Privacy Policy

The Service is operated by InBio, Inc., a company incorporated in the State of Delaware, United States. We handle data in two capacities:

• As a controller — for our marketing site and for account and billing data of the person who signs up (the community owner).
• As a processor — for the content and member data inside a community, which we process on behalf of, and under the instructions of, the community owner. If you’re a member of a community hosted on ComBase, that community’s owner is the controller of your data; please contact them for requests about it. Our commitments as a processor are set out in our Data Processing Addendum.

• Account & billing data — your email address, the community name/subdomain you choose, and billing details (payment is handled by our processor; we don’t store full card numbers).
• Community data — the forums, pages, posts, settings and uploads you and your members create.
• Usage & device data — pages viewed, actions taken, IP address, browser and device information, collected automatically as you use the Service.

To provide and operate the Service, authenticate you, send necessary emails, process payments, monitor and fix errors, prevent abuse, understand usage, and comply with legal obligations. Our legal bases (where applicable) are performing our contract with you, our legitimate interests in running and securing the Service, your consent (for marketing analytics cookies), and legal compliance. We do not sell your personal data, and we do not use your community content to train AI models.

We use a small set of trusted providers to run the Service; they process some data on our behalf:

• Cloudflare — hosting, CDN, object storage and security (processes IP addresses, traffic metadata and uploaded files).
• Stripe — payment processing.
• Sentry — error and performance monitoring (may capture technical details, IP address and request context when something goes wrong).
• Resend — transactional email (activation links, notifications).
• Google Analytics — usage analytics on our marketing site only (not inside communities).

The current list, each provider’s purpose and location, and how we notify customers of changes are kept in our Data Processing Addendum.

We use cookies to keep you signed in, remember preferences, and — on our marketing site only — for analytics. You can control cookies through your browser; disabling some may affect how the site works.

We’re based in the United States and use providers that may process data in the US and other countries. Where data is transferred out of your region (for example from the EEA or UK), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent mechanisms, as reflected in our Data Processing Addendum.

We keep your data for as long as your account is active. After cancellation or non-payment, data is retained and then deleted on the staged timeline set out in our Terms of Service — including a recovery-and-export window before anything is deleted, with deleted data aged out of backups within 30 days. You can request deletion of your account at any time; some records may be retained where the law requires (for example, invoices).

We protect your data with encryption in transit and at rest, role-based access controls, tenant separation, monitoring, regular backups and a documented incident-response process. No service is perfectly secure, but we take reasonable, industry-standard measures to keep your data safe. To report a vulnerability or a security concern, email [email protected].

Depending on where you live, you may have rights to access, correct, export, delete, or restrict processing of your personal data, or to object to certain processing. To exercise them for data we control, email [email protected]. For data held inside a community, contact that community’s owner; we’ll assist them in responding as their processor.

The Service isn’t directed to children under 16, and we don’t knowingly collect their data. If you believe a child has provided us data, contact us and we’ll delete it.

We may update this policy from time to time and will note the “last updated” date above. Controller: InBio, Inc. (d/b/a ComBase), 1111B S Governors Ave STE 39177, Dover, DE 19904, USA. Questions or requests? Email [email protected].