Privacy notice

Dashboard activity

While you use a signed-in customer or partner dashboard, we record its recent activity time so authorised staff can see whether you are online and when you were last active. This does not record page contents, keystrokes or form values, and it is not shared with other customers or partners.

Your account

Your name, email address and country, and a record of when you signed in and from which network address.

Your company

Its name, state and type, its members and their ownership, addresses, the file number and EIN once issued, and the facts on the EIN application, such as what the business does and a contact number.

Identity documents

We don't ask for one. Forming your company doesn't need a passport, so we don't collect one, and where a bank or an agency needs to see who you are, you give it to them directly. Any passport we collected before 19 September 2026 is deleted automatically 30 days after the company was filed.

Documents

The files you and your team keep in Documents. If you send someone a file request, the files they upload and the name they give, which is kept with each file. They can't see anything else you store.

Mail

Where you have a US mailing address with us, scans of the envelopes and contents of mail addressed to your company.

Payments

What you bought and when. You enter card details on Stripe’s pages, so they never reach our servers. We keep a reference to your Stripe customer record, not the card.

Bookkeeping

If you connect Mercury, Stripe or Wise, or upload a bank statement, the company's transactions and the categories they're given. The read-only keys you create for the feeds are stored encrypted.

Contractors

If you use the contractor register, your US contractors' names, addresses and tax identification numbers from the W-9 forms they fill in. Tax identification numbers are stored encrypted.

The assistant

The questions you ask the assistant in your dashboard, and its answers.

Messages

Support conversations and anything you email us.

Abuse reports and copyright notices

If you report abuse or send us a copyright notice, your name, contact details and what you send us, used only to deal with it.

Name checks

If you ask us to check a company name on our site, the name, the state and your email address, so we can email you the answer. We don't use that address for anything else, and we delete the request when you ask.

Visits

On our public site and order form: which pages are opened, the site that sent the visit, the country and city it came from, and the browser and kind of device. We also note which steps of the order form you reach, and when you start an order and pay for one, with the plan and what you paid us. Google Analytics counts these for us. When you pay, our server confirms it to Google, using the visitor number Google's cookie gave your browser; without that cookie, nothing is sent. Google isn't told your name, your email or anything in your dashboard, which isn't counted at all. Before a visit is counted, we remove anything in the address that belongs to you, such as an invitation link or a referral code. We keep the code an advertisement adds to its link, so Google can tell which ad brought the visit.

Where your visit came from

The link that brought your first visit: the campaign tags on it, the click identifier an advertising network added to it, the site that sent it and the page it landed on. Your browser keeps this in its own storage for 90 days, sends it nowhere, and it is written to your order if you place one, so we know which advertisement or link led to it.

We use your data to form and run your company. That means preparing and filing documents with the state, applying for your EIN with the IRS, checking who you are before we sign anything in your name, acting as your registered agent, receiving and scanning your mail, keeping your compliance calendar, and answering you when you write. We also use it to run the service itself: to sign you in, prevent abuse, take payment, fix errors, see which pages people read, and keep the records the law requires a filing agent to keep. If we find, or are told, that a site, app, email account or number we run for you breaks our terms, we may look at its code, content and logs, and at the record of what it has sent. We send you occasional product news and offers only if you've switched them on.

Where data protection law asks for a legal basis, ours is the contract between us for the services, our legal obligations as a filing agent, and our legitimate interest in running a secure service. We send product news and offers only with your consent. In the European Economic Area, the United Kingdom and Switzerland, we count your visits with Google Analytics only with your consent too.

Government agencies see what a filing needs: the Secretary of State of the state you chose, and the IRS for your EIN. The people on our team who work on your company see it, and so does anyone you invite to your company in the app, at the level of access you give them. So do the providers that run parts of the service for us, each under contract and only for that purpose:

