Legal
Last updated: February 16, 2026
Welcome to BASTUDIO ("the App," "Service," "we," "us," or "our"), operated by TouchApp Inc., a Delaware corporation (EIN: 32-0615643, Delaware File No.: 7721589), with its registered address at 16192 Coastal Highway, Lewes, DE 19958, United States (Sussex County).
This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our mobile application (available on iOS and Android) and web application at bastud.io (collectively, the "Platforms"). Please read this Privacy Policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.
If you do not agree with the terms of this Privacy Policy, please do not access or use the Service. We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last updated" date of this Privacy Policy.
We collect information that you provide directly to us, information collected automatically when you use the Service, and information from third-party sources.
a) Account Information
When you create an account, we collect:
b) Patient Content
When you use the Service, you may upload:
c) Payment Information
We do not directly collect or store your full payment card details. Payment processing is handled by third-party providers:
These providers may collect payment card numbers, billing addresses, and transaction history. Please refer to their respective privacy policies for details.
d) Usage Data
We automatically collect certain information when you interact with the Service, including:
e) Device Information
We may collect information about the device you use to access the Service, including:
We use the information we collect for the following purposes:
We do not sell your personal information to third parties. We may share your information in the following circumstances:
a) Service Providers
We share information with third-party service providers who perform services on our behalf:
b) Legal Requirements
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order, subpoena, or government agency request).
c) Business Transfers
If TouchApp Inc. is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
d) With Your Consent
We may share your information with third parties when you have given us your explicit consent to do so.
We take the security of your data seriously and implement appropriate technical and organizational measures to protect your information.
While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.
IMPORTANT DISCLAIMER: BASTUDIO is NOT a medical device and is NOT HIPAA compliant. The Service is not designed, intended, or certified to meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA) or any other healthcare data protection regulation.
The Service allows aesthetic surgeons to upload patient before-and-after photographs and generate transformation videos. Regarding patient data:
Your Responsibilities:
TouchApp Inc. disclaims all liability for any unauthorized disclosure of patient information resulting from your use of the Service.
Depending on your location, you may have the following rights regarding your personal information:
To exercise any of these rights, please contact us at support@bastud.io. We will respond to your request within 30 days.
BASTUDIO is not intended for use by individuals under the age of 18. The Service is designed exclusively for licensed aesthetic surgeons and medical professionals.
We do not knowingly collect personal information from anyone under the age of 18. If we discover that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information as quickly as possible.
If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at support@bastud.io so that we can take appropriate action.
TouchApp Inc. is based in the United States (Delaware). If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.
By using the Service, you consent to the transfer of your information to the United States and other jurisdictions that may have different data protection laws than your country of residence.
Our service providers, including Cloudflare, Stripe, RevenueCat, and Resend, may process and store data in various locations worldwide. We rely on these providers' compliance with applicable data transfer mechanisms, including:
We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specifically:
We may also retain certain information as required by law, to resolve disputes, enforce our agreements, or for other legitimate business purposes.
The Service integrates with and relies on third-party services. Each of these services has its own privacy policy governing their collection and use of data:
We encourage you to review the privacy policies of these third-party services to understand how they handle your data. We are not responsible for the privacy practices of these third-party services.
BASTUDIO uses minimal tracking technologies. Here is what we use:
a) Authentication Tokens (JWT)
We use JSON Web Tokens (JWT) to authenticate your sessions. These tokens are stored locally on your device and are used to verify your identity when making requests to our servers. JWT tokens are not cookies but serve a similar purpose for session management.
b) Local Storage (AsyncStorage)
On mobile devices, we use AsyncStorage (React Native) to store your authentication token and user preferences locally on your device. This data remains on your device and is not transmitted to third parties.
c) Essential Technical Data
Our servers may log basic technical information such as IP addresses, request timestamps, and user agent strings for security monitoring and abuse prevention. This data is used solely for operational purposes and is not used for advertising or tracking.
What We Do NOT Use:
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:
Right to Know: You have the right to request that we disclose what personal information we have collected about you in the preceding 12 months, including the categories of information, the sources, the business purposes for collection, and the categories of third parties with whom we share it.
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions (such as legal obligations or completing transactions you initiated).
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you the Service, charge you different prices, or provide a different quality of service because you exercised your rights.
Right to Opt-Out of Sale: We do not sell your personal information to third parties. Therefore, there is no need to opt out of the sale of personal information.
Categories of Information Collected:
To exercise your California privacy rights, please contact us at support@bastud.io. We will verify your identity before processing your request and respond within 45 days.
We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will:
Your continued use of the Service after any modifications to this Privacy Policy constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically for any changes.
If we make changes that materially affect how we handle your previously collected personal information, we will make reasonable efforts to notify you and give you an opportunity to review the changes before they take effect.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
We will do our best to respond to your inquiry within 30 days of receipt.