BaseBara Privacy Policy
Effective date: September 21, 2026 · Last updated: September 21, 2026 · Version: 1.0
BaseBara, Inc. ("BaseBara," "we," "us") provides business-to-business sales intelligence (verified professional contact and company information and related research tools), currently offered as a free early-access beta, delivered through AI assistants such as Claude and ChatGPT via the Model Context Protocol ("MCP") and through basebara.com (together, the "Services"). As used in this Policy, "free early-access beta" means that the Services are production-ready and currently offered without charge before planned paid offerings; it is not a trial, demo, prototype, or incomplete release.
This Privacy Policy explains what personal information we collect, why, who receives it, how long we keep it, and the choices available to you. It covers two groups of people:
- Customers, Users, and prospective customers of BaseBara: people who connect BaseBara inside an AI assistant, create an account, visit basebara.com, or communicate with us in the course of our sales, marketing, and partnerships.
- Business professionals and business contacts in the BaseBara Database: people whose professional contact information appears in our database, whether or not they have ever used BaseBara.
Privacy at a glance
- Professional data only. The BaseBara Database contains information about individuals in their professional capacity (the kind of information found on a business card), compiled from licensed data providers and publicly available sources. It is designed to exclude, and we do not knowingly include, sensitive personal information, household data, or information about minors. The Services display and provide professional (work) contact information only.
- Your queries stay yours. What you submit to our tools is private by default: it is not added to the BaseBara Database, not shared with other customers, and not sold. We do not build our database from our users' inboxes, address books, calendars, or CRMs.
- We do not train AI models on your data.
- Your choices. Anyone can request access, correction, or deletion of their information, or opt out of its disclosure, at https://www.basebara.com/privacy-center or privacy@basebara.com, free of charge, whether or not you live in a state that mandates these rights.
- We are currently a free early-access beta. We have not sold personal information: users pay nothing, and we do not exchange data for money or other valuable consideration. When we introduce paid services, we will update this Policy first and provide all legally required notices and mechanisms.
- Not for FCRA purposes. BaseBara is not a consumer reporting agency, and our data may not be used for credit, employment, insurance, housing, or any other purpose regulated by the Fair Credit Reporting Act.
1. Our roles
For the BaseBara Database, User accounts, basebara.com, and our own marketing, BaseBara determines how and why personal information is processed and acts as the business (or "controller"). For your queries and submissions (Section 2.2), we act as a service provider (or "processor"): we process that data only to provide the Services to you, on your instructions, as described in our Terms of Use.
2. Information we collect
2.1 Information about Users and prospective customers
- Account and authentication data. When you connect BaseBara through an AI assistant, we receive limited account identifiers through the platform's OAuth flow (such as your name, email address, and workspace or organization identifier), along with the OAuth tokens that operate your connection. If you register on basebara.com, we collect the details you provide.
- Request-history and service-usage data. We maintain a user-controlled request history consisting of the BaseBara tool invoked, the inputs sent to that tool, and the outputs it returned so we can deliver results, show your search history, and detect repeat searches to help you avoid duplicate lookups. Separately, we log technical metadata such as timestamps, request identifiers, and IP address solely to administer usage limits, prevent fraud and abuse, debug problems, and maintain security; those diagnostic and security logs do not contain raw tool inputs or outputs. We receive only what you or your AI assistant deliberately send to our tools. We do not receive, request, or reconstruct your conversations, chat history, memory, or files.
- Communications. Messages you send to support, partnerships, or privacy@basebara.com, and the professional contact details and correspondence involved in our own sales and marketing outreach (opt out anytime).
- Website data. Standard server logs and the limited cookies described in Section 8.
We do not sell or share information about our Users or prospective customers. Your account data, usage data, and communications are used only as described in this Policy.
Our tools never request, and do not accept, passwords, API keys, session cookies, one-time or multi-factor authentication codes, or third-party access tokens as tool inputs; nor government identifiers, financial account numbers, health information, or other sensitive data. Please do not submit any of these through chat or our tools; they are not designed to collect such data, and we will delete any we discover.
2.2 Your queries and submissions
This is data you choose to send to the Services for processing: search queries, contact identifiers you ask us to look up, and any lists or other content you choose to provide, together with the results we return to you.
