Privacy

Who we are

Basalt is made by Petrus Labs LLC. In this policy, “we” means Petrus Labs, and “a business” means a studio, restaurant or other business that uses Basalt to run itself.

Most of what is in Basalt is put there by a business about its own members, staff, lessons and suppliers. We hold that information on the business's behalf and use it only to run Basalt for them.

What we collect

Your account. Your email address, which is how you sign in. We email you a link each time; there is no password.

What a business puts in. Depending on the modules it uses: members and their contact details, lesson schedules and attendance, invoices and payments, student rosters, stock counts, vendor invoices, and staff clock-in times.

Accounts a business connects. When a business connects Google Calendar, Toast, Stripe or PayPal, we keep what is needed to use that connection. Google Calendar is described in full below.

What we don't collect. Basalt has no analytics, advertising or tracking tools.

Google Calendar

A business can connect a Google account so that its lessons appear in a Google calendar. When it does, Basalt asks Google for three things:

• See the list of your calendars, so you can choose which one lessons go into.
• Create and change events, so lessons can be written to that calendar and kept up to date.
• Your email address, so Basalt can show which Google account is connected.

What we do with it. Basalt writes each upcoming lesson as an event in the one calendar the business chooses. An event carries the lesson's name, the names of the people in it, and any note on the lesson. If the business turns on invitations, each member's email address is added as a guest on their own lessons, and Google emails them the invitation.

What we don't do. Basalt does not read the events already in your calendars. We do not use Google data for advertising, we do not sell it, we do not use it to train any AI model, and we do not send it to any AI service.

What we store. The connection itself, encrypted; the connected account's email address; which calendar was chosen; and the identifiers of the events Basalt created, so it can update or remove them later.

Removing access. Disconnecting in Basalt's Integrations page withdraws Basalt's access at Google and deletes the stored connection. Events already written stay in the calendar, because people may have made plans around them. A business that wants them gone can remove every event Basalt wrote, in one step, from the calendar settings on its Lessons page. You can also withdraw access at any time from your Google account's permissions page.

Basalt's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who else handles it

We use a small number of services to run Basalt. Each receives only what it needs for its job. We do not sell personal information.

• Supabase stores Basalt's database and files, and handles sign-in.
• Vercel hosts Basalt.
• Anthropic reads photographs of vendor invoices so their line items can be filled in. Nothing else is sent to it.
• Resend delivers Basalt's emails, such as sign-in links, invitations and invoices.
• Google, Toast, Stripe and PayPal, only when a business connects them.

Payments

When a member pays online, they enter card details on Stripe's or PayPal's own page. Basalt never sees or stores card numbers. The money goes to the business, not to us.

Students

A business can keep a list of the students it teaches, some of whom may be children. Students are entered by the business, have no email address in Basalt, and never sign in. We do not knowingly collect information directly from children.

Cookies

Basalt uses cookies only to keep you signed in and to remember a few choices while you use it. There are no advertising or analytics cookies.

Keeping and deleting

We keep a business's information for as long as it uses Basalt. A business can delete its own members, lessons and records at any time. It can also ask us to delete its account entirely, which removes its records and stored files.

If you are a member of a business and want your information changed or removed, ask that business first, since it decides what it keeps. You can also write to us.

Security

Everything is sent over encrypted connections. Credentials for connected accounts are encrypted in storage. Access to the systems that run Basalt is limited to the people who need it.

Changes and contact

If this policy changes, the date at the top changes with it. Questions go to hello@petrus.vc.