Legal Policies

This Privacy Policy describes how HomeBase CRM, Inc. collects, uses, discloses, and protects your personal information when you use our CRM platform. Please read this policy carefully to understand our practices regarding your personal information.

ARTICLE 1 — INFORMATION WE COLLECT

1.1 Information You Provide. We collect information you provide directly to us, including:

• Account Information: name, email address, phone number, company name, job title, profile photo.
• Business Data: contacts, leads, clients, prospects, vendors, team members with their names, emails, phones, addresses, notes, and interaction history.
• Transaction Data: property addresses, purchase prices, commission amounts, closing dates, contract terms, transaction documents.
• Communication Content: emails, SMS messages, call recordings, meeting notes, correspondence with contacts.
• Calendar Data: appointments, meetings, showings, open houses, deadlines, events with attendees and locations.
• Payment Information: credit card numbers, billing addresses, payment history (processed by third-party payment processors).
• Support Communications: customer support requests, feedback, survey responses.

1.2 Information Collected Automatically. When you access the Platform, we automatically collect:

• Usage Data: features accessed, pages viewed, time spent, click patterns, search queries, files downloaded.
• Device Information: device type, operating system, browser type, IP address, unique device identifiers.
• Location Data: approximate location derived from IP address, precise location with consent (for mobile features).
• Log Data: server logs, access times, referring URLs, error reports, performance metrics.

1.3 Information from Third Parties. We may receive information about you from third parties, including:

• Integrated Services: Google, Microsoft, JustCall, Zoom, MLS providers (contact data, calendar events, communication logs).
• Lead Providers: lead generation services, marketing partners, referral sources.
• Public Sources: public records, social media platforms, business directories.
• Data Append Services: skip tracing, property records, valuation services.

ARTICLE 2 — HOW WE USE INFORMATION

2.1 Primary Purposes. We use the information we collect to:

• Provide, maintain, and improve the Platform and services;
• Process transactions and send related information;
• Send service communications, updates, and security alerts;
• Respond to comments, questions, and support requests;
• Personalize user experience and deliver relevant content;
• Generate AI-powered insights, coaching, and recommendations;
• Analyze usage patterns and trends to improve functionality;
• Detect, investigate, and prevent fraud, security breaches, and prohibited conduct;
• Comply with legal obligations and enforce Terms of Service;
• Facilitate business transfers, mergers, or acquisitions.

2.2 Legal Basis for Processing (GDPR). For EU/UK users, we process personal data under the following legal bases:

• Contract Performance: Processing necessary to provide services under our Terms of Service.
• Legitimate Interests: Processing for service improvement, security, fraud prevention, marketing (where not overridden by your rights).
• Consent: Processing based on your explicit consent (e.g., marketing communications, certain cookies).
• Legal Obligation: Processing required to comply with applicable laws and regulations.

GOOGLE USER DATA

Purpose. HomeBase is a CRM for real estate agents. When you choose to connect your Google account, HomeBase accesses Google user data only to provide the following user-facing features to you, the signed-in agent:

• Google Sign-In: Your name, email address, and profile picture, used to create and secure your HomeBase account.
• Gmail: Reading, sending, composing, and organizing (labeling, starring, archiving) your email so you can manage client communication inside HomeBase and link messages to your contacts and deals.
• Google Calendar: Reading and writing calendar events so your showings, closings, and appointments stay in sync between HomeBase and your Google Calendar.

Limited Use. HomeBase's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not sell Google user data, and we do not use or transfer it for advertising, including retargeting or personalized ads.
• We do not use Google user data to determine creditworthiness or for lending purposes.
• We do not use Google user data to develop, improve, or train generalized AI or machine learning models.
• We transfer Google user data to others only when necessary to provide these features, to comply with law, or as part of a merger or acquisition with notice to you.
• No HomeBase staff read your Google user data unless you give explicit permission (for example, for support), it is needed for security purposes, or it is required by law.

Storage and Deletion. Google access tokens are transmitted over encrypted connections and stored securely on our servers, where they are accessible only by our backend systems and are never exposed to your browser or to other users. You can delete your HomeBase account and all associated data, including stored Google tokens, at any time from your Profile page or by contacting us. For full removal, you can also revoke HomeBase's access to your Google account from your Google Account security settings (myaccount.google.com/permissions), which immediately stops all further access.

ARTICLE 3 — INFORMATION SHARING AND DISCLOSURE

3.1 No Sale of Data. We do not sell your personal information to third parties for their marketing purposes.

3.2 Service Providers. We share information with third-party service providers who perform services on our behalf, including:

• Hosting and Infrastructure: AWS, Cloudflare (data storage, CDN, security).
• Communication Services: JustCall (calls and SMS), email delivery providers.
• Video Conferencing: Zoom (virtual meetings, recordings).
• Calendar Integration: Google, Microsoft (calendar sync, event management).
• Payment Processing: Stripe, Wix Payments (payment processing, fraud prevention).
• MLS Data: Multiple listing service providers (property listings, market data).
• AI Services: OpenAI, Anthropic, Google (AI-powered features, with data processing agreements).
• Analytics: Google Analytics, Mixpanel (usage analytics, performance monitoring).
• Customer Support: Support ticketing systems, live chat providers.

3.3 Legal Requirements. We may disclose information if required by law, subpoena, court order, or government request, or when we believe disclosure is necessary to protect our rights, your safety, or public safety.