Your queries and submissions are private by default. We use them only to perform the task you requested and to operate and secure the Services. They are not added to the BaseBara Database, not disclosed to other customers, not sold, and not used to train AI models (Section 3). Aggregate, de-identified statistics that cannot reasonably be linked to you or any individual may be used to improve the Services.
2.3 The BaseBara Database (business professionals and business contacts)
The BaseBara Database contains information about individuals in their professional or business capacity. In plain terms, it is professional business-card-level information about who works where, in what role, and how to reach them at work:
| Category | What we hold |
|---|---|
| Identifiers | Name; email addresses used in a professional context, which may include personal-domain addresses where they are used professionally; work phone numbers, including direct-dial and mobile numbers; links to public professional profiles |
| Professional or employment-related information | Current employer, job title, department or function, seniority, and employment history |
| Coarse geolocation (never precise) | City or region of the individual's employer or office |
| Inferences (professional attributes only) | Attributes derived from the above, such as likely role, function, or seniority |
| Company (firmographic) information (describes organizations, not individuals) | Employer name, website and domain, industry, size, location, and technologies used |
Sources. We compile the BaseBara Database from: (a) licensed third-party data providers under written agreements; (b) publicly available sources such as company websites, professional profiles, press releases, and government and business registries; and (c) third-party verification services that help us confirm accuracy and deliverability. We collect, access, and use information from these sources only where authorized under applicable law, contracts, source terms, and technical access controls. We resolve, deduplicate, and verify records using our own entity-resolution technology. We do not build the BaseBara Database from our users' inboxes, address books, calendars, CRMs, or queries and submissions, and we do not operate a contributory data network.
2.4 Information we do not collect
We do not knowingly collect, and the BaseBara Database is designed to exclude: Social Security numbers or other government identifiers; financial account or payment card information; health, medical, or biometric information; precise geolocation; racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or union membership; family or household details; criminal-record information; and information about anyone we know to be under 18. The BaseBara Database is designed not to include, and we do not knowingly include, "sensitive personal information" as defined by the California Consumer Privacy Act.
3. How we use information
We use the information described above to: provide, operate, and secure the Services, including resolving and serving professional records in response to your requests; verify and improve the accuracy of the BaseBara Database; administer beta access and usage limits; provide support; detect, investigate, and prevent fraud, abuse, and security incidents; comply with law and enforce our agreements; communicate with Users and prospective customers about the Services (opt out anytime); and improve the Services using aggregated or de-identified data, which we maintain in de-identified form and do not attempt to re-identify.
AI commitments. Our Services use AI to fulfill your requests. We do not use your queries and submissions or User personal information to train artificial-intelligence or machine-learning models, and we do not permit our service providers to do so. If we introduce optional features that involve learning from data you provide, they will require your explicit opt-in consent and will be described to you before you enable them. We do not sell or license the BaseBara Database to AI developers for model-training purposes.
4. How we disclose information
| Recipients | What and why |
|---|---|
| Beta users | In response to their queries, authorized beta users receive BaseBara Database records (the categories in §2.3). The Terms of Use restrict use to lawful business purposes and prohibit uses regulated by the FCRA. |
| Service providers | Companies that process data on our behalf (hosting and infrastructure, data verification, analytics, communications, security, and support tooling) under contracts that limit their use of the data to providing services to us, as the CCPA requires. |
| AI assistant platforms (e.g., Anthropic, OpenAI) | When you use BaseBara inside an AI assistant, your tool inputs and our outputs pass through that platform; its own privacy policy governs its handling of your conversations (see Anthropic's Privacy Policy and OpenAI's Privacy Policy). |
| Legal, safety, and corporate | Professional advisors; authorities where legally required (we disclose only in response to legally valid requests); and parties to a merger, financing, or acquisition, with notice where required. |
During the free early-access beta, we do not exchange BaseBara Database records or any other personal information for money or other valuable consideration, and we do not disclose personal information for cross-context behavioral advertising. We do not disclose personal information to data co-ops or contributory exchanges, do not sell personal information to government or law-enforcement agencies or foreign actors, and do not license the BaseBara Database to AI developers for training.
5. BaseBara inside Claude, ChatGPT, and other AI assistants
- What we receive: the inputs the assistant sends to our tools when you invoke them, your platform account identifiers via OAuth, and technical metadata needed for security, usage limits, and support.
