Last updated: August 28, 2026
This Privacy Policy describes how Base Operations, Inc. (“we,” “us”) collects, uses, and shares personal information when you visit or use baseoperations.com (our marketing site), copilot.baseoperations.com (our Base Report product), the Base Operations Platform (our enterprise software), and our related products and services (collectively, the “Services”), including when you purchase a report or credits. This single policy applies across all of these surfaces.
1.1 Categories of Information. We collect the categories of personal information described in this Article 1 when you visit our websites, register for or administer an account, purchase or use the Services, or otherwise communicate with us. Some of this information you or your organization provides to us directly; some we collect automatically as you use the Services; and some we receive from our service providers and other third parties.
1.2 Account and Business Information. When you or your organization register for an account, or when we establish an account for you, we may collect your name, business email address, company name, job title or role, business telephone number, account credentials, and the settings and preferences associated with your account. Where your organization establishes the account, we may receive this information from your organization rather than from you directly. We collect this information in your business capacity.
1.3 Order and Payment Information. When you purchase a report or credits, we collect the details of your order, which include the products purchased, the quantity, the currency and amount charged, the date of the transaction, and your billing name and country. Payment is processed by our payment provider, Stripe, Inc. (“Stripe”), which acts as merchant of record for the transaction and collects and processes your payment card details and billing information directly. We do not receive or store full payment card numbers, expiration dates, or security codes. Stripe provides us with limited transaction data, which includes confirmation that payment was made, the last four digits and brand of the payment card, the billing name and country, and the amount charged. Stripe processes your information in accordance with its own privacy policy, and we encourage you to review it. We retain records of your orders in order to fulfil them, to service your account, and to meet our tax, accounting, and other legal obligations.
1.4 Communications. We collect the information that you provide when you contact customer support, request a demonstration of the Services, subscribe to a newsletter or mailing list, respond to a survey, or otherwise correspond with us. This information may include your contact details, the contents of your message and any attachments to it, and our record of the correspondence and of our response to it. We may record or transcribe a demonstration or a support call. Where we do so, we notify the participants before the recording begins, and a participant may ask us to delete the recording.
1.5 Device Information. When you visit or use the Services, we automatically collect certain information about the device you use and the manner in which you interact with the Services (“Device Information”). Device Information may include your browser type and version, your operating system, your internet protocol address, your time zone and language settings, the pages, features, and products that you view, the uniform resource locators that referred you to our websites and that you visit after leaving them, the dates and times of your visits, and the manner in which you interact with the pages and features presented to you. We may infer your approximate location, which includes your country, state, and city, from your internet protocol address. We do not collect precise geolocation data from your device. We collect Device Information using cookies, log files, web beacons, tags, pixels, and similar technologies, which are described further in our Cookie Declaration, and you may manage non-essential technologies as described in Article 5. Where we make a mobile application or a software development kit available, Device Information may also include unique device identifiers and information about the mobile device and its operating system.
1.6 Usage Information. We collect information about how you use the Services, which may include the reports you generate, the locations and geographies you query, the search parameters and filters you apply, the credits you purchase and redeem, the features you access, the content you submit to the Services, and the dates and times of your activity.
1.7 Content You Submit. You and your organization may submit content and data to the Services, which may include facility lists, travel itineraries, personnel locations, and similar information relating to identifiable individuals. Where that content is submitted by a business customer in connection with its use of the Base Operations Platform, Section 1.9 applies to it.
1.8 Information from Other Sources. We may receive information about you from our service providers, from analytics and advertising partners, from business-data providers, and from your organization, and we combine that information with the information described above. We also collect information from publicly available sources and from third-party data providers in order to produce the reports made available through the Services; that information relates to locations, events, and conditions rather than to you.
1.9 Matters Outside this Policy. This Policy does not apply to personal information that we process on behalf of, and under the documented instructions of, a business customer in connection with that customer’s use of the Base Operations Platform. In those circumstances we act as a service provider or processor, our handling of that information is governed by our agreement with that customer, and the privacy notice of that customer applies to it.
2.1 Generally. We use the personal information described in Article 1 for the purposes set out in this Article 2. We will not use your personal information for a purpose that is materially different from, or incompatible with, the purposes described in this Policy without providing you notice and, where required by applicable law, obtaining your consent.
2.2 Provision and Operation of the Services. We use personal information to provide, operate, maintain, and support the Services, which includes creating and administering your account, authenticating you and your authorized users, generating and delivering the reports and other outputs you request, making the Services available to you in accordance with your subscription or the credits you hold, responding to your support requests, and providing you with technical and account assistance.
2.3 Orders, Payments, and Credits. We use personal information to process your orders and payments, to issue, track, apply, and reconcile credits, to issue receipts and invoices, to administer refunds and chargebacks, and to maintain records of your transactions for tax, accounting, and audit purposes.
2.4 Communications. We use personal information to communicate with you, which includes sending administrative, transactional, and service messages relating to your account, your orders, and the availability or operation of the Services, responding to your inquiries, notifying you of changes to this Policy or to our other terms, and, where permitted by applicable law or where you have consented, sending you marketing communications from which you may unsubscribe at any time.
2.5 Improvement and Development. We use personal information to understand how the Services are used, to test, troubleshoot, and improve the Services, and to develop new features, products, and services.
2.6 Security, Fraud, and Abuse Prevention. We use personal information to protect the security and integrity of the Services and of our users, which includes verifying accounts and activity, detecting, investigating, and preventing fraud, unauthorized access, abuse, and misuse of the Services, monitoring for and responding to security incidents, and enforcing usage limits and access restrictions.
2.7 Analytics and Aggregated Information. We use personal information to produce analytics and statistical information about the use of the Services. We may create aggregated, anonymized, or de-identified information from personal information, and we may use and disclose that information for any lawful purpose, including to improve and market the Services and to produce industry reporting and benchmarks. Where we maintain information in de-identified form, we will maintain it in that form, will not attempt to re-identify it except as permitted by applicable law in order to test the effectiveness of our de-identification, and will contractually obligate any recipient of that information to the same commitments.
2.8 Legal Compliance and Enforcement. We use personal information to comply with applicable law and with our legal, regulatory, tax, and accounting obligations, to respond to lawful requests from governmental and regulatory authorities and to legal process, to establish, exercise, and defend legal claims, to enforce the End User License Agreement and our other terms and policies, and to protect the rights, property, and safety of Base Operations, our users, and the public.
2.9 Legal Bases for Processing. Where the General Data Protection Regulation of the European Union or of the United Kingdom applies to our processing of your personal information, we rely upon the following legal bases:
We do not process special categories of personal data within the meaning of Article 9 of the General Data Protection Regulation, and we ask that you not submit such data to us. Where we require personal information in order to enter into or perform a contract with you, and you do not provide it, we may be unable to provide the Services or to fulfil your order.
3.1 Generally. We disclose personal information to the categories of recipients described in this Article 3, and for the purposes described in Article 2. We do not disclose your personal information to third parties for their own independent purposes except as described in this Policy. Information that we hold in aggregated, anonymized, or de-identified form is not personal information, and we may use and disclose it as described in Section 2.7.
3.2 Service Providers and Processors. We disclose personal information to service providers and processors that perform functions on our behalf and in accordance with our instructions, which include payment processing, application hosting and infrastructure, database and storage services, authentication, website and product analytics, customer relationship management and marketing operations, and customer support tooling. Stripe processes payments and acts as merchant of record as described in Section 1.3. Each service provider is permitted to process personal information only for the purposes for which we engage it, is prohibited from using or disclosing that information for its own purposes, and is bound by written terms requiring it to maintain appropriate security measures.
3.3 Professional Advisors. We disclose personal information to our auditors, accountants, insurers, bankers, and legal counsel where necessary in order for them to provide professional services to us, in each case subject to obligations of confidentiality.
3.4 Corporate Transactions. We may disclose or transfer personal information in connection with, or during negotiations of or diligence conducted in contemplation of, any merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction. Any recipient of personal information in such a transaction will be bound to treat that information in a manner consistent with this Policy.
3.5 Legal and Protective Disclosures. We may disclose personal information where we believe in good faith that disclosure is required in order to comply with applicable law, to respond to a subpoena, court order, or other lawful request from a governmental or regulatory authority, to establish, exercise, or defend legal claims, to enforce the End User License Agreement and our other terms and policies, or to protect the rights, property, or safety of Base Operations, our users, or the public.
3.6 Disclosures to Your Organization. Where you access the Services through an account established by your employer or by another organization, that organization administers the account, and we may provide it with information relating to that account, which includes aggregated usage statistics and information concerning the use of the Services by its authorized users. Your use of the Services in those circumstances is also subject to the policies of your organization.
3.7 At Your Direction. We disclose personal information to any other person at your direction or with your consent.
3.8 No Sale of Personal Information. We do not sell your personal information, we have not sold personal information in the preceding twelve months, and we do not sell the personal information of any individual under sixteen years of age. For these purposes, a sale is the disclosure of personal information to a third party in exchange for monetary or other valuable consideration.
3.9 Cross-Context Behavioral Advertising. We disclose personal information, which includes identifiers and internet and other electronic network activity information, to advertising networks, social media platforms, and analytics partners that use that information to deliver advertising to you on websites and services other than our own. Those disclosures constitute sharing for cross-context behavioral advertising under the California Consumer Privacy Act and processing for targeted advertising under the privacy laws of other states. We do not share the personal information of any individual whom we know to be under sixteen years of age.
3.10 Opting Out of Sharing and Targeted Advertising. You may direct us at any time to stop sharing your personal information for cross-context behavioral advertising and to stop processing it for targeted advertising. You may do so by using the “Do Not Sell or Share My Personal Information” link, the “Your Privacy Choices” link, or a similar link in the footer of our websites, by sending an opt-out preference signal as described in Article 5, or by contacting us at the address set out in Article 11. An opt-out applies to the browser or device from which it is made and, where we can reasonably associate that browser or device with an account, to that account.
4.1 Retention Generally. We retain personal information for as long as is necessary for the purposes described in Article 2, and we do not retain it for longer than is reasonably necessary for those purposes. Where we no longer require personal information, we delete it or de-identify it.
4.2 Criteria for Retention. We determine the period for which we retain each category of personal information by reference to the purposes for which that category is processed and to the following criteria: the amount, nature, and sensitivity of the information; whether those purposes can be achieved by other means; the potential risk of harm arising from unauthorized use or disclosure; the duration of our relationship with you and with your organization; our need to resolve disputes and to enforce our agreements; and any period prescribed by applicable law. Applying those criteria, and subject to Sections 4.3 and 4.4, we retain account and business information for so long as the account remains open and for such further period as is necessary in order to conclude our relationship with you and your organization; order and payment information for the period prescribed by the tax, accounting, and recordkeeping laws to which we are subject; communications for so long as is necessary in order to address the matter to which they relate and to maintain a record of it; Device Information and usage information for the period necessary for the analytics, security, and product development purposes for which they are collected; and information concerning your marketing preferences for so long as is necessary in order to give continuing effect to any opt-out you have exercised.
4.3 De-identified and Aggregated Information. This Article does not apply to information that we hold in aggregated, anonymized, or de-identified form, which we may retain and use as described in Section 2.7.
4.4 Backups and Legal Holds. Where we delete personal information, we remove it from our active systems, and any copy retained in a backup or archive is deleted or overwritten in the ordinary course of our backup cycle. We retain personal information notwithstanding the periods described in Section 4.2 where we are required to do so by applicable law, or where that information is relevant to an actual or anticipated legal claim, investigation, or regulatory proceeding, and in each case for so long as that requirement or that matter subsists.
5.1 Cookies and Similar Technologies. You may manage non-essential cookies and similar technologies through the cookie banner presented on our websites, through the controls described in our Cookie Declaration at https://www.baseoperations.com/cookie-declaration, and through your browser settings. Where required by applicable law, non-essential cookies and similar technologies are set only after you have given your consent through that banner. Technologies that are strictly necessary in order to deliver the Services cannot be disabled through those controls, and blocking certain technologies may affect the manner in which the Services function.
5.2 Marketing Communications. You may opt out of marketing communications at any time by using the unsubscribe link contained in any marketing email or by contacting us at the address set out in Article 11. We will continue to send you administrative, transactional, and service messages relating to your account and your orders, which are not marketing communications.
5.3 Opt-Out Preference Signals. We recognize the Global Privacy Control signal and other opt-out preference signals, and we treat such a signal as a valid request to opt out of the sale or sharing of personal information and of the processing of personal information for targeted advertising. We do not require you to verify your identity, or to provide any information beyond that necessary to send the signal, in order for us to give effect to it. We treat a signal as applying to the browser or device from which it is sent and to any profile associated with that browser or device, and, where we can reasonably associate that browser or device with an account, to that account. Section 3.10 describes the other methods by which you may opt out.
5.4 Do Not Track and Other Browser Signals. We give effect to those browser-based signals that we recognize as opt-out preference signals, in the manner described in Section 5.3. A browser signal that we do not recognize as an opt-out preference signal, including a “Do Not Track” header sent otherwise than as an opt-out preference signal, does not alter our collection or use of personal information, and no common standard governing “Do Not Track” signals has been adopted. Third parties, including the advertising networks and analytics partners described in Section 3.9, may collect personal information about your online activities over time and across different websites when you use the Services.
5.5 Your Account. You may review and update the personal information associated with your account through the Services or by contacting us at the address set out in Article 11. Where your account has been established by your organization, we may direct your request to that organization or ask you to submit it through your organization.
5.6 Additional Rights. Article 6 describes the rights available to residents of California and of other states, and Article 7 describes the rights available where the General Data Protection Regulation applies. The choices described in this Article 5 are available to you irrespective of where you reside.
6.1 Application. This Article 6 applies to residents of California and of other states whose privacy laws confer the rights described below. Those laws differ from one another, and a right described in this Article is available to you only to the extent that the law of your state confers it.
6.2 Categories of Personal Information Collected. In the preceding twelve months we may have collected the following categories of personal information: identifiers, which include your name, business email address, business telephone number, account credentials, and internet protocol address; commercial information, which includes records of the orders you place and of the reports and credits you purchase and redeem; internet and other electronic network activity information, which includes Device Information and your browsing and interaction history on our websites; geolocation data, which includes the locations you query and the approximate location we derive from your internet protocol address; professional or employment-related information, which includes your company name and your job title or role; and inferences drawn from any of the foregoing. Article 1 describes these categories in greater detail.
6.3 Sources and Recipients. We collect personal information from the sources described in Article 1. We disclose each category described in Section 6.2 to the categories of recipients described in Article 3, in each case for the purposes described in Article 2, and we share the categories described in Section 3.9 for cross-context behavioral advertising.
6.4 Purposes and Retention. Article 2 describes the purposes for which we collect and use each category of personal information, and Article 4 describes the periods for which we retain it.
6.5 Sensitive Personal Information. Certain of the personal information described in Section 6.2 may be sensitive personal information, for example your account credentials, which permit access to your account. We collect, use, and disclose that information solely in order to provide, authenticate, and secure the Services, and otherwise for the purposes in respect of which the right to limit the use and disclosure of sensitive personal information does not apply. We do not use or disclose it in order to infer characteristics about you, and we do not collect any other category of sensitive personal information.
6.6 Your Rights. Subject to the exceptions provided by applicable law, you have the right to know what personal information we collect, use, disclose, and share and to access a copy of it; to correct inaccurate personal information; to delete personal information; to obtain your personal information in a portable form; to opt out of the sale or sharing of personal information and of the processing of personal information for targeted advertising, as described in Section 3.10; to limit our use and disclosure of sensitive personal information, where we collect it; and, under the laws of several states, to appeal a decision we make in respect of your request.
6.7 Non-Discrimination. We will not deny you goods or services, charge you a different price or rate, provide you a different level or quality of goods or services, or otherwise discriminate or retaliate against you because you have exercised a right described in this Article 6.
6.8 Exercising Your Rights. You may exercise a right described in this Article by contacting us at support@baseoperations.com or at the address set out in Article 11 and, in the case of an opt-out, by the methods described in Section 3.10. We will verify your request to the extent required by applicable law, and we may decline to act upon a request that we are unable to verify. You may use an authorized agent to submit a request on your behalf, in which case we may require written proof of that agent’s authority and may require you to verify your identity with us directly.
6.9 Appeals. Where we decline to act upon your request, you may appeal that decision by contacting us at the address set out in Article 11 and identifying the request and the grounds of your appeal. We will inform you in writing of the outcome of the appeal and, where the appeal is unsuccessful, of the manner in which you may submit a complaint to the attorney general or other regulatory authority of your state.
6.10 Direct Marketing Disclosures. We do not disclose personal information to third parties for those third parties’ own direct marketing purposes.
7.1 Application and Controller. This Article 7 applies where the General Data Protection Regulation of the European Union or of the United Kingdom applies to our processing of your personal data. In that case Base Operations is the controller of that personal data, and the provisions of this Article are in addition to, and prevail over any inconsistency with, the remainder of this Policy.
7.2 Legal Bases and Retention. Section 2.9 sets out the legal bases upon which we rely for each purpose for which we process personal data, and Article 4 describes the periods for which we retain it.
7.3 Your Rights. Subject to the conditions and exceptions provided by applicable law, you have the right to request access to your personal data; to request the rectification of personal data that is inaccurate or incomplete; to request the erasure of your personal data; to request that we restrict our processing of it; to object to our processing of it, including processing carried out on the basis of our legitimate interests and processing for direct marketing purposes; to receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another controller; not to be subject to a decision based solely upon automated processing which produces legal effects concerning you or similarly significantly affects you; and, where we rely upon your consent, to withdraw that consent at any time. We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you.
7.4 Exercising Your Rights and Complaints. You may exercise a right described in this Article by contacting us at the address set out in Article 11, and we may ask you for information reasonably necessary in order to confirm your identity. You are also entitled to lodge a complaint with the supervisory authority of the member state of your habitual residence, of your place of work, or of the place of the alleged infringement, and, in the United Kingdom, with the Information Commissioner.
7.5 International Transfers. We process personal data in the United States. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely upon the Standard Contractual Clauses approved by the European Commission, together with the International Data Transfer Addendum issued by the Information Commissioner where the transfer is made from the United Kingdom, and upon such supplementary measures as may be required, or otherwise upon a lawful transfer mechanism available to us. You may request a copy of the mechanism upon which we rely by contacting us at the address set out in Article 11.
8.1 Security Measures. We maintain technical, physical, and organizational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure of or access to that information, appropriate to the nature of the information and to the risks involved.
8.2 No Guarantee. No method of transmission over the internet and no method of electronic storage is completely secure, and, although we take the measures described in Section 8.1, we cannot guarantee the absolute security of personal information.
8.3 Your Responsibilities. You are responsible for maintaining the confidentiality of your account credentials, for restricting access to the devices through which you access the Services, and for notifying us promptly at the address set out in Article 11 of any suspected unauthorized use of your account.
9.1 Intended Users. The Services are intended for use by businesses and by individuals who are at least eighteen years of age and who access the Services on behalf of an organization. The Services are not directed to children.
9.2 No Knowing Collection. We do not knowingly collect personal information from any individual under sixteen years of age. Where we learn that we have collected personal information from such an individual, we will delete that information.
9.3 Parents and Guardians. A parent or guardian who believes that we may hold personal information relating to a child may contact us at the address set out in Article 11, and we will take steps to delete that information.
10.1 Amendments. We may amend this Policy from time to time in order to reflect changes in our practices or for other operational, legal, or regulatory reasons. Where we do so, we will revise the date stated at the beginning of this Policy.
10.2 Notice of Material Changes. Where an amendment is material, we will provide additional notice before the amendment takes effect, by posting a notice on our websites or by sending a message to the email address associated with your account, and we will obtain your consent to the amendment where applicable law requires it.
11.1 Contact Details. If you have any questions about this Policy or our privacy practices, if you wish to exercise a right described in this Policy, or if you wish to make a complaint, you may contact us at: Base Operations, Inc., 650 Massachusetts Ave NW, Ste 600, Washington, D.C., 20001, USA, or by email at support@baseoperations.com.
