Privacy Policy

Last updated: 22 August 2026

This Privacy Policy explains how Baseline Labs ("Baseline Labs", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit baselinelabs.ai and markupschema.com (the "Sites") or use our products and APIs (the "Services"). It also describes the rights you have over your personal data and how to exercise them.

This document is provided for transparency and is pending final legal review. If anything here conflicts with a signed agreement between us, that agreement prevails.

This document is written in English. Translations into other languages are produced by machine and are provided for convenience only; they have not been reviewed by a lawyer. Where a translation differs from this English text, this English text governs.

1. Who we are

Baseline Labs provides generative-engine-optimisation (GEO) and structured-data tools that help businesses understand and improve how AI models and search engines represent them. For the purposes of the General Data Protection Regulation (GDPR) and the UK GDPR, Baseline Labs is the data controller for personal data processed through the Services. Baseline Labs is based in Galway, Ireland. You can reach us at info@baselinelabs.ai.

2. The data we collect

Information you provide

• Account data — your name, email address, and password (stored only as a salted hash) when you register.
• Social sign-in data — if you register or sign in with Google or GitHub instead of a password, that provider sends us your email address, whether the provider has verified it, and your display name (from GitHub, also your username). We never receive your password for that account. We store the provider name and your identifier with them so we can recognise you next time you sign in.
• Billing data — your subscription tier and the payment metadata returned by our payment processor. We never see or store full card numbers; card details are handled directly by Stripe.
• Content you submit — the domains, URLs, keywords, brand names, and study configurations you enter to run audits and reports.
• Support communications — the contents of messages you send us by email or through contact forms.

Information we collect automatically

• Usage and device data — pages viewed, actions taken, approximate location derived from IP address, browser and device type, and referring URLs.
• Analytics — we use self-hosted, cookieless Umami analytics and Google Analytics 4 to understand aggregate usage. See "Cookies and analytics" below.
• Session recordings — we run OpenReplay, a session-replay tool hosted on our own servers, which records how pages are used: clicks, scrolling, navigation and console errors. What you type into form fields is not recorded, and numbers shown on the page are obscured; email addresses displayed on a page are not. If you are signed in, the recording is tagged with your email address so we can reproduce a fault you report. Recordings stay on our infrastructure and are not shared with a third-party analytics provider. Session replay is off unless you accept the "Analytics" category in our cookie banner — until you do, the recorder is not even loaded.
• Logs — request logs and error logs that help us operate the Services securely and diagnose problems.

3. How we use your data

• To provide, maintain, and improve the Services and run the audits you request.
• To create and administer your account and process your subscription.
• To communicate with you about your account, security, service changes, and (where you have opted in) product updates.
• To monitor, secure, and troubleshoot the Services and prevent abuse.
• To comply with our legal obligations.

4. Legal bases for processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

5. Cookies and analytics

Umami is privacy-first and cookieless: it does not track you across sites and collects only aggregate, anonymised usage data. Google Analytics 4 may set cookies on your device. You can control cookies through your browser settings, and where consent is legally required we will only set non-essential cookies on that basis. Essential cookies (for example, your login session) are necessary for the Services to function.

6. Sharing and sub-processors

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, including:

We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety, and property of Baseline Labs, our users, or others.

7. International transfers

Our core application and database are hosted in the European Union. Some processing happens outside it, and we would rather say so than round it off. GPU inference — where the page content we crawl for you is analysed — runs on instances we rent through Vast.ai, which sit wherever capacity is available and are not pinned to a region, so they may be outside the EEA. Object storage (Cloudflare R2) is a globally distributed service, so crawled page content, screenshots, and generated schema may be held outside the EEA. Several of the sub-processors listed above are also established outside the EEA.

If you need the transfer safeguards that apply to a specific provider in writing, email info@baselinelabs.ai and we will send you what is in place.

8. Data retention

We keep personal data for as long as your account is active and as needed to provide the Services. Audit results and study data are retained until you delete them or close your account. We may retain certain records longer where required for legal, tax, security, or dispute-resolution purposes, after which the data is deleted or anonymised.

9. Your rights

Subject to applicable law, you have the right to access, correct, delete, or port your personal data; to restrict or object to certain processing; and to withdraw consent at any time. To exercise any of these rights, email info@baselinelabs.ai. Because we are based in Ireland, our lead supervisory authority is the Irish Data Protection Commission (DPC), dataprotection.ie. You can complain to the DPC, and you also have the right to lodge a complaint with the data-protection authority of the country where you live or work, or where you believe the problem occurred.

10. Security

We use technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), hashed passwords, access controls, and network isolation between services. No method of transmission or storage is completely secure, but we work continuously to protect your data.

11. Children

The Services are not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notifying you directly.

13. Contact us

Questions about this policy or your personal data? Email us at info@baselinelabs.ai.