Privacy Policy

Last updated: June 2026

This Privacy Policy describes how Basis Research, Inc. ("Basis," "we," "our") collects, uses, and shares information when you access our website at basisresearch.tech or use the Basis research platform (together, the "Service"). Read this alongside our Terms of Service and Disclosures.

Information we collect

Account information. When you create an account, we collect your name, work email address, and your organization name. If you join through a team invitation, we also receive the workspace identifier associated with that invitation.

Usage data. We collect records of actions inside the platform: documents ingested, extractions run, tables exported, and features accessed. We use this to operate and improve the Service, not to profile users for advertising.

Customer content. The filings, transcripts, PDFs, and notes you upload to Basis are your content. We store them to provide the Service and for no other purpose. Your workspace content is isolated per organization.

Device and network data. We log IP addresses, browser type, and operating system for security, abuse prevention, and debugging. This data is not sold or used for advertising.

Payment data. Billing is handled by our payment processor. We do not store full card numbers or bank account details on our own servers. Your payment details are handled entirely within the payment processor's environment.

How we use it

• To authenticate you and keep your session secure.
• To run the extraction pipeline on the documents you submit and return results to your workspace.
• To send transactional emails: account confirmations, password resets, billing receipts, and change alerts you configure.
• To monitor for abuse, unauthorized access, and service errors, and to maintain the security of the platform.
• To improve extraction quality and the platform, using aggregated and de-identified usage patterns. We never use individual content for this purpose.
• To respond to your support requests and to comply with our legal obligations.

What we do not do

We do not train models on customer content. Your uploads, notes, extractions, and research library are never used as training data for any machine-learning model, by Basis or by any subprocessor. This is a firm commitment, not a default setting.

We do not sell personal data. We do not sell, rent, or trade your personal information to data brokers, advertisers, or any third party for commercial purposes. We operate a subscription business.

We do not use your data for advertising targeting. We have no advertising revenue and no incentive to profile users for ad networks. We do not share data with advertising platforms.

Data storage and security

Your data is stored on infrastructure hosted in the United States. We apply encryption in transit (TLS 1.2 or higher) and at rest (AES-256). Access to production data is restricted to authorized personnel on a need-to-know basis and is logged. For a full description of our technical and organizational security controls, see our Security page.

Retention and deletion

We retain your account data and workspace content for as long as your account is active. If you close your account, we delete your personal data and content within 30 calendar days of the closure request, except where we are required to retain records for tax, legal, or fraud-prevention purposes.

To request deletion of your data without closing your account, contact us at privacy@basisresearch.tech. We will respond within 5 business days to confirm the request and within 30 calendar days to complete it.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. To exercise any of these rights, contact us at privacy@basisresearch.tech. We respond within 30 calendar days. We do not charge a fee for handling rights requests in good faith.

• Access. Request a copy of the personal data we hold about you, including account information and usage records.
• Correction. Ask us to correct inaccurate or incomplete personal data.
• Export. Request a machine-readable export of your workspace content, including notes, extractions, and configured alerts.
• Deletion. Ask us to delete your personal data, subject to retention obligations imposed by law.
• Objection. Object to certain uses of your data. Where we rely on legitimate interests as a legal basis, you may object and we will assess whether our interests override yours in the circumstances.

Cookies

We use cookies for session management only. These are strictly necessary for the Service to function and do not require your consent under any cookies framework. We do not use cookies for analytics, advertising, or cross-site tracking.

We set a session cookie that expires when you close your browser, and a persistent authentication token that expires after 30 days of inactivity. No third-party tracking cookies are present on any page of the Service.

Subprocessors

We use a limited set of third-party services to operate the platform. Each subprocessor is bound by a data processing agreement that restricts them to handling your data only as we direct and in compliance with applicable privacy law.

Categories of subprocessors we use include: cloud infrastructure and storage, payment processing, transactional email delivery, and application error monitoring. We do not share your content with any subprocessor except as strictly necessary to deliver the feature you are using. A current list of subprocessors is available on request at privacy@basisresearch.tech.

International users

Basis is operated from the United States and our infrastructure is located in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. For transfers from the European Economic Area or the United Kingdom, we rely on standard contractual clauses as the legal transfer mechanism.

Users in the European Economic Area have rights under the General Data Protection Regulation (GDPR). Users in California have rights under the California Consumer Privacy Act (CCPA). We honor those rights regardless of where a request originates.

Children

The Service is intended for professionals at investment firms and is not directed at anyone under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have done so, we will delete it promptly.

Changes to this policy

If we make material changes to this Privacy Policy, we will notify account holders by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

For privacy questions, data requests, or to report a concern, contact us at privacy@basisresearch.tech or by post at:

Basis Research, Inc.
Attn: Privacy
New York, NY, USA