Privacy Policy

Effective November 5, 2026

This policy explains what information Arcaro Labs LLC ("Basemode", "we", "us") collects, why, who we share it with, how long we keep it, and the choices you have. It covers our website, dashboard, API, MCP server, Figma plugin and shared docs pages (together, the "Service").

The short version: we collect what we need to sync your design tokens with your code, we encrypt the tokens you give us for Figma and GitHub, and we never sell anything or use your designs or code to train AI models.

What we collect

Account and organization

• Account details: your name, email address and a hash of your password (never the password itself). If you sign in with Google, we receive your name, email address and Google account ID. If your organization uses single sign-on, we receive the details your identity provider sends, usually your name and email.
• Security settings: your two-factor secret, stored encrypted, and recovery codes, stored as hashes.
• Organization details: its name, members, roles and invitations.
• Billing details: your plan, billing contact and subscription status. Card details go straight to Stripe, our payment processor; we never see or store your full card number.
• Activity: a log of actions in your organization, such as who connected a repository or made a key, with the time and, for sign-ins and security events, the IP address and browser.
• Messages: what you send us through the contact form or by email.

Design systems and connections

• Design tokens: the variables and styles we read from the Figma files you choose, or that the plugin sends: their names, values and modes, the file keys and versions, snapshots when something changes, and the history of changes.
• Connections: the tokens you give us for Figma and GitHub, stored encrypted, with the name of the account each belongs to. Your Slack webhook address, if you add one.
• Repository details: the repository and folder you choose, the files Basemode generates, the pull requests it opens, and adoption results that say where your tokens are used. To do this, Basemode reads the repository files it needs to compare generated code, find references to renamed tokens and measure adoption.
• Keys: design system keys and shared docs links, stored only as one-way hashes, with a short hint so you can tell them apart.

From our website

Our marketing site counts page views for our own use: the page's path, the referring site, and a count of visitors that can't identify anyone and resets every day. It uses no cookies and no advertising or third-party analytics trackers. If your browser sends Do Not Track or Global Privacy Control, we don't count the view at all. Like most websites, our servers record basic request information, such as IP address and browser, to run and secure the site.

The CLI and GitHub Action

The basemode command-line tool and our GitHub Action run on your own computer or in your own GitHub workflows. Used without a key, they send us nothing. Used with a design system key, they send us only what that sync needs.

Cookies

We use only the cookies the Service needs: a session cookie that keeps you signed in, and cookies that protect against cross-site attacks. Your browser may also store small preferences, such as light or dark mode. We don't use advertising cookies, and we don't track you across other sites.

How we use it

• To provide the Service: syncing tokens, generating code, opening pull requests, notifying your team, showing shared docs pages and answering coding assistants.
• To keep it secure: verifying sign-ins and keys, enforcing rate limits, and detecting misuse.
• To communicate: account and security emails, sync and pull request notices, trial and billing notices, and replies to your messages.
• To bill you and keep the records the law requires.
• To meet legal obligations and enforce our terms of service.

Where privacy laws ask for a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure and reliable service, your consent where we ask for it, and legal obligations.

We don't sell or rent personal information, we don't use it for advertising, and we don't use your designs, tokens or code to train AI models.

Who we share it with

• Connected services. We send to Figma, GitHub and Slack what each step needs: requests to read your Figma files, commits and pull requests to your repository, and messages to your Slack channel.
• People you share with. Anyone with a shared docs link can see the tokens on that page. Coding assistants using your key can read your design system.
• Service providers that help us run the Service, under contracts that limit their use of the data to the work they do for us:
  • Google Cloud, for hosting, our database, file storage and secrets management
  • Stripe, for payments
  • Our email delivery provider, for sending email
  • Google, if you choose to sign in with Google
• Arcaro Labs' own operations system, which receives counts of events such as sign-ups and subscriptions (not who made them), error summaries, and our marketing site's page views, so we can run the company's products.
• When the law requires it, or to protect the rights, safety and security of our users, the public or us. We'll push back on requests that are too broad, and tell the people affected where we're allowed to.
• In a business change, such as a merger or sale, where the new owner keeps the protections in this policy.

How long we keep it

• Design systems, their snapshots and history: until you delete the design system or your organization.
• Connections: until you remove them or your organization is deleted.
• Accounts: until you delete your account or your organization is deleted.
• Sessions: up to 30 days, or until you sign out.
• Notifications: 90 days.
• Activity log: 2 years, including after the organization it belongs to is deleted, so security incidents and disputes can still be looked into. Failed sign-ins and password reset requests, which record email and IP addresses, are kept for 30 days.
• Billing records: as long as tax and accounting law requires.

Deleted data may remain in encrypted backups for a limited time until they're replaced.

How we protect it

Figma, GitHub and Slack credentials are encrypted and never shown again, even to you. Keys, sessions and recovery codes are stored only as hashes. Traffic is encrypted in transit. Our security page explains more.

No system is perfectly secure. If a breach affects your information, we'll tell you without undue delay, as the law requires.

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. You also have the right not to be treated differently for using these rights.

You can update most details in the dashboard, remove connections, delete design systems, delete your account, or delete your organization. For anything else, email us. We'll respond within the time the law requires, and may need to confirm your identity first. If you're in the EU, UK or another region with a data protection authority, you can also complain to it.

California residents

This section is for California residents, under the California Consumer Privacy Act as amended (CCPA). In the last 12 months we have collected these categories of personal information, for the purposes in "How we use it":

• Identifiers: name, email address, IP address, account identifiers.
• Customer records and commercial information: billing contact, plan and subscription history. Card details are collected by Stripe.
• Internet activity: sign-ins and actions in the dashboard.
• Professional information: your organization and your role in it.
• Sensitive personal information: account sign-in credentials, used only to sign you in and keep your account secure.

We disclose these categories for business purposes only to the parties listed in "Who we share it with". We don't sell or share personal information for cross-context behavioral advertising, and haven't in the last 12 months. We don't use sensitive personal information for anything beyond what the CCPA allows, so the right to limit its use doesn't apply. We keep each category for the periods in "How long we keep it".

You may ask us to tell you what we collect, use and disclose about you; to delete it; and to correct it. You won't be treated differently for asking. To make a request, email us from the address on your account, or have an authorized agent email us with your written permission. We'll confirm your identity and answer within 45 days.

International transfers

We're based in the United States, and we and our service providers process information there and may process it in other countries. Where the law requires, we protect those transfers with safeguards such as the European Commission's Standard Contractual Clauses.

Children

The Service is for businesses and professionals. It isn't directed to children, and we don't knowingly collect information from anyone under 16. If you think a child has given us information, contact us and we'll delete it.

Changes to this policy

If we change this policy in a way that matters, we'll tell customers by email or in the dashboard before it takes effect, and update the date at the top.

Contact

Questions, requests or concerns about privacy:

Arcaro Labs LLC
hello@basemode.io