Privacy Policy

Last updated: August 24, 2026

This Privacy Policy explains how Homebasedao, Inc. ("Homebase," "we," "us") handles information in connection with the Homebase Investor Database (the "Service"). It covers two audiences: our subscribers and prospective subscribers, and the business contacts and firms listed in the database. This Policy is part of, and incorporates, our Terms of Service, including its disclaimers and limitations of liability.

Part A — Subscribers and prospective subscribers

Information we collect

• Account: your email address, used for sign-in via one-time magic links. If you submit a valid checkout form while our database is unavailable, we may retain that address in a monitored support inbox so we can send one service-recovery follow-up.
• Billing: handled by our payment processor, Stripe. We receive subscription status and identifiers; we do not collect or store your card number.
• Usage: the sign-ins, searches, reveals, follows, and exports you perform. We record these to meter your credit balance, apply per-subscriber export watermarks, prevent abuse, operate the Service, and understand and improve it.
• Session: a single first-party, HTTP-only session cookie. We do not use third-party advertising or cross-site tracking cookies.

How we use it and who we share it with

We use subscriber information to provide, secure, bill, and improve the Service. We share it only with processors that operate the Service on our behalf — Stripe (payments), Resend (transactional email), and Vercel and Turso (hosting and database) — and where required by law or to protect our rights. We do not sell subscriber personal information and do not share it for cross-context behavioral advertising. An address captured from an interrupted checkout is treated as unverified, is not added to a marketing list through this process, and may receive at most one transactional message after we confirm that checkout is available again.

Part B — Listed business contacts and firms

What data and where it comes from

The database contains business contact information about firms and their professional staff — such as firm name, professional role, business email, business phone, public company page, and investment focus. This information is compiled from publicly available sources, including firms' own public websites and public regulatory filings (such as SEC Form D), and business email addresses are checked for deliverability through a third-party verification service (MillionVerifier). We do not knowingly collect special categories of personal data, government identifiers, financial account numbers, or data about consumers or children, and the Service is directed only to business professionals.

Purpose and legal basis

We process this business-contact data to maintain a professional reference tool that helps subscribers identify and contact prospective investors for legitimate business-to-business purposes. Where the GDPR or UK GDPR applies, our legal basis is our legitimate interest (and our subscribers') in business networking and professional outreach, balanced against the limited, professional nature of the data. Because we obtain this data from public sources rather than from you directly, we rely on the disproportionate-effort exemption for individual source notices (Article 14(5)(b)) and provide this Policy instead; you may object to processing at any time (see below). We are the controller of this business-contact data; subscribers are independently responsible for their own use of it (see the Terms).

Your rights — access, correction, and removal

If you or your firm are listed, you may request access, correction, or deletion, and you may opt out of being included, regardless of where you live. Email info@homebasecre.com or use our removal page. We honor removal requests across the entire Service, including exports. Removals are permanent: we keep a minimal suppression record (a "tombstone") holding only the identifiers needed to keep the record suppressed, precisely so that a later data refresh cannot re-introduce a record you asked us to remove. Depending on where you live, you may have additional rights, including the right to object to processing, the right to restrict or delete, the right not to be discriminated against for exercising your rights, and the right to lodge a complaint with your data-protection supervisory authority. We respond to verifiable requests within the time required by applicable law, free of charge.

Your right to opt out of "sale" or "sharing"

We do not sell or share subscriber personal information (Part A). As to the business-contact data in the database (Part B): our subscription is a license to a compiled business-reference tool, and subscribers are contractually prohibited from reselling or redistributing the data. However, to the extent that making listed business-contact data available to subscribers is treated as a "sale" or "share" under the CCPA/CPRA or similar laws, you may opt out at any time, and being removed via our removal page or by emailing info@homebasecre.com operates as a permanent opt-out that we honor across the entire Service. We do not process this data for cross-context behavioral advertising and do not knowingly sell or share the personal information of anyone under 16.

Accuracy and your remedy

We compile business-contact data from public sources and do not warrant its accuracy, completeness, or currency. If a record about you is inaccurate or you do not wish to be listed, your remedy is correction or removal as described above, which we provide promptly and free of charge. To the maximum extent permitted by law, this correction-and-removal process is your sole and exclusive remedy with respect to your inclusion in the database, and the limitations of liability in the Terms of Service apply.

Retention

We retain subscriber account and billing records for as long as your account is active and as needed for legal, tax, and accounting purposes. We delete interrupted-checkout recovery notices after they are handled and, if unresolved, within 30 days. We retain database records until they are removed on request or as part of ordinary data maintenance; suppression tombstones are retained indefinitely to keep removals permanent.

Security

We use reasonable, industry-standard measures to protect information, including encrypted transport, hashed session tokens, and access controls. No system is perfectly secure, and we cannot guarantee absolute security.

International users

Homebase operates in the United States, and information is processed there. If you access the Service or are listed from outside the United States, you understand your information will be processed in the United States under this Policy.

Changes

We may update this Policy from time to time. Material changes will be posted here with a revised "last updated" date.

Contact

Privacy, removal, and all other requests: info@homebasecre.com. See also our Terms of Service.