Privacy
What Basis collects, why, who sees it, and how long we keep it.
Effective 26 August 2026 · previous versions in the repository history
Basis is used by two different groups of people, and the answers are different for each. Agents hold accounts and run analyses. Consumers may never have heard of us — they used a calculator embedded on an agent's website and left their details. This page covers both, and says which is which.
1. If you used a calculator on an agent's website
You typed into an embedded Basis widget. Here is what happens.
What we collect
Nothing at all, unless you press Send me the full analysis. What you type is sent to our server as you go, because that is what computes the numbers on screen — but it is answered and discarded. No record of you exists until you press the button. If you close the tab, there is nothing to delete.
When you do press it, the agent receives:
- Your contact details — name, email, phone (optional) and your message.
- What you entered into the calculator — the property address, price, rent, financing assumptions and the rest.
- The scenarios you tried — each combination you modelled on that page, how long you spent, and how many times you changed the numbers. Kept in your browser while you work and sent once, with everything else.
- The page you were on — the address of the agent's own page that the calculator was embedded in, without its query string.
- Your device type, IP address and approximate city — for example "Boise, ID · iPhone · Safari". The city is worked out from your IP address using a database held on our own server, so your address is not sent to anyone else to be looked up. It is an estimate of where your network is, not where you are: a VPN, a corporate connection or a mobile carrier will place you somewhere else entirely, and it is never more precise than a city.
- The generated analysis, saved so the agent can send you the full version.
We do not set advertising cookies, we do not track you across sites, and there is no analytics or session-recording script in the widget. The scenario history above covers only the page you are on, in that one visit. Basis appears on many agents' websites and it is never used to connect a person across them, or to build a profile that outlives the form you filled in.
Who receives it
The agent whose website you were on. That is the point of the form — they asked for the analysis so they can follow up with you. They see everything above.
Their CRM, if they use one. Agents on our paid tiers can configure an outbound webhook, which forwards your record to a system they choose. We do not control that system and it is not ours. Under California law this disclosure may count as a sale or share unless a service-provider contract covers it — so we are naming it here rather than leaving you to discover it.
Not anyone else. We do not sell your information, we do not share it with other agents, and we do not use it to market anything to you.
Your choices
The agent is the person to contact first — it is their relationship with you and their copy of your details. If you would rather deal with us, or they do not respond, email privacy@basis.local and we will delete our copy and tell you what we removed.
2. If you have a Basis account
What we collect, and where it comes from
| What | Where it comes from | Why |
|---|---|---|
| Name, email, company, licence number, phone | You, at signup and in settings | To run your account and put your name on your reports |
| Password | You | Stored only as a PBKDF2 hash with a per-user salt. We cannot read it |
| Your saved deals and analyses | You | The product |
| Leads captured by your widget | Consumers on your website | Delivered to you; see section 1 |
| Your branding — accent colour, logo, disclaimer, privacy URL | You | Applied to your reports and widget |
| Team membership and role | Your organization's admin | Access control |
| Session records | Created when you sign in | To keep you signed in, and to sign you out |
| Billing status and Stripe identifiers | Stripe, when you subscribe | To know which plan you are on |
Who we share it with
Named, because "third-party service providers" tells you nothing:
- Stripe — subscription billing. They see your email and payment details. Card numbers never reach us.
- Fly.io — hosting. Holds the application and database.
- Your own CRM webhook, if you configure one — a destination you choose, for leads you own.
- Abstract, only if you use the lease-abstraction handoff, and only for the document you hand off.
There is no advertising network, no analytics provider and no data broker in that list, and there is not going to be one added quietly.
Do we sell or share personal information?
No. We do not sell personal information and we do not share it for cross-context behavioural advertising. The one disclosure worth being precise about is the agent-configured CRM webhook described in section 1 — that is a transfer at the agent's direction, to a system the agent chose.
3. How long we keep things
| What | How long | Why |
|---|---|---|
| Your account and saved deals | While the account is active, then 24 months | So a returning agent keeps their work |
| Leads and their consent records | 3 years from capture | California's ARL requires consent records kept 3 years, or 1 year after termination, whichever is longer |
| Your IP address and browser string | 90 days, then erased | The approximate city was worked out when you submitted and is kept with the lead; the address itself has no further use, so it does not sit there for three years |
| Generated reports | 24 months | Shared report links stay usable for a reasonable period |
| Sessions | Until they expire or you sign out | They are credentials |
| Password reset tokens | Minutes — then deleted, not merely marked used | They are credentials |
| Webhook delivery logs | Trimmed to the most recent per endpoint | Debugging, not archiving. Response bodies are never stored |
| Billing records | 7 years | Tax and accounting obligations |
4. Your rights
Whoever you are and wherever you live, you can ask us to:
- Tell you what we hold about you, and give you a copy.
- Correct it if it is wrong.
- Delete it. We will, except where a record must legally survive — billing records, which we de-identify rather than destroy.
- Stop marketing. We send almost none, and you can opt out of what there is.
Two ways to reach us, because one is not enough: privacy@basis.local, or from inside your account under Settings.
We will acknowledge within 10 business days and complete the request within 45 days, or tell you why we need longer (up to 90 days). We will not charge you and we will not ask for identification we do not already hold.
If we say no
You can appeal, by replying to our decision and saying you want it reviewed. Most US state privacy laws require an appeal process; we would rather have one than argue about whether it applies. We will respond within 45 days and, if we still say no, tell you how to complain to your state Attorney General.
5. Security
TLS everywhere. Passwords hashed with PBKDF2-HMAC-SHA256 and per-user salts, compared in constant time. Rate limiting on sign-in. Every data query scoped to your organization server-side, not hidden in the interface. Outbound webhooks validated so they cannot be pointed at internal infrastructure, with response bodies never stored or returned.
No system is perfectly secure, and we would rather say that than imply
otherwise. If something goes wrong we will tell you — see
docs/breach-response.md.
6. Children
Basis is a professional tool for real-estate agents. It is not directed at children and we do not knowingly collect information from anyone under 18. If you believe we have, email us and we will delete it.
7. Changes
If this policy changes materially we will tell account holders by email before it takes effect, and update the date at the top. Old versions stay in our repository history so you can see what changed.
Contact
[DECISION NEEDED: replace privacy@basis.local with a real monitored address, and add the legal entity name and postal address — several state laws require a physical address in a privacy notice.]