Privacy Policy

1. Scope and our role

This policy applies when you visit a BasePO website, create or use an account, join a workspace, connect a third-party service, contact us, or otherwise use BasePO.

Organizations use BasePO to manage their business operations. For personal information that an organization submits to its workspace and directs us to process, that organization generally determines why and how the information is used, and BasePO acts as its service provider or processor. BasePO acts as the controller or business for information used to manage accounts, protect the service, provide support, administer our business, and meet our legal obligations. If your information belongs to a customer's workspace, contact that organization first regarding its privacy practices or requests.

2. Information we collect

Account and contact information

We collect information such as your name, email address, authentication identifiers, organization, role, workspace memberships, and communications preferences.

Workspace and business information

We process information you or other authorized users enter or upload, including company, supplier, product, purchase order, line item, receiving, inventory, location, invoice, fee, attachment, note, and activity information. Some records may contain business contact information or other personal information.

Connected-service information

If you connect a service such as Shopify or QuickBooks Online, we receive identifiers, authorization details, configuration, and business records that you authorize the service to share. The exact information depends on the provider, permissions, and features you use.

Payment information

We may receive invoice identifiers, payment status, amount, currency, dates, links, and reconciliation details from you or a connected provider. Payment providers collect and process payment credentials under their own privacy policies.

Device, usage, and security information

We collect technical information such as IP address, browser and device type, timestamps, pages or features used, session and authentication events, diagnostic data, request identifiers, and security or audit records.

Support information

We collect the messages, files, contact details, and troubleshooting information you provide when requesting support or otherwise communicating with us.

3. Sources of information

We receive information directly from you; from workspace owners, administrators, and other authorized users; automatically from your browser or device; from connected services at your direction; and from service providers that help us operate and secure BasePO. We may also receive business contact information from public sources or business partners when permitted by law.

4. How we use information

We use information to:

• provide and administer accounts, workspaces, permissions, and requested features;
• create and manage purchasing, receiving, inventory, invoice, and payment records;
• connect with and exchange authorized data with third-party services;
• authenticate users, prevent fraud, secure the service, and investigate incidents;
• respond to support requests and communicate about the service;
• monitor performance, troubleshoot errors, and improve BasePO;
• administer subscriptions, billing, and our business operations;
• comply with law, enforce agreements, and protect rights and safety; and
• create aggregated or de-identified analytics that do not reasonably identify a person.

If you choose a feature that uses automated or artificial-intelligence-assisted extraction, classification, or generation, we process the content you submit to provide that feature. You should review generated or extracted information before using it in business records.

5. How we disclose information

We may disclose information:

• Within your workspace. To owners, administrators, buyers, clients, and other users according to assigned permissions and the records shared with them.
• To connected services. To providers such as Shopify or QuickBooks when an authorized user enables an integration or requests an action.
• To service providers. To companies that provide infrastructure, hosting, database, authentication, email, security, support, and optional processing services. These may include Vercel, Supabase, Resend, and OpenAI where the applicable feature uses them.
• For legal and safety reasons. When reasonably necessary to comply with law or legal process; enforce agreements; or protect BasePO, our users, or others.
• For a business transaction. In connection with financing, due diligence, a merger, acquisition, reorganization, bankruptcy, or sale of assets.
• At your direction. When you request, authorize, or consent to the disclosure.

We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising. We do not use workspace content to serve third-party advertisements.

6. Invoices and payments

BasePO may create or link an operational invoice to an invoice and payment page hosted by a connected provider. The provider may collect payment-card or bank account information directly. BasePO does not receive or store complete payment-card or bank account credentials entered on those hosted pages. We receive limited transaction and status information needed to display, reconcile, and audit the payment in BasePO. The connected provider's privacy policy governs its processing.

Intuit and QuickBooks are registered trademarks of Intuit Inc. Used with permission.

7. Cookies and local storage

BasePO uses cookies, browser storage, and similar technologies that are necessary to sign you in, maintain sessions, remember security and product settings, route requests, and operate the service. We do not currently use third-party advertising cookies or tracking for cross-site behavioral advertising.

8. Data retention

We retain information for as long as reasonably needed to provide BasePO, maintain legitimate business and security records, comply with legal obligations, resolve disputes, and enforce agreements. Retention depends on the record and how the service is used:

• account and workspace records are generally retained while the account or workspace is active and for a limited period afterward for recovery, legal, and operational needs;
• short-lived diagnostic and operational logs are generally retained for no more than 90 days unless needed to investigate a security, legal, or service issue;
• Shopify privacy-request payload details and direct request identifiers are removed after fulfillment, while minimized non-identifying outcome evidence may be retained for up to 24 months unless a legal hold applies;
• invoice, payment, tax, billing, security, and audit records may be retained longer when needed for accounting, compliance, fraud prevention, or legal claims; and
• backup copies are deleted on scheduled cycles and may not be removed immediately.

When information is no longer needed, we delete it, de-identify it, or isolate it until deletion is possible. Workspace owners may have their own retention duties and controls.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including access controls, authorization boundaries, encrypted connections, and protection of integration credentials. No method of transmission or storage is completely secure. Please protect your credentials and notify us promptly at security@basepohq.com if you believe an account or workspace has been compromised.

10. Your privacy rights

Depending on where you live and subject to applicable exceptions, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, restrict or object to certain processing, withdraw consent, or appeal a decision. You may also have the right to opt out of sale or sharing for targeted advertising; BasePO does not currently engage in those practices. We will not discriminate against you for exercising a privacy right.

To submit a request, email privacy@basepohq.com. We may verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization. If the information is controlled by an organization using BasePO, we may direct the request to that organization or help it respond as its service provider.

11. Shopify privacy requests

BasePO receives Shopify's required privacy webhooks. If BasePO has no matching customer data, the request is completed with a no-data outcome. When responsive data exists, we process the request according to the merchant's instructions and applicable law. Direct request identifiers and payload details are removed after fulfillment, subject to the limited audit retention described above.

12. Data locations and transfers

BasePO and its service providers may process information in the United States and other countries where they operate. Those countries may have privacy laws different from the laws where you live. Where required, we use appropriate safeguards for international data transfers.

13. Children

BasePO is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can take appropriate action.

14. Changes to this policy

We may update this Privacy Policy as BasePO, our practices, or legal requirements change. We will post the revised policy and update the effective date. If a change is material, we will provide additional notice where required by law.

15. Contact us

Privacy questions and requests may be sent to privacy@basepohq.com.

CMDN Collective, LLC, doing business as BasePO
California, United States