3.4 Business Transfers. In connection with any merger, acquisition, reorganization, bankruptcy, or sale of assets, customer information may be transferred as part of the transaction.

3.5 With Your Consent. We may share information with third parties when you explicitly consent to such sharing.

ARTICLE 4 — DATA RETENTION

4.1 Retention Period. We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

4.2 Account Data. Account information is retained while your account is active and for 90 days after account closure or termination.

4.3 Business Records. Transaction records, financial data, and legal documents are retained for periods required by applicable laws (typically 7 years for tax and legal compliance).

4.4 Backup Data. Backup copies of deleted data are retained for 90 days, after which they are permanently deleted.

4.5 Anonymized Data. We may retain anonymized, aggregated data for analytics and business intelligence purposes indefinitely.

ARTICLE 5 — YOUR RIGHTS AND CHOICES

5.1 Access and Portability. You have the right to access your personal information and receive a copy in a structured, commonly used, machine-readable format.

5.2 Correction. You have the right to correct inaccurate or incomplete personal information.

5.3 Deletion. You have the right to request deletion of your personal information, subject to certain exceptions (legal obligations, fraud prevention, legitimate business purposes).

5.4 Restriction. You have the right to restrict or object to certain processing of your personal information.

5.5 Marketing Opt-Out. You may opt out of marketing communications at any time via unsubscribe links or account settings.

5.6 Cookie Controls. You may manage cookie preferences through browser settings or our cookie management tool.

5.7 CCPA Rights (California). California residents have additional rights: right to know categories of personal information collected, right to delete, right to opt-out of sale/sharing, right to correct, right to limit use of sensitive personal information, right to non-discrimination.

5.8 GDPR Rights (EU/UK). EU/UK residents have additional rights: right to access, rectification, erasure, restriction, data portability, objection to processing, withdrawal of consent, right to lodge complaint with supervisory authority.

5.9 Exercising Rights. To exercise your rights, contact us at privacy@homebase.app. We will respond within 30 days (45 days for CCPA requests). We may require verification of your identity.

ARTICLE 6 — DATA SECURITY

6.1 Security Measures. We implement administrative, physical, and technical safeguards designed to protect personal information, including:

• Encryption: AES-256 encryption at rest, TLS 1.3 encryption in transit.
• Access Controls: Role-based access, multi-factor authentication, least privilege principles.
• Monitoring: 24/7 security monitoring, intrusion detection, anomaly detection.
• Testing: Regular vulnerability scans, penetration testing, security assessments.
• Training: Employee security awareness training, confidentiality agreements.
• Certifications: SOC 2 Type II compliance, GDPR compliance measures.

6.2 Breach Notification. In the event of a data breach affecting your personal information, we will notify you and applicable authorities within 72 hours of discovery, as required by law.

6.3 No Guarantee. While we strive to protect your personal information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

ARTICLE 7 — INTERNATIONAL DATA TRANSFERS

7.1 Transfer Mechanisms. Your personal information may be transferred to and processed in countries other than your country of residence. We use the following mechanisms to ensure adequate protection:

• EU-U.S. Data Privacy Framework: Certification for transfers to the United States.
• Standard Contractual Clauses: EU-approved contractual safeguards for transfers outside the EEA.
• Adequacy Decisions: Transfers to countries with adequacy decisions from the European Commission.

7.2 Your Rights. You may request information about the specific safeguards used for international transfers by contacting privacy@homebase.app.

ARTICLE 8 — COOKIES AND TRACKING

8.1 Cookie Types. We use the following types of cookies:

• Essential Cookies: Required for core functionality (authentication, security).
• Functional Cookies: Remember preferences and settings.
• Analytics Cookies: Understand usage patterns (Google Analytics).
• Marketing Cookies: Measure campaign effectiveness.

8.2 Third-Party Cookies. Third-party service providers may set cookies when you use the Platform. Their use is governed by their own privacy policies.

8.3 Cookie Management. You may manage cookie preferences through browser settings or our cookie management tool. Disabling essential cookies may impair Platform functionality.

8.x Digital Business Cards and Shared Links. When a HomeBase user shares a digital business card or other shareable link, HomeBase records interactions with it, such as when the card is opened, which buttons or links are tapped, and whether the contact card is saved. If the user sent a personalized link to a specific recipient, those interactions are associated with that recipient's record in the user's CRM and are visible only to that user. Anonymous visitors are not identified by device fingerprinting, IP matching, or third-party identity data; a visitor is identified only if they received a personalized link or choose to share their own information. Recipients may ask the sending agent, or contact HomeBase, to have this activity deleted.

ARTICLE 9 — CHILDREN PRIVACY

9.1 Age Restriction. The Platform is not intended for children under 18 years of age. We do not knowingly collect personal information from children.

9.2 Parental Rights. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at privacy@homebase.app to request deletion.

ARTICLE 10 — CHANGES TO THIS POLICY

10.1 Updates. We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notice at least 30 days before the effective date.

10.2 Acceptance. Your continued use of the Platform after the effective date of changes constitutes acceptance of the updated policy.

ARTICLE 11 — CONTACT US

Privacy Inquiries: privacy@homebase.app

Data Protection Officer: dpo@homebase.app

Mailing Address:
HomeBase CRM, Inc.
Attn: Privacy Department
123 Innovation Drive, Suite 400
Wilmington, DE 19801
United States of America

EU Representative: For EU/UK users, our GDPR representative can be contacted at eu-rep@homebase.app

© 2026 HomeBase CRM, Inc. All rights reserved.