BASIO — Architecture Copilot, a brand of cook up studio UG (haftungsbeschränkt). Last updated: October 3, 2026.
The controller within the meaning of the GDPR and the BDSG is:
cook up studio UG (haftungsbeschränkt)
Adolf-Kolping-Straße 3
66583 Spiesen-Elversberg
Germany
We process our users' personal data only within the legally permitted scope. BASIO is a SaaS platform for architecture competitions. When using our services, we collect data that is necessary for contract performance, the operation of the platform, and for legal requirements.
Hosting Provider
Our website basio.at is hosted by IONOS SE. Provider: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.
Server location: Germany. Data is processed exclusively on servers within the Federal Republic of Germany and therefore within the EU; no transfer to a third country takes place in connection with hosting.
With every page visit, the following data is automatically transmitted and temporarily stored in server log files:
Legal basis: Art. 6(1)(f) GDPR
Server log files are deleted after 30 days. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.
IONOS privacy policy: ionos.de/terms-gtc/datenschutzerklaerung
Our website uses cookies (small text files stored on your device). On your first visit, you are asked via a cookie consent banner for your consent to the categories Statistics and Marketing; you can change your selection at any time via the "Cookie Settings" link in the footer.
Technically necessary cookies
For basic functions of the website. Legal basis: Art. 6(1)(f) GDPR
Payment cookies (Stripe)
Technical cookies for fraud prevention. Legal basis: Art. 6(1)(b) GDPR
Marketing cookies (Meta Pixel)
We use the Meta Pixel of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (when processed by the US parent company: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA). The Meta Pixel measures the effectiveness of our advertisements, enables the creation of target audiences for ad placements, and evaluates visitor behavior on our website. In doing so, data such as pages visited, interactions, and technical information (including IP address, device and browser data) may be collected and linked to your Facebook/Instagram account, if you are logged in there. The Meta Pixel is loaded only after your active consent via the cookie banner; without consent, no data is transmitted to Meta. Further details can be found in section 14 "Meta Pixel".
Legal basis: Art. 6(1)(a) GDPR (consent)
Third-country transfer: EU-US Data Privacy Framework or Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR
Withdrawal: You can withdraw your consent at any time with future effect via the "Cookie Settings" link in the footer.
Meta privacy policy: facebook.com/privacy/policy · Information on the Pixel: Meta Business Help Center
Statistics cookies (Google Analytics)
We use Google Analytics (Google tag, GA4) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (when processed by the US parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics enables statistical analysis of website usage, including page views, time spent, and visitor origin, in order to tailor our offering to demand. In doing so, technical information (including a shortened IP address, device and browser data, usage behavior) is collected and evaluated in pseudonymized form. The Google tag is loaded only after your active consent via the cookie banner; without consent, no data is transmitted to Google. Further details can be found in section 13 "Google Analytics".
Legal basis: Art. 6(1)(a) GDPR (consent)
Third-country transfer: EU-US Data Privacy Framework or Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR
Withdrawal: You can withdraw your consent at any time with future effect via the "Cookie Settings" link in the footer.
Google privacy policy: policies.google.com/privacy · Information on Google Analytics: Google Support
Cookie settings can also be adjusted in your browser at any time.
Platform
The BASIO application is operated on Base44 infrastructure. The platform provider is Base44, Inc. (a company of Wix.com Ltd., Israel). Application data is stored and processed in the USA via Base44's sub-processors (including MongoDB, Inc. – database; Render Services, Inc. – servers; Supabase, Inc. – media; Twilio Inc./SendGrid – email delivery of the app; Datadog, Inc. – logging). AI functions are provided via Base44's AI access (see "AI processing"). Transfers are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses; for Israel there is an adequacy decision by the EU Commission.
Registration data
Email address, name (optional), password (encrypted), subscription plan or pass, and payment status. Legal basis: Art. 6(1)(b) GDPR.
Usage data in the app
Project data (competition briefs, plans, architecture documents, analyses, concepts, visualizations) is stored in your account and processed solely to provide the service. You may delete your account at any time: info@basio.at
Teams
If you use BASIO in a team (Studio or Office plans, or a pass with several users), projects created in the team are visible to and editable by all active team members. Team members' names and email addresses are visible within the team. The team is managed by the paying account, which can invite and remove members. Legal basis: Art. 6(1)(b) GDPR.