- What we do not receive: your conversation history, memories, uploaded files, or anything outside the tool calls you make. Our tools request the minimum inputs needed and return only information relevant to your request. We never pull, reconstruct, or infer your chat log.
- Read-only tools: our current AI-assistant tools only search for and retrieve requested information. They do not send communications, place calls or texts, make purchases, modify data in third-party systems, or take other external actions on your behalf.
- How we protect your connection: connections use OAuth 2.0 in accordance with applicable AI Platform authorization requirements, with user authorization and permissions limited to those reasonably necessary for the current tools. We do not materially expand permissions without renewed authorization. The OAuth tokens that operate your connection are short-lived or revocable, encrypted at rest, excluded from application logs, and used solely to authenticate and secure your connection, never for any other purpose.
- Your controls: disconnect BaseBara at any time in your assistant's connector settings, which revokes our access; ask us to delete your account data and your queries and submissions at any time (Section 7).
- No advertising. We do not serve ads or sponsored results, and we do not use your data for advertising.
The connector boundary, in one table:
| Data | Purpose | Stored? | Retained | Recipients | Your control |
|---|---|---|---|---|---|
| Tool inputs (search terms, identifiers, lists you submit) | Execute your request; provide your request history; detect repeat searches to help avoid duplicate lookups | Yes | Until you delete them or your account closes | BaseBara and its hosting providers only | Delete anytime; disconnecting stops all collection |
| Tool results | Deliver results and history to you; detect repeat searches to help avoid duplicate lookups | Yes | Until you delete them or your account closes | Returned to you through your AI assistant | Delete anytime |
| OAuth identifiers and tokens | Authenticate and secure your connection | Yes | Account identifiers and relationship records: account duration + 30 days; tokens: until revoked, disconnected, or the account closes, then revoked and deleted promptly from active systems, with backups expiring as described in Section 12 | BaseBara only (issued via your platform's OAuth flow) | Disconnect in your assistant's settings (revokes access) |
| IP address and security metadata | Fraud prevention, security, usage limits | Yes | Up to 12 months | BaseBara and its security service providers | Deleted with your account, except records needed for an active security investigation or legal obligation |
6. Business professionals and business contacts in the BaseBara Database
Why you may be in our database. If you work in a business role, your professional contact details may appear in the BaseBara Database, compiled from the sources in Section 2.3. Beta users look up this information for lawful business-to-business purposes: the professional equivalent of a business directory listing.
Your choices, free and available to everyone regardless of where you live:
- Opt out. Ask us to stop disclosing your record through the Services. Our opt-out is broader than the sale-focused opt-out some state laws describe, and we honor it even though we do not sell personal information. It requires only enough information to locate your record and takes effect within 15 business days.
- Delete my record. Deletion is permanent, so we first confirm the request through the business email address associated with the record (or comparable verification). Verified deletions are removed from the Database, added to a hashed suppression list so your record stays deleted as the Database is refreshed over time, and passed to the service providers that process data on our behalf with instructions to delete. If we cannot verify a deletion request, we will tell you why and will still opt the record out of disclosure.
- Access. Request a copy of the information we hold about you, its sources by category, our purposes, and the categories of recipients.
- Correction. Ask us to fix inaccurate information (verified the same way as deletion).
Submit any of these at https://www.basebara.com/privacy-center or privacy@basebara.com. You may use an authorized agent, who must provide proof of authorization. We may decline requests that we determine, in good faith and with documented reasons, to be fraudulent or abusive, and we will explain why. We will never discriminate against you for exercising your rights.
Fair Credit Reporting Act notice. BaseBara is not a consumer reporting agency as defined by the FCRA, and the Services do not constitute "consumer reports." BaseBara data may not be used, in whole or in part, to determine any person's eligibility for credit, insurance, employment, housing, or any other purpose that would require compliance with the FCRA. Our Terms of Use prohibit such uses.
7. Users: your choices
If you use BaseBara, you may access, correct, export, or delete your account data and your queries and submissions at any time via privacy@basebara.com or in-product controls where available. Disconnecting BaseBara in your AI assistant's settings stops all further collection, and when you close your account we delete this data on the schedule in Section 12, except where retention is required by law. The request channels, timelines, and appeal process in Section 9 apply equally here.
