Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
The company logs your full IP address for spam and security and ties web analytics data, including your IP address, to your user account while it's active. They use third-party cookies and ad-company scripts for advertising effectiveness and transfer all user data to the United States. While the company commits not to sell your data or use it for AI model training, users should be aware of the IP logging and data transfer practices.
90% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
Not clearly stated
Critical issues and red flags that may indicate potential harm or significant risk to the user. These require immediate attention.
?
Not clearly stated
No cited risk flags — wording is unclear
There were no findings that met the criteria for this section.
Data Use and Sharing
3 findings
Policies related to how your data is collected, used, shared, and managed. This includes specifics on third-party sharing, advertising, and data retention practices.
Not clearly stated: There were no findings that met the criteria for this section.
medium90% confidence
Web analytics data tied to IP address and user account
Information about browsing activity for analytics, such as browser and operating system versions, IP address, web pages visited, and load times, is collected and tied to your IP address and user account if you are signed in, until your account is no longer active.
Why it matters: Your browsing activity, including your IP address and pages visited, is collected for analytics and linked to your user account while it is active.
We collect information about your browsing activity for analytics and statistical purposes such as conversion rate testing and experimenting with new product designs. This includes, for example, your browser and operating system versions, your IP address, which web pages you visited and how long they took to load, and which website referred you to us. If you have an account and are signed in, these web analytics data are tied to your IP address and user account until your account is no longer active.
General Geolocation data, paragraph 3 · Citation strength: strong
medium90% confidence
Third-party cookies and ad-company scripts used for ad effectiveness
When users click on the company's ads on third-party platforms, an ad-company script may load on their browsers to set a third-party cookie and send information to the ad network to evaluate ad effectiveness.
Why it matters: Clicking on ads may result in third-party cookies being set on your browser to track ad effectiveness, sharing information with ad networks.
37signals occasionally runs ads on various third-party platforms such as Google. Users who click on one of our ads will be sent to the Basecamp marketing site. Where permissible under law, we may load an ad-company script on their browsers that sets a third-party cookie and sends information to the ad network to enable evaluation of the effectiveness of our ads, e.g., which ad they clicked and which keyword triggered the ad, and whether they performed certain actions such as clicking a button or submitting a form.
Advertising and Cookies, paragraph 1 · Citation strength: strong
low90% confidence
Data transferred to the United States
If you are located outside of the United States, any information you provide will be transferred to and stored in the United States, and by using the services or providing personal information, you consent to this transfer.
Why it matters: Your data will be transferred to and stored in the United States if you are outside the U.S., and your use of the services implies consent to this.
Our products and other web properties are primarily housed in the United States. If you are located in the European Union, UK, or elsewhere outside of the United States, please be aware that any information you provide to us will be transferred to and stored in the United States. By using our websites or Services and/or providing us with your personal information, you consent to this transfer.
Location of site and data, paragraph 1 · Citation strength: strong
Cancellation and Renewal
Not clearly stated
Terms and conditions related to subscription cancellations, auto-renewal processes, and associated refund policies.
?
Not clearly stated
No cited billing terms — wording is unclear
There were no findings that met the criteria for this section.
Other Gotchas
Not clearly stated
Potentially surprising or less-than-obvious clauses that could impact user rights or experience. These often require careful reading.
?
Not clearly stated
No cited gotchas — wording is unclear
There were no findings that met the criteria for this section.
Protections
9 findings
Safeguards and user-friendly policies that benefit the consumer, enhancing their privacy, control, or security.
Not clearly stated: There were no findings that met the criteria for this section.
Protection95% confidence
Commitment not to sell personal information
The company states that it will never sell your personal information to third parties and will not use your name or company in marketing statements without your permission.
Why it helps: This explicitly protects your personal information from being sold and ensures your name or company won't be used in marketing without your consent, safeguarding your privacy.
We’ll never sell your personal information to third parties, and we won’t use your name or company in marketing statements without your permission either.
Changes and questions, paragraph 10 · Citation strength: strong
Protection95% confidence
Payment information handled by processor, not stored on company servers
Credit card information is submitted directly to the payment processor and does not hit the company's servers.
Why it helps: Your sensitive credit card details are handled directly by a payment processor, reducing the risk of them being compromised on the company's servers.
Credit card information is submitted directly to our payment processor and doesn’t hit 37signals servers.
Human access to content requires express permission or legal process
No human at the company looks at your content except for limited purposes with your express permission, such as fixing an error, or if required to respond to legal process.
Why it helps: This limits internal access to your content, requiring your explicit permission for most human intervention, thereby protecting your privacy.
No 37signals human looks at your content except for limited purposes with your express permission, for example, if an error occurs that stops an automated process from working and requires manual intervention to fix. These are rare cases, and when they happen, we look for root cause solutions as much as possible to avoid them recurring. We may also access your data if required in order to respond to legal process (see “When required under applicable law” below).
When we access or disclose your information, paragraph 3 · Citation strength: strong
Protection90% confidence
User notification before data disclosure to government, unless legally prohibited
It is the company's policy to notify affected users before disclosing data in response to government requests, unless legally prohibited from doing so, or in some emergency cases.
Why it helps: You will generally be informed if your data is requested by the government, allowing you to be aware of and potentially challenge such requests, unless legal restrictions prevent notification.
It is 37signals’ policy to notify affected users before we disclose data unless we are legally prohibited from doing so, and except in some emergency cases.
When we access or disclose your information, paragraph 9 · Citation strength: strong
Protection95% confidence
No user content used to train AI models
The products do not include built-in AI features that process your content, and the company does not use your content to train AI models. AI providers are contractually prohibited from training their models on your content.
Why it helps: This protects your content from being used to train AI models, preventing unintended use or exposure of your data through artificial intelligence systems.
Our products don’t include built-in AI features that process your content, and we don’t use your content to train AI models. The AI providers we work with are also contractually prohibited from training their models on your content.
When we access or disclose your information, paragraph 14 · Citation strength: strong
Protection90% confidence
Data rights apply to all customers regardless of location
The company strives to apply the same data rights to all customers, regardless of their location, including rights such as Right to Know, Access, Correction, Erasure, Complain, Restrict Processing, Object, Portability, and Non-Discrimination.
Why it helps: This commitment extends important data privacy rights, often associated with specific regions like the EU, to all customers globally, providing a higher standard of protection for everyone.
At 37signals, we strive to apply the same data rights to all customers, regardless of their location. Some of these rights include:
Your rights with respect to your information, paragraph 1 · Citation strength: strong
Protection95% confidence
Right to Portability includes direct export options
You have the right to receive your personal information and transmit it to another party, with direct export instructions provided for various products.
Why it helps: This enables you to easily move your data to another service, giving you greater control and flexibility over your personal information.
Right to Portability. You have the right to receive the personal information we have about you and the right to transmit it to another party. If you want to export data from your accounts, you can do so directly by following these instructions for HEY , Basecamp 5 , Basecamp 2 , Basecamp Classic , Highrise , Campfire , and Backpack .
Your rights with respect to your information, paragraph 9 · Citation strength: strong
Protection95% confidence
All data encrypted during transmission
All data is encrypted via SSL/TLS when transmitted from the company's servers to your browser, and database backups are also encrypted.
Why it helps: Encrypting data during transmission protects your information from unauthorized access as it travels between servers and your device.
All data is encrypted via SSL/TLS when transmitted from our servers to your browser. The database backups are also encrypted.
How we secure your data, paragraph 1 · Citation strength: strong
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.