BASIO-GPT (chat in the app)
Your questions to BASIO-GPT and the answers are stored per user and project so that you can continue the history in later sessions. The history is visible only to you, and not to other members even within a team. You can remove it at any time via "Delete history"; otherwise it is deleted together with your account. No history is stored in the demo access. Legal basis: Art. 6(1)(b) GDPR.
AI processing
For analysis, extraction, text and images, BASIO uses AI models that are accessed exclusively via Base44's AI access (AI Gateway): language models from Anthropic, PBC, OpenAI, L.L.C. and Google (Gemini) for analysis, requirement and geometry extraction and text; AI images (visualizations) are generated with image models from Google (Gemini) and labeled as AI-generated in the app. Inputs (e.g., uploaded documents, text queries, chat messages) are transmitted to these providers for processing. We do not use your data to train AI models. Please do not enter any sensitive personal data. Legal basis: Art. 6(1)(b) GDPR.
Third-country transfer: Anthropic, PBC, OpenAI, L.L.C. and Google LLC (USA) – EU-US Data Privacy Framework or Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, see also section 20.
For location search, maps, aerial images, terrain, buildings and cadastre, BASIO retrieves freely available official and open geodata, including from the Federal Agency for Cartography and Geodesy (basemap.de), basemap.at, the Federal Office of Metrology and Surveying (BEV), swisstopo, the state surveying authorities and OpenStreetMap services. You will find the full overview with licences in the app under "Help → Data sources & licences".
In doing so, the address or coordinates of the project location are transmitted to these services. When map tiles are loaded, your browser connects directly to the servers of the respective providers; your IP address is transmitted in the process. The providers are independently responsible for this processing. For providers in the United Kingdom (including the OpenStreetMap Foundation), there is an adequacy decision by the EU Commission.
Legal basis: Art. 6(1)(b) GDPR (provision of the service) or Art. 6(1)(f) GDPR (legitimate interest in displaying map material).
Provider
Stripe Payments Europe, Limited
1 Grand Canal Street Lower, Grand Canal Dock
Dublin, D02 H210, Ireland
Data processed
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Third-country transfer: EU-US Data Privacy Framework + Standard Contractual Clauses Art. 46(2)(c) GDPR
Privacy policy: stripe.com/privacy
Retention period for payment and invoice data: 10 years (§ 147 German Fiscal Code)
After purchase
After a purchase is completed, the BASIO application securely transmits the purchase data (name, email address, company, billing address, product purchased, amount, time) to our automation (n8n, on servers of IONOS SE in Germany). It updates your customer status in HubSpot and sends the welcome email with your access information via Brevo. Legal basis: Art. 6(1)(b) GDPR.
Legal basis: Art. 6(1)(b) and (c) GDPR
System emails are sent for:
System emails of the app are sent via Base44 (Twilio/SendGrid); emails relating to purchase, waitlist, demo access and feedback are sent via our automation (n8n) and Brevo.
Legal basis: Art. 6(1)(b) GDPR
BASIO offers an optional integration with Microsoft 365. It is only activated if you connect your Microsoft account yourself in the settings; without this connection, no data is transmitted to Microsoft.
Provider
Microsoft Ireland Operations Limited
One Microsoft Place, South County Business Park, Leopardstown
Dublin 18, D18 P521, Ireland
Connection process
The connection is established via Microsoft's authorization procedure (OAuth 2.0). You log in directly with Microsoft and grant BASIO the permissions you approve. Your Microsoft password is never transmitted to us or stored by us. Only the access and refresh tokens, as well as the identifier of your Microsoft account, are stored to maintain the connection.
Data processed
Purpose
Transfer of deadlines and appointments to your Outlook calendar, as well as tasks and briefings to Outlook or Microsoft Teams. The transfer occurs only upon your explicit action (clicking the respective synchronization function) and includes only the content selected at that time.
Legal basis
Art. 6(1)(a) GDPR (consent by connecting the account and triggering synchronization) as well as Art. 6(1)(b) GDPR (performance of the usage contract).
Withdrawal and deletion
You can disconnect the connection at any time in BASIO's settings and additionally revoke the granted permission in your Microsoft account. After disconnecting, the stored tokens are deleted without delay. Content already transferred to Outlook or Teams remains in your Microsoft account and is subject to the responsibility of Microsoft or your organization; it must be deleted separately there if needed.
Microsoft privacy statement: privacy.microsoft.com
For the contact form, the test access form, and the waitlist on basio.at, we use n8n: self-operated automation software running on servers of IONOS SE in Germany (data processing agreement with IONOS). This forwards the entered data to HubSpot (CRM) for customer management and to Brevo for sending confirmation emails.
Data processed
HubSpot (CRM)
Provider: HubSpot Ireland Limited, One Sir John Rogerson's Quay, Dublin 2, Ireland. Purpose: management of contact and lead data, tracking of inquiries and sales processes (including company, contact person, inquiry history, sales opportunities).
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures/contract performance) or Art. 6(1)(f) GDPR (legitimate interest in customer management and sales)
Third-country transfer: Our contract partner is HubSpot Ireland Limited (EU). When processed by the US parent company HubSpot, Inc.: Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
HubSpot privacy policy: legal.hubspot.com/privacy-policy
Brevo (email delivery)
Provider: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Purpose: sending confirmation and transactional emails (including test access delivery, purchase confirmations, waitlist confirmation). Brevo processes the data within the EU; no transfer to third countries takes place.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures/contract performance)
Brevo privacy policy: brevo.com/legal/privacypolicy
Retention period
Contact and CRM data is stored for as long as a legitimate interest in the customer relationship or inquiry processing exists, but no longer than until your deletion request; thereafter any statutory retention periods apply (see section 24). Providing this data is voluntary; without a name and email address, we cannot respond to your inquiry or provide test access.
If you sign up for the BASIO waitlist, we process your name, email address, optionally your office name, as well as the timestamps of your registration and confirmation. You will first receive an email containing a confirmation link; only after clicking it will you be added to the waitlist (double opt-in). The purpose is to inform you about the market launch of BASIO and to send you a personal access code. The legal basis is your consent (Art. 6(1)(a) GDPR); logging the confirmation serves as proof of consent (Art. 7(1) GDPR). We use n8n (on IONOS SE servers), HubSpot, and Brevo. Unconfirmed registrations are deleted after 30 days at the latest. At market launch, confirmed waitlist contacts receive a personal access code for the Partner Pass by email. The code is stored together with your email address in the BASIO application (Base44) so that it can be verified that it is redeemed only once and only by you. You may withdraw your consent at any time with future effect by emailing info@basio.at.
Contact form
For inquiries via the contact form, we process name, email address, office name, your message where applicable, and the campaign parameters (UTM parameters) through which you reached our website. Legal basis: Art. 6(1)(b) GDPR (initiating a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering your inquiry).
Demo access
You can request free demo access via the "Test access" form. For this we process name, email address, office name, position, your confirmation of the privacy policy and the campaign parameters. You will receive a personal link by email to read-only access to an example project. In the BASIO application we store an access key, your email address, the number of visits and the time of the last visit. The demo access is a shared read-only account; your inputs in the limited demo chat are transmitted to the AI providers for answering (section 5) but are not stored. Legal basis: Art. 6(1)(b) GDPR.
Interest scoring
In our emails to prospective customers, we record via Brevo whether an email was opened and whether any contained links were clicked, as well as whether the demo access was used. We combine this information into an internal interest score to prioritize inquiries according to need. No automated decision within the meaning of Art. 22 GDPR takes place. Legal basis: Art. 6(1)(f) GDPR. You can object to this analysis at any time by emailing info@basio.at.
Follow-up emails only with consent
We send further emails with information about BASIO (e.g., reminders, notes on features and offers) only if you have expressly consented in the form. Each of these emails contains an unsubscribe link; you can withdraw your consent at any time with effect for the future. Legal basis: Art. 6(1)(a) GDPR, section 7(2) no. 2 of the German Unfair Competition Act (UWG).
We invite Partner Pass holders by email (via n8n and Brevo) to give voluntary feedback, at most twice during the term, as well as to an optional closing conversation. Feedback responses are stored in the BASIO application (Base44). For evaluation, we use an AI model from Anthropic (Claude) to create a summary for the further development of BASIO. Participation is voluntary and has no influence on your access. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the product).
With your consent, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to statistically evaluate the use of our website. This involves processing, among other things, pages visited, time spent, device and browser information, and a shortened IP address. Processing by Google LLC in the USA is possible; it takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (German Telecommunications-Digital-Services-Data-Protection Act). A data processing agreement is in place with Google. You may withdraw your consent at any time via the cookie settings.
