Privacy Policy

1. Who we are

SageBase is operated by Welfana Business System, a sole proprietorship registered in Malaysia (Suite 29-7, Dua Sentral Suite, 8 Jalan Tun Sambanthan, 50470 Kuala Lumpur, Malaysia). We provide a multi-tenant, AI-powered knowledge base platform that lets organisations upload documents, author wiki pages, and query their content with AI (“the Service”).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the choices you have. It applies to the SageBase web application and our website.

2. Data we collect

We collect and process the following categories of data:

• Account data — your name, email address, password (stored as a one-way hash, never in plain text), and role within your organisation.
• Organisation data — your organisation’s name and configuration.
• Your Content — the documents, wiki pages, files, and media you upload or author, together with the semantic embeddings generated from them.
• Query data — the questions you ask in AI chat and the responses generated, including citations to your sources.
• Usage data — search activity, API calls, AI token usage for billing, and technical logs required to operate and debug the Service.
• Billing data — payment references and invoice details. Full card details are processed by our payment providers and are never stored on our servers.
• Technical data — IP address, browser type, and device information.

3. How we use your data

• To provide, operate, and maintain the Service, including ingesting and indexing your documents.
• To generate AI answers. Your queries and relevant content are transmitted to our AI model provider for processing; responses are returned to you.
• To authenticate users and enforce access control between tenants.
• To bill you accurately and manage subscriptions and invoices.
• To send service-related notifications.
• To improve the Service, diagnose faults, and keep it secure.
• To comply with legal obligations and respond to lawful requests.

4. How data is shared

We do not sell personal data. We share data only as necessary to operate the Service:

• AI model providers — your queries and relevant content are transmitted to our AI provider(s) for processing and embedding. These providers act as our processors.
• Google — when you sign in with Google, we receive your name and email address via Google’s OAuth service.
• Cloud storage providers — including Cloudflare R2, which stores your uploaded files on our behalf.
• Payment processors — for payments and subscriptions.
• Infrastructure providers — cloud hosting and database services that store your data on our behalf.
• Law enforcement or regulators — where required by law, court order, or to protect our rights and users.

5. Data retention

We retain account and organisation data for as long as your account is active. Your Content and query data are retained for as long as needed to provide the Service and for legitimate business purposes such as billing and dispute resolution. You may delete data through the application at any time; deleted data is removed from our systems within a reasonable period, except where we are required to retain it by law.

6. Data security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), hashed passwords, tenant isolation so that one organisation’s data is not visible to another, and role-based access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your role as a data controller

For the personal data contained in your content (for example, personal data in documents you upload), you are the data controller and SageBase acts as a data processor on your behalf. You are responsible for ensuring you have a lawful basis for that data and for providing your own privacy notice where required, including under Malaysia’s Personal Data Protection Act 2010 (“PDPA”) where it applies.

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at support@sagebase.net.

9. Cookies, local storage and product analytics

Our web application uses local storage to keep you signed in (authentication tokens) and to remember your preferences. We do not use third-party advertising cookies. You can clear local storage through your browser settings at any time, though this will sign you out.

Product analytics. We use a self-hosted, privacy-focused analytics tool to understand how the application is used, so we can find and fix broken screens. It records page views and the routes you visit inside the app, tied to a pseudonymous identifier rather than your identity. This helps us answer questions like “which screens do people abandon” without profiling individuals.

Session replay (off by default). We can enable a session recorder that captures interactions — clicks, scrolling and page structure — to reproduce interface faults. It is disabled unless we are actively investigating a usability problem. When it is enabled: form input values are masked and never captured, the recording is stored on our own infrastructure, it is retained only as long as needed to diagnose the issue, and it never captures the contents of the documents you upload.

What we do not do. We do not sell analytics data, we do not use it to build advertising profiles, and we do not share it with advertising networks. Your documents, questions and answers are never included in analytics or session recordings.

10. International transfers

Our infrastructure and service providers may store or process data in countries outside your own. Where this occurs, we use providers who maintain appropriate safeguards for the protection of personal data.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the application or by email. The “Last updated” date at the top of this page reflects the most recent revision.

12. Contact us

If you have any questions about this Privacy Policy or how your data is handled, contact us at: