Privacy Policy by Basecamp

BasecampUpdated 17 Oct 2025

This Privacy Policy outlines how 37signals LLC collects, uses, secures, and discloses user data across its various products like Basecamp and HEY. It details the types of information gathered, user rights regarding their data, and practices concerning data retention and international transfers. The policy emphasizes that user data is never sold and explains the company's approach to legal requests for information.

Other names:Data Protection PolicyGDPR PolicyPrivacy Notice

Privacy Policy

Last updated: April 20, 2023

The privacy of your data—and it is your data, not ours!—is a big deal to us. In this policy, we lay out: what data we collect and why; how your data is handled; and your rights with respect to your data. We promise we never sell your data: never have, never will.

This policy is split into sections. For your convenience, links to each of those sections is as follows:

Privacy policy

What we collect and why

When we access or disclose your information

Your rights with respect to your information

How we secure your data

What happens when you delete content in your product accounts

Data retention

Location of site and data

When transferring personal data from the EU

Changes and questions

This policy applies to all products built and maintained by 37signals LLC including Basecamp (all versions), HEY, Highrise, Campfire, Backpack, Ta-da List, and Writeboard (together, "37signals"). If you are applying for a job at 37signals, please review our Recruitment Privacy policy.

This policy applies to our handling of information about site visitors, prospective customers, and customers and authorized users (in relation to their procurement of the services and management of their relationship with 37signals). We refer collectively to these categories of individuals as "you" throughout this policy.

However, this policy does not cover information about a customer’s end users that 37signals receives from a customer, or otherwise processes on a customer’s behalf, in connection with the services provided by 37signals to the customer pursuant to an applicable services agreement (including the content of messages of customer end users ("End User Communications")). 37signals processes End User Communications under the instructions of the relevant customer, which is the "data controller" or "business" (or occupies a similar role as defined in applicable privacy laws), as described in the applicable services agreement between such customer and 37signals. 37signals’s obligations as a "data processor" or "service provider" with respect to such information are defined in such services agreement and applicable data protection addendum and are not made part of this policy.

If you are a customer’s end user and you have questions about how your information is collected and processed through the services, please contact the organization who has provided your information to us for more information.

If you are a California resident, please click here to see our California Notice at Collection, which includes additional disclosures as required by California law.

What we collect and why

Our guiding principle is to collect only what we need. Here’s what that means in practice:

Identity and access

This is a preview. The full template is free on GitLaw.

5.0 out of 5 on Google

Read reviews

As seen in

Law360
Artificial Lawyer
Insider
Axios Pro
San Francisco Business Times
Built In
Startups Magazine
Business Reporter
Tech.eu

United States note

This version is drafted for US law generally. Contract, employment and consumer rules vary by state — for example on non-competes and at-will employment. Tell GitLaw which state applies and it adjusts the draft.

Jurisdiction
United States of America
California (US)
European Union
Document info
HTML document. Document created on Thu Sep 11th, 2025. Last updated on Fri Oct 17th, 2025.
This document is public
Licensed under CC BY 4.0 (Attribution).
Come to agreements faster
Write, review, negotiate, and manage legal contracts
Related documents
European Union
Content Moderation Practices by Mozilla
This document outlines how an organization manages content moderation for user-generated text, images, and software applications. It specifies the human-led review process for reports of illegal or policy-violating content and the subsequent appeals procedure for both reporters and account holders.
Updated 13 Aug 2026
England & Wales
Firefox Focus and Firefox Klar Privacy Notice by Mozilla
This privacy notice explains how a browser developer processes technical, interaction, and browsing data. It details user rights under data protection laws and provides options for managing data collection and search preferences.
Updated 13 Aug 2026
Denmark
Privacy Policy (Denmark) by Seedsummit
This internal data protection policy establishes how a company manages personal information in compliance with the EU General Data Protection Regulation. It defines processing principles such as data minimization and storage limitation, and outlines the responsibilities of a designated IT systems administrator in Denmark.
Updated 13 Aug 2026
US
VPN Privacy Notice by Mozilla
This privacy notice explains how a VPN service handles user data, encryption, and third-party sharing. It details the collection of account info, approximate location via IP address, and limited billing details from providers like Stripe or Apple.
Updated 13 Aug 2026
US
Security Policies Coordinated Disclosure Of Security Vulnerabilities (GitHub)
This policy establishes a framework for security researchers to find and report vulnerabilities in a company's software. It introduces a bug bounty program that offers financial rewards for coordinated disclosure and provides links to specific legal safe harbor terms.
Updated 13 Aug 2026
US
Firefox OS Privacy Notice by Mozilla
This privacy notice explains how an operating system handles user data related to updates, location services, and device activation. It outlines user options for disabling data sharing for app usage and search engine analytics directly within device settings.
Updated 13 Aug 2026

Frequently asked questions

A template isn't binding on its own - like any contract, it becomes binding once it's properly completed and signed. Templates in our curated library are professionally drafted for US or UK law; review any template before you sign it.

Yes. Chat with GitLaw to edit any section, or make changes directly in the editor.

Yes, read about team plans here.

Describe what you need in the chat and GitLaw will draft it for you.

Templates in our curated library are professionally drafted for US or UK law. The wider library comes from the GitLaw community and public sources - a solid starting point, but check any template fits your situation before you rely on it.

Mostly US and UK law. Some templates use general commercial terms that work across jurisdictions, and many note which law they're written for.

It depends on the situation. Templates work well for routine business agreements. For anything involving significant money, complex IP, employment, or areas you're unsure about, it's worth getting professional advice before you sign. GitLaw provides templates and tools, not legal advice.

Open any template in GitLaw and describe the change you want in the chat — 'make clause 4 mutual' or 'add a 30-day notice period', for example. GitLaw drafts the revised language and shows it as a suggested edit. You accept, reject, or keep editing from there.

Yes. Upload a Word, PDF, or Markdown file and GitLaw will open it in the editor. You can review, edit, or chat with GitLaw about it the same way you would with any template from the library.

Trusted by 5,000+ businesses

Nexus logoMlabs logoTechstars logo

From template to signed, in one place

Every template opens in an editor with an AI agent alongside it.

1

Open

Pick a template and open it. Nothing to download, and no credit card to start.

Free to open

2

Edit with AI

Describe your situation in chat and the agent adapts the wording, clause by clause.

Tracked changes you can review

3

Send and sign

Share it for negotiation, then collect signatures without leaving GitLaw.

eSign included

Built for your legal work,
with practicing lawyers

Trained on 5,500+ clauses and specialist areas of law. Built with a standards committee of independent lawyers.

As seen in

Law360
Artificial Lawyer
Insider
Axios Pro
San Francisco Business Times
Built In
Startups Magazine
Business Reporter
Tech.eu

Ready to get started?

No sales calls, no credit card. Just chat with GitLaw.

GitLaw provides templates and tools, not legal advice. Templates are a starting point, not a substitute for advice on your situation - for anything significant, speak to a qualified lawyer.