With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland, to measure the effectiveness of our ads and to optimize advertising. We and Meta are joint controllers for the collection and transmission of data to Meta (Art. 26 GDPR). We have entered into an agreement with Meta on joint controllership (Controller Addendum). Under this agreement, we are responsible for informing users; Meta is responsible for handling data subject rights regarding the data stored by Meta. Subsequent processing by Meta takes place under Meta's own responsibility. Information on data processing by Meta, including the legal basis and your rights, can be found at facebook.com/about/privacy. Transfer to Meta Platforms, Inc. in the USA is possible (EU-US Data Privacy Framework or Standard Contractual Clauses). Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Withdrawal at any time via the cookie settings.
For internal notifications about new confirmed waitlist registrations, we use the WhatsApp Business Platform of WhatsApp Ireland Limited or Meta Platforms Ireland Limited. This involves transmitting name, email address, and, where applicable, office name. Processing in the USA is possible (EU-US Data Privacy Framework or Standard Contractual Clauses). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in timely processing). A data processing agreement is in place with WhatsApp.
We maintain company pages on Instagram, Facebook, and LinkedIn. For the evaluation of page statistics (Insights), we are joint controllers together with the respective provider (Art. 26 GDPR): Meta Platforms Ireland Limited (Facebook, Instagram) or LinkedIn Ireland Unlimited Company (LinkedIn). The providers assume primary responsibility for the processing and for data subject rights. Further information can be found in the providers' privacy policies. Legal basis: Art. 6(1)(f) GDPR.
For email communication, documents, and calendars, we use Google Workspace (Google Ireland Limited) and Microsoft 365 (Microsoft Ireland Operations Limited). Processing in the USA is possible (EU-US Data Privacy Framework or Standard Contractual Clauses). Data processing agreements are in place with both providers. Legal basis: Art. 6(1)(b) and (f) GDPR.
For booking demo appointments, we use Calendly. Provider: Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA.
The booking window is only loaded when you actively open the appointment booking. When it is opened, a connection to Calendly's servers is established and your IP address is transmitted.
Data processed
Purpose
Scheduling, managing, and sending reminders for consultation and demo appointments.
Legal basis
Art. 6(1)(b) GDPR (carrying out pre-contractual measures at your request).
Calendly privacy policy: calendly.com/privacy
Our website includes an AI-powered support chat that runs on Base44's infrastructure. The chat answers questions about the product, features, and pricing based on a knowledge base we provide.
Data processed
Purpose
Answering questions about the service and improving our informational offerings.
Legal basis
Art. 6(1)(f) GDPR (legitimate interest in efficient user support) or Art. 6(1)(b) GDPR for pre-contractual inquiries.
Important notice
Please do not enter any personal or confidential data in the support chat (in particular no special categories of personal data under Art. 9 GDPR, no login credentials, and no confidential project documents). Use of the chat is voluntary; alternatively, you can reach us by email at info@basio.at or via the contact form.
The website is hosted exclusively on servers in Germany (IONOS SE). Transfers to third countries take place with the following services:
Free information about stored data.
Correction of inaccurate data.
Deletion of data, provided no retention obligations apply.
Restriction of data processing.
Receive data in a machine-readable format.
Object on grounds relating to your particular situation.
Consent may be withdrawn at any time.
Complain to the competent supervisory authority.
Competent supervisory authority
Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany
Contact to exercise your rights: info@basio.at
We employ technical and organizational security measures. Data transmission is encrypted via TLS/SSL. The website is hosted in Germany (IONOS SE). The BASIO application is operated via Base44 (see section 5 "Registration and User Account"). Security measures are continuously improved.
Processors (Art. 28 GDPR)
Independent controllers
Stripe Payments Europe Limited (for payment processing, fraud prevention, and statutory obligations).
Providers of the map and geodata services (section 5a).
Joint controllers (Art. 26 GDPR)
Meta Platforms Ireland Limited (Meta Pixel, Facebook/Instagram pages), LinkedIn Ireland Unlimited Company (LinkedIn page).
Agreements pursuant to Art. 28 GDPR are in place with all processors; an agreement pursuant to Art. 26 GDPR is in place with Meta.
We reserve the right to update this privacy policy. In the event of material changes, we will inform you by email.
Last updated: October 3, 2026 · cook up studio UG (haftungsbeschränkt) · Moritz Koch · info@basio.at