8. Cookies, analytics, and browser privacy signals
basebara.com uses strictly necessary cookies and limited first-party analytics to operate and improve the site. We do not use third-party advertising cookies, and we do not sell personal information collected through cookies. You can control cookies through your browser settings, and basebara.com recognizes browser opt-out preference signals such as the Global Privacy Control (GPC): browsers sending the signal have non-essential cookies and analytics suppressed.
9. United States privacy rights
We extend the following rights to all United States residents, whether or not your state mandates them: the right to know and access the personal information we have collected about you, and to receive it in a portable format; the right to correct inaccurate information; the right to delete; the right to non-discrimination for exercising your rights; and the right to appeal a decision we make about your request (reply to our response or email privacy@basebara.com with "Appeal," and a different reviewer will respond within 45 days; if you remain unsatisfied, you may contact your state attorney general).
How to exercise your rights: (1) the request form at https://www.basebara.com/privacy-center; (2) privacy@basebara.com. We confirm receipt within 10 business days and respond within 45 calendar days, extendable once by 45 days with notice. Opt-out requests are honored within 15 business days. Verification for access, correction, and deletion uses reasonable measures matched to the request, typically confirmation through the email address associated with the record or account.
Additional disclosures for California residents. In the preceding 12 months, we have collected the categories of personal information described in Sections 2.1–2.3, from the sources described there, for the purposes in Section 3, and disclosed them for business purposes to the recipients in Section 4. We have not sold or shared personal information, as the CCPA defines those terms, in the preceding 12 months. During the free early-access beta, we do not exchange BaseBara Database records or any other personal information for money or other valuable consideration ("sharing" under the CCPA refers specifically to disclosures for cross-context behavioral advertising, which we do not engage in). Apart from the OAuth tokens that operate your own connection, which we use solely to authenticate and secure the Services, we do not collect sensitive personal information, and we do not use or disclose personal information for purposes that would trigger the right to limit under California law. We do not use personal information for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects. We have no actual knowledge of selling or sharing the personal information of consumers under 16, and our database excludes minors. California residents may designate an authorized agent as described in Section 6.
10. International users and data location
The Services are operated from the United States, and the information we collect is processed and stored in the United States. The BaseBara Database is focused on United States business professionals; we do not knowingly include individuals located in the European Economic Area, the United Kingdom, or Switzerland. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.
11. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, logging and monitoring, and vendor security review. No method of transmission or storage is completely secure; if we discover a breach affecting your personal information, we will notify you and regulators as required by law. To report a suspected vulnerability or other security issue, contact security@basebara.com.
12. Retention
We keep personal information for the periods below (or shorter, where the purpose ends sooner), then delete or de-identify it. Deletion requests under Sections 6, 7, and 9 override these periods.
| Data | Retained |
|---|---|
| Your queries, submissions, and request history | Until you delete them or your account closes |
| Account and OAuth relationship records | Duration of the account + 30 days |
| Security and diagnostic logs (including IP metadata) | Up to 12 months, except records needed for an active security investigation or legal obligation |
| Deleted data in backups | Removed or irreversibly expired within 90 days of deletion |
| Support and privacy-request communications | Up to 2 years after resolution (privacy-request records are kept at least 24 months, as California regulations require) |
| Marketing and prospect communications | Until you opt out, or 24 months after our last interaction |
| BaseBara Database records | While the record remains reasonably current and accurate; records are continuously re-verified and refreshed, and removed on request as described in Section 6 |
| Hashed suppression-list entries | Indefinitely, solely so opted-out and deleted records stay out of the Database |
| Records required by law (e.g., tax, accounting, legal holds) | For the period the applicable law requires |
13. Children
The Services are intended for business use by adults. We do not knowingly collect personal information from anyone under 18, and the BaseBara Database excludes minors. If you believe we have information about a minor, contact privacy@basebara.com and we will delete it.
14. Changes to this Policy
We will post changes here with an updated "Last updated" date and maintain an archive of prior versions. For material changes (for example, if we introduce paid services or begin selling personal information as the law defines it), we will update this Policy beforehand, provide prominent notice, and implement any legally required mechanisms before the change takes effect.
15. Contact us
BaseBara, Inc. · Attn: Privacy privacy@basebara.com · Request form: https://www.basebara.com/privacy-center
If you have an unresolved concern, you may also contact your local consumer-protection or data-protection authority.