BaselinePrivacy & Cookie Notice
Last updated: June 18, 2026
Who we are
Baseline provides a platform for authoring rubrics and evaluating AI outputs. Baseline is the data controller for the personal data described here. Our governing law and place of establishment is Washington, DC, United States. If you have any questions or want to exercise your rights, contact us at support@baseline.ai.
What we collect and why
- Account data — your email, name, and organization memberships, so we can authenticate you and provide the service. Legal basis: performance of our contract with you.
- Content you create — rubrics, datasets, evaluation runs, and related data you enter. Legal basis: performance of our contract with you.
- Billing data — subscription and payment identifiers, processed through Stripe. Legal basis: performance of our contract and compliance with legal obligations.
- Product analytics & error monitoring — usage events, device/browser information, and error reports. Legal basis: your consent, collected via the cookie banner. These are off until you accept, and you can withdraw consent at any time.
How long we keep it
We retain account and content data for as long as your account is active, and delete or anonymize it after you close your account, subject to any retention we must keep for legal, tax, or fraud-prevention reasons. Analytics data is retained according to each analytics provider's standard retention windows.
Your rights
You can access, correct, export, or erase your personal data. You can export your data or permanently delete your account at any time from Settings → Account. Depending on where you live, you may also have the right to restrict or object to processing, or to lodge a complaint with your local data-protection authority. To make any other request, email support@baseline.ai.
Cookies
We use a small number of cookies. Strictly-necessary cookies are required to run the service and are always active. Analytics cookies are only set after you accept them in the banner — you can decline without losing any functionality.
| Cookie | Category | Purpose |
|---|---|---|
| sb-*-auth-token | Strictly necessary | Keeps you signed in (Supabase authentication session). |
| active_org | Strictly necessary | Remembers which organization you're currently working in. |
| analytics_consent | Strictly necessary | Remembers your cookie choice so we don't ask again. |
| ph_* | Analytics | PostHog product-analytics cookies — set only after you accept. |
| _ga | Analytics | Google Analytics cookies — set only after you accept. |
| _ga_* | Analytics | Google Analytics cookies — set only after you accept. |
You can change your analytics choice at any time: .
Subprocessors
We rely on the third-party services below to operate Baseline. Each processes personal data on our behalf under a data-processing agreement. The analytics subprocessors run only after you consent.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Authentication and primary application database hosting | Email address, name, organization memberships, and the data you create in the app | United States |
| Stripe | Subscription billing and payment processing | Billing contact, subscription identifiers, and payment details (card data is held by Stripe, never by us) | United States / EU |
| Resend | Transactional and run-result email delivery | Recipient email address and message content | United States |
| PostHog | Product analytics and error monitoring to understand how features are used and to debug failures | Product usage events, error reports, device/browser information, and IP address (profiles are created only for identified users) | United States |
| Vercel | Application hosting and request execution for the Baseline web app | All data processed by the application while serving a request, including account, content, and billing data | United States |
| Fly.io | Background compute for evaluation runs and optimization runs | Rubric and prompt content, dataset rows, and evaluation results processed while a run executes | United States |
| Anthropic | LLM inference for evaluation and optimization runs, including the default judge and reflection models when a Team has not connected its own key | Prompt content and the model outputs generated or scored during a run | United States |
| OpenAI | LLM inference for evaluation and optimization runs when a Team connects its own OpenAI key | Prompt content and the model outputs generated or scored during a run | United States |
| LLM inference for evaluation and optimization runs when a Team connects its own Google key | Prompt content and the model outputs generated or scored during a run | United States | |
| Mistral | LLM inference for evaluation and optimization runs when a Team connects its own Mistral key | Prompt content and the model outputs generated or scored during a run | European Union |
International transfers
Some of our subprocessors are located in the United States. Where personal data is transferred outside your region, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Changes to this notice
We may update this notice from time to time. When we make material changes, we'll update the "last updated" date above and, where appropriate, notify you in the app.