, the logs also record the display's internet (IP) address. The web server of basencloud.com keeps no visitor log.
• Link codes: the codes a display shows for linking are stored only as a scrambled fingerprint, with the account that used them, and are deleted 30 days after they expire.
• E-mail codes: the codes we e-mail you to confirm your address or reset your password are stored only as a scrambled fingerprint, with the e-mail address they were sent to and how often a wrong code was typed. They expire after 10 minutes and are deleted within a day.

The website basencloud.com

The public pages of basencloud.com (this policy, the terms, the support, account deletion, app and link pages) set no cookies and load no analytics, advertising or third-party scripts. The link page never reads, shows, stores or sends the code in the link from your battery's display. The staff dashboard on basencloud.com is for BasenGreen staff only and is not covered by this policy.

What we do not collect

• Camera images: the app uses the camera only to read the QR code on your battery's display. The image is processed on your phone; it is never stored or sent.
• Your location, contacts, photos, microphone, calendar or files. The app does not use Bluetooth.
• Advertising identifiers, analytics, crash-reporting or tracking tools. BasenCloud does not track you across apps or websites.
• Payment details: BasenCloud is free and has no purchases.

If you have allowed your phone to share diagnostics with app developers, Apple or Google may give BasenGreen anonymous crash reports under their own privacy policies.

Why we use your data and our legal bases

Where the EU or UK General Data Protection Regulation (GDPR) or a similar law applies, we rely on these legal bases:

• To create and run your account, sign you in, link batteries and show you their data, show your first name and shortened e-mail address on a linked battery's display, read a battery's BMS log when you ask, keep your battery names and settings, and send the notifications you allowed: because this is necessary to provide the service you asked for (performance of a contract).
• To keep BasenCloud, your account and the batteries secure: session records, abuse protection, the audit log and the investigation of misuse. Our legitimate interest is protecting our customers, the batteries and the service.
• To keep battery data and to monitor, support and update BasenGreen batteries: our legitimate interest in keeping the batteries safe, working and supported, for you and for later owners.
• To keep the link history after you delete your account, no longer connected to your name or e-mail address: our legitimate interest in knowing who had access to each battery and when.
• To answer your messages and contact you about your account or an important change to the service: to provide the service, and our legitimate interest in keeping you informed.
• To comply with the law, answer lawful requests from authorities, and establish or defend legal claims: our legal obligations and our legitimate interests.

Your phone asks for your permission before the app may use the camera or send notifications. You can withdraw that permission at any time in your phone's settings.

We do not make decisions about you based solely on automated processing, and we do not profile you.

Do you have to give us this data?

No. You can use guest mode without giving us anything. To use BasenCloud with your own battery you need an account, and we cannot create one without your e-mail address and either the ID of your Google or Apple account or a password. An account you create with your e-mail address also needs your first name and family name. Your name is used for the display and for support. Notifications, battery names, alarm acknowledgements and BMS log reads are optional.

Who receives your data

We do not sell or rent personal data, and we do not share it for advertising. Personal data is received only by:

• LYNX Technology, which develops and maintains BasenCloud for BasenGreen and may access the data to operate, maintain and repair the service;
• Contabo GmbH, Germany, which hosts the BasenCloud server and database in the European Union;
• the Expo push service of 650 Industries, Inc., USA, which receives the push token, the text of a notification and the technical details needed to deliver it (the battery ID and the notification type), and passes it on to Apple or Google;
• the Expo update service of 650 Industries, Inc., USA, which delivers updates of the app. Each time the app starts, also in guest mode, it asks this service whether a newer version is available. Expo then receives your phone's IP address, technical details of the installed app, such as its platform and version, and a random identifier that the app creates for this installation. It does not receive your name, e-mail address or account ID;
• Microsoft, whose Microsoft 365 e-mail service sends the codes and notices described under "Your account with an e-mail address" from no-reply@basencloud.com. It receives the address each e-mail goes to and the text of the e-mail;
• Apple, which provides Sign in with Apple and delivers notifications to iPhones and iPads through the Apple Push Notification service;
• Google, which provides Google sign-in and delivers notifications to Android phones through Firebase Cloud Messaging;
• authorised BasenGreen staff, who see customer accounts (name, e-mail address, sign-in methods, linked batteries, link history, and how many phones receive notifications) to give support and keep the batteries safe. Their access depends on their role, and their actions on customer accounts are recorded in the audit log;
• anyone at your battery's display, who sees your first name and shortened e-mail address while the battery is linked to your account;
• authorities, courts or other parties where the law requires it, or where it is necessary to protect the rights, safety or property of our customers, BasenGreen or others.

We require every service provider that processes personal data for us, including LYNX Technology, Contabo, Expo and Microsoft, to protect it at least as well as this policy and the law require, and to use it only to provide their service to us. The same applies to any company related to BasenGreen that is given access to your data. Apple and Google handle the data they receive for sign-in and notifications under their own privacy policies.

Cloudflare, Inc. provides the domain name service (DNS) for basencloud.com. It answers name lookups only; the traffic between the app, the website and our server does not pass through Cloudflare.

