Privacy Statement

1. About this statement

Base PM is a product of Base Management Trading Pty Ltd (ABN 73 700 115 466, ACN 700 115 466), an Australian proprietary limited company. In this statement, "Base PM", "we" and "us" mean that company — it is the entity responsible for the personal information described here, and the one you deal with under the Australian Privacy Principles (APPs).

We operate a software-as-a-service platform for construction project management, estimating, site compliance and AI-assisted document and communication handling. We are committed to handling personal information openly and responsibly.

This statement applies to personal information we collect through the Base PM web and mobile applications, the public portals we host on behalf of our customers (client, tender, subcontractor, site sign-in, form and e-signature pages), our marketing site, support channels and any related services. By using Base PM you consent to the practices described here.

2. The kinds of information we collect

The categories of personal information we collect depend on how you and your organisation use the Service. They typically include:

3. How we collect personal information

• From you directly — when you sign up, configure your account, upload documents, send a chat message to an AI assistant, or contact us.
• From your team — when an administrator invites you to a workspace or assigns you to a project.
• From accounts you connect — Gmail, Google Calendar, Microsoft Outlook and Xero, when you authorise those connections. Mailbox connections keep collecting new messages until you disconnect (sections 6 and 7).
• From people your organisation deals with — when a client, subcontractor, supplier, worker or visitor uses a portal, sign-in page, form or signature page that we host for you, or replies to an email or message sent from the Service.
• From public registers and directories — the Australian Business Register, ASIC and QBCC datasets, and trade directories, when you verify a business or search for one.
• From other AI assistants — when you connect Base PM to a third-party AI client (section 12), the instructions you give that client reach us.
• Automatically — through cookies and logs when you use the Service.

Often you will give us personal information about other people — a client's contact details, a subcontractor's licence, a worker's phone number, or the contents of an email thread. You must have a reasonable basis for sharing that information with us and, where required, you must tell the individual that their information will be handled in accordance with this statement. A connected mailbox contains mail from many people; by connecting it you confirm you are entitled to bring that mail into your workspace.

4. Why we collect, hold, use and disclose personal information

We use personal information to:

• Create and operate your account and provide the Service;
• Process AI assistant requests, including reading and summarising the documents you upload, filing and triaging email, producing estimates, drafting correspondence and other outputs you ask for;
• Run the automations your organisation turns on (for example, filing an inbound email against a project and creating a task from it);
• Keep site, safety and compliance registers that your organisation is required to keep;
• Send, receive and record email, SMS and WhatsApp communications on your behalf;
• Bill subscriptions, meter AI usage and process payments;
• Verify businesses, licences and identities where you ask us to;
• Provide customer support and respond to enquiries;
• Send service notifications (billing receipts, security alerts, important changes to the Service);
• Send product updates and marketing where you have opted in (you can opt out at any time);
• Monitor for abuse, fraud and security incidents and comply with our legal obligations; and
• Improve and develop the Service, using aggregated and de-identified usage metrics.

We do not use personal information for advertising, and we do not sell it.

5. AI processing

Base PM uses third-party large language and vision model providers to power its AI Features. When you send a chat message, ask the assistant to work with a document or record, or an automation runs on your behalf:

• The prompt, the relevant Customer Data (for example a PDF, an email, a site photo, a financial report or project records) and necessary context are sent to a model provider over an encrypted connection.
• The model provider processes the request and returns a response. We store the prompt and the response in your workspace so you can revisit them.
• Short text passages (document page descriptions, rate-book entries, saved notes) are also converted into numerical embeddings so they can be searched.

Which providers

Our primary model provider is Anthropic. Depending on the task, its cost and the model settings in force, a request may instead be routed through OpenRouter to a model operated by Alibaba (Qwen), DeepSeek, OpenAI, Google (Gemini), xAI (Grok), Zhipu AI (GLM) or TypeSafe; embeddings are generated by OpenAI; and rendered drawing pages are sent to a GPU service hosted on RunPod for symbol detection. Providers are listed in section 8. We may add or change providers; where that materially changes where your data is processed we will update this statement.

No training on your data

Your Customer Data is not used to train or improve foundation or general-purpose models — not by us, and not by our providers. We use providers under API terms, or under settings, that exclude our traffic from model training, subject only to short-term abuse-monitoring retention some providers require. We do not route requests to a provider that reserves the right to train on inputs.

AI outputs may be inaccurate. You must review them before relying on them. We do not make automated decisions that produce legal or similarly significant effects on individuals; where an automation would send a message to someone outside your organisation, it drafts for a person to approve unless your administrator has expressly turned on unattended sending.

6. Google user data (Gmail and Google Calendar)

Base PM offers optional connections to Gmail and Google Calendar. Nothing in this section applies unless you choose to connect a Google account. This section, together with the rest of this statement, is our disclosure for the purposes of the Google API Services User Data Policy.

6.1 What we ask permission for, and why

6.2 How Gmail data flows through Base PM

• What is read. From the moment you connect, Base PM checks your mailbox for new messages about every 90 seconds and reads each new message in full — headers, sender, recipients, subject, body and attachment list. Mail that existed before you connected is not read, except (a) when you run a receipt scan over a date range you choose, or (b) when you or the assistant search your mailbox for a specific message.
• What is stored. For each new message we store the Gmail message and thread identifiers, the addresses, subject, message text and the list of attachments in your organisation's workspace. Attachments to messages that match a project are downloaded and stored as project documents. Receipts you scan are stored as receipt records with their image.
• Who can see it. Messages brought into the workspace are part of your organisation's records: other members of your organisation can see them on the project, lead and contact they relate to, and members with the appropriate role can see all of them. Receipt scans are visible only to you. If your mailbox contains personal mail, consider connecting a work-only account.
• AI processing. Message content and attachments are processed by the model providers in section 5 to file, triage, summarise and answer questions about them, and attachment pages are described and embedded so they can be searched. This is done to provide the features you have connected Gmail for, and for no other purpose.
• Sending. Mail is sent through your Gmail account only when you send it, approve a draft, or your organisation's administrator has expressly enabled unattended sending for an automation.

6.3 Limited Use

Base PM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We only use Google user data to provide and improve the user-facing features described in this section — filing, searching, summarising and replying to your email, importing attachments, and syncing your programme to your calