Effective date: October 11, 2026
Who we are
Base Workshop is a trade name of Base Capital Group, LLC. We are an Ohio-based company, and our business and the handling of your data are governed by the laws and regulations of Ohio and the United States of America. Throughout this policy, “we,” “us,” and “our” refer to Base Workshop and Base Capital Group, LLC.
We build and operate online software applications.
This policy applies by default to all apps we build and operate, including any we launch in the future. It currently contemplates the following apps in particular:
Secret Santa Picker — Generates gift exchange matches and notifies participants of who they drew.
Insurance Company Simulator — A game that lets users run a simulated insurance company and save their results.
What data we collect
We collect only the information needed to run each app.
All apps
Collected automatically: Your IP address is recorded by our hosting provider and used for rate limiting and abuse prevention. Cloudflare Turnstile processes a browser challenge to verify you are not a bot.
For rate limiting, our apps also store a one-way hash (SHA-256) of your IP address, along with hourly request counts, in our database. The raw IP address is not stored there.
Secret Santa Picker
Provided by the organizer: Participant names (required), participant email addresses (optional), group assignments (optional), and the organizer’s own name and email address (required at the time of sending notification emails).
Insurance Company Simulator
Provided by the host: Your email address, the names of players or participants you enter into a simulation, and the simulation results you save.
How we use your data
Each piece of data serves a specific purpose:
All apps
IP addresses are used to enforce rate limits and prevent abuse of the apps. We do not use IP addresses for tracking or profiling.
We do not sell, rent, or trade personal data to any third party. We do not send marketing emails, newsletters, or promotional content. The only emails we send are those needed to provide the apps, such as Secret Santa match notifications requested by an organizer and emails related to your use of the Insurance Company Simulator.
Secret Santa Picker
Names and groups are used to generate Secret Santa matches, ensuring members of the same group are not paired together.
Email addresses are used to send a one-time notification email to each participant revealing who they drew. Emails are only sent when the organizer explicitly triggers sending.
Organizer name and email are included in the notification emails so recipients know who organized the exchange and how to reach them.
Insurance Company Simulator
Email address is used to associate you with your saved results and to send you emails related to your use of the Insurance Simulator.
Participant names and saved results are used to run your simulations and let you return to the scenarios you have saved.
Legal basis for processing
For users in the European Economic Area (EEA), we process personal data under the following legal bases:
Performance of a contracted service — When you use the Insurance Simulator, processing your email address, participant names, and saved results is necessary to provide the service you have requested.
Legitimate interest — Processing is necessary to provide the Secret Santa matching and notification service that the organizer has chosen to use, and to keep all apps secure through rate limiting and bot protection.
User responsibility — When you enter other people’s names or email addresses into either app, you are responsible for having permission to share that information with us for that purpose. By using the apps, you confirm you have this permission.
Who has access to your data
We use a small number of infrastructure providers to operate the apps. Each processes data only as needed to perform their function:
Vercel (United States) — Hosts the apps and serves web requests.
Neon (United States) — Default database host for all of our apps. All Insurance Company Simulator data is stored in Neon, and Secret Santa Picker draw data may be stored in Neon.
Microsoft Azure (United States) — Hosts a database used by the Secret Santa Picker. Secret Santa Picker draw data may be stored in Azure or in Neon.
Google Gmail (United States) — Delivers emails from apps on our behalf.
Cloudflare (United States) — Provides DNS resolution and bot protection via Turnstile for both apps.
We do not share personal data with any other third parties, advertisers, or data brokers.
Data retention and deletion
Data you enter into our apps is retained unless you delete it through the app's delete function, or request deletion via email.
You may request deletion of your data from either app at any time by emailing us at baseworkshop.app@gmail.com. Include the app name, date you used it, and any other identifying details with your request. We will process deletion requests within 90 days.
Children’s privacy
Our apps are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child’s information has been submitted through our apps, please contact us at baseworkshop.app@gmail.com and we will promptly delete it.
Security
We take reasonable measures to protect personal data from unauthorized access, loss, or misuse. Data is encrypted in transit using HTTPS/TLS. Database connections use encrypted authentication. API endpoints are protected by rate limiting and bot detection. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Changes to this policy
We may update this privacy policy from time to time, including when we launch new apps. Changes will be posted on this page with an updated effective date. We encourage you to review this page periodically. Your continued use of the apps after any changes constitutes acceptance of the updated policy.
Contact us
For any privacy-related questions or requests, you can reach us at baseworkshop.app@gmail.com.