Apple (App Store) and Google (Google Play) distribute the app under their own terms and privacy policies. If BasenGreen's battery business is ever transferred to another company, your data may be transferred with it; we will tell you before that happens, and this policy will continue to protect it.

International transfers

The BasenCloud server and database are in Germany, in the European Union. BasenGreen is in China, and BasenGreen and LYNX Technology staff may access data from outside the European Union to support you and maintain the service. Expo's push and update services are in the USA, and Apple, Google and Microsoft process data in the USA and other countries.

Where the law requires a safeguard for such a transfer, for example when personal data from the European Economic Area, the UK or Switzerland goes to a country without an adequacy decision, we use one recognised by law, such as the European Commission's Standard Contractual Clauses. You can ask for a copy of these safeguards at support@basengreen.com.

How long we keep data

• Account data (name, e-mail address, sign-in details, and the one-way hash of your password if you have one): until you delete your account.
• App sessions, with their IP addresses and phone software descriptions: kept for 30 days after the session ends (when it expires, or when you sign out), and deleted with your account.
• Push tokens: until you sign out on that phone or delete your account. A token that Apple or Google reports as no longer valid is no longer used.
• Notification choices, the record of notifications sent, and alarm acknowledgements: until you delete your account.
• Battery names and location labels: until you unlink the battery or delete your account.
• The link history (which account linked or unlinked a battery, and when): kept as BasenGreen's record of access to each battery. When you delete your account, it stays but is no longer connected to your name or e-mail address.
• BMS log read requests (the battery, your account ID and the time): kept with the battery's record of operations. After you delete your account, they point to an account ID that is no longer connected to your name or e-mail address.
• Audit log: kept for as long as BasenGreen needs it for security and accountability. Entries about customers contain no name, no e-mail address, and no IP address or software details of a phone.
• Battery data: kept by BasenGreen for as long as it supports the battery. It is not deleted when you unlink the battery or delete your account, because it belongs to the battery.
• Link codes: 30 days after they expire. E-mail codes: they expire after 10 minutes and are deleted within a day. Abuse-protection counters: at most one hour.
• Server logs: they rotate automatically, so older entries are overwritten as new ones arrive. They are not included in backups.
• Backups: the database is backed up every day. Daily copies are kept for 14 days and weekly copies for 8 weeks, then erased. Data you delete therefore leaves the backups at the latest about 8 weeks later. Backups are used only to recover from a failure; if one is ever restored, we make sure that deleted accounts stay deleted.
• E-mails with our support: as long as needed to handle your request and any follow-up.

How we protect your data

• All traffic between the app, the website, the battery displays and our server is encrypted with TLS.
• Each display has its own credential, the server stores only a scrambled form of it, and a display can send data only about itself.
• Your sign-in is kept in your phone's secure storage (the iOS Keychain or the Android Keystore). Access tokens last 15 minutes and session tokens change every time they are renewed; the server stores only scrambled forms of session tokens.
• Every request for a battery's data checks that your account holds the battery's active link.
• Codes for linking a battery work once, expire after 5 minutes and are stored only as a scrambled fingerprint.
• A BasenCloud password is stored only as a one-way hash. The codes we e-mail you work once, expire after 10 minutes, stop working after 5 wrong tries and are stored only as a scrambled fingerprint.
• BasenGreen staff access depends on their role, and important staff actions are recorded in an audit log that cannot be changed.
• Backups are kept with restricted access.

No system is perfectly secure. If a security incident affects your personal data, we will inform you and the authorities as the law requires.

Your rights and choices

Depending on where you live, and in any case where the GDPR applies, you have the right to:

• get a copy of your personal data and information about how we use it;
• have incorrect data corrected;
• have your data deleted: delete your account in the app (Profile › Delete account), or see https://basencloud.com/account/delete;
• restrict how we use your data, or object to our use of it based on our legitimate interests;
• receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another company where this is technically possible;
• withdraw a permission you gave, such as for notifications, at any time, without affecting what was done before.

To use these rights, write to support@basengreen.com from the e-mail address of your BasenCloud account. We may ask you to confirm your identity before we act. We answer within one month; if a request is complex, we may extend this by up to two more months and will tell you why. We apply these rights to every user, wherever you live.

You can also complain to a data protection supervisory authority, in particular in the country where you live or work or where you think a breach happened. In the European Union you can find your authority through the European Data Protection Board (https://www.edpb.europa.eu); in the UK it is the Information Commissioner's Office (https://ico.org.uk). We would appreciate the chance to deal with your concern first.

Children

BasenCloud is not directed at children under 16, and you must be 16 or older to create an account. We do not knowingly collect personal data from children under 16. If you believe a child has created an account, write to support@basengreen.com and we will delete it.

Changes to this policy

We update this policy when the service or the law changes. The date at the top shows the current version. If a change significantly affects how we use your data, we will tell you in advance, for example in the app or by e-mail.

Contact

Shenzhen Basen Technology Co., Ltd., Shenzhen, China. E-mail: support@basengreen.com, for support, privacy questions and deletion requests.