• Stripe, for payments.
• Resend, for sending email.
• Vercel, which runs the site, and Neon, which hosts our database.
• Cloudflare, whose private storage holds your documents, and whose browser takes the picture of your website's home page that your dashboard shows.
• Sentry, which records errors so we can fix them. It isn't sent your cookies or sign-in details.
• Meta, which is told when an order is started and when one is paid for, in the scrambled form described below the list, so we can tell which advertisement led to it.
• Google, which counts visits to our public site and order form through Google Analytics, and is told when an order that began with one of our Google advertisements is started and paid for, as described below the list. Google also sees data if you sign in with Google, play one of our videos on a guide, or ask the assistant in your dashboard a question. The assistant sends your question and a short summary of your company, such as names, dates and deadlines, to Google's Gemini model. It never sends the contents of your documents or your bank transactions.
• Openprovider, which registers your domain in your company's name, if you have one with us, and runs the mailboxes for your business email, if you have it.
• Amazon Web Services, whose Lightsail servers run your managed WordPress sites and Managed Apps, if you have them.
• GitHub, which builds your Managed Apps from your repository before we run them.
• Cloudflare and Google, if you write to one of our @baseacross.com addresses. Cloudflare Email Routing receives the message and passes it to a Gmail inbox, where we read it.
• SignalWire, if you have a US business phone number with us. It carries your calls and texts, and holds voicemails and any call recordings until you release the number.
• A USPS-registered commercial mail receiving agency, for the US mailing address, where you have one.
• Banks we introduce you to, only when you ask us to make the introduction.

We don't sell personal data. When you start an order and when you pay for one, we tell Meta, so that we can see which of our advertisements led to it: a scrambled form of your email address and country that Meta can only match against its own records, and the network address and browser type the order was started from. It is not sent your name, your company or your card, and nothing is set in your browser for it. If you came to us from a Google advertisement, we tell Google too, so that we can see which one led to it: the code that advertisement added to its link, when you started the order and when you paid, and what you paid us. Nothing else is sent, and we don't do this for people living in the European Economic Area, the United Kingdom or Switzerland. We'll disclose personal data if the law requires us to, and we may keep a copy of what we disclosed for that purpose. We'll tell you when we're allowed to.

The service runs on servers in the United States. Your data is encrypted while it travels and while it's stored. Documents sit in private storage with no public access. They leave it through links issued to a signed-in member of your company, which expire within minutes, or through a share link a member makes for one file. A share link works until it's turned off or runs out, and every open is recorded. Bank feed keys and contractors' tax identification numbers are encrypted again on top of that. Every change to a company record goes into an audit log showing who made it and when, and you can ask us for that record.

We keep your data for as long as your company is with us. After that, we keep what the law requires a filing agent to keep about what it filed, which in most cases means several years. Any passport we collected in the past is deleted automatically 30 days after the company was filed, or 30 days after it was uploaded if that's later. Mail scans stay until you delete them or close the address. Voicemails, and call recordings on a number where you've turned recording on, stay until you release the number. We keep a backup copy of the files in Documents so they can't be lost. When you delete a file, its backup copy is deleted 30 days later. If you close your account, we remove everything we're not required to keep.

You can see and download what we hold about your company from your account at any time. You can ask us to correct anything that's wrong, give you a copy of your personal data, delete it where we're not required to keep it, or stop sending you product news and offers, which you can also turn off in your settings. If you're in the United Kingdom or the European Economic Area, you have these rights under the GDPR, including the right to complain to your data protection authority. If you're in California, you have them under the CCPA. Email privacy@baseacross.com and we'll answer within thirty days.

We set cookies that keep you signed in. They're set when you sign in, they aren't used to track you across other sites, and you're signed out after thirty days without a visit. On our public site one more, ba_in, notes that you're signed in and whether partner navigation should take priority, so the header can show My Base or Partner Dashboard; it holds no name or account identifier and lasts thirty days.

We count visits to our public site and order form with Google Analytics, which sets its own cookies, named _ga, for up to 13 months. In the European Economic Area, the United Kingdom and Switzerland we ask first, and nothing is counted until you say yes. Everywhere else it is on from your first visit. Wherever you are, Cookie choices at the foot of any page turns it off, and one more cookie remembers your answer for 13 months.

Some of our country guides include one of our videos. On the guide, nothing from YouTube loads until you press play. Each video also has a page of its own, and there the player loads with the page. Either way the player comes from YouTube's privacy-enhanced service, and YouTube may store information in your browser under Google's own privacy policy.

When you allow analytics, we also record visits from partner links. We keep the first public page, campaign labels and a random browser-tab visit ID, with a 30-minute inactivity window. Subsequent page views are not recorded for partner reports. If a qualifying paid purchase is linked to that visit, the partner can see that it converted, without customer names, emails or IP addresses. Visit records are deleted after 90 days by our scheduled retention job. Declining analytics or sending a Do Not Track or Global Privacy Control signal prevents this collection.

We use no advertising cookies.

If we change this notice in a way that affects you, we'll email you before it takes effect. The date at the top is always the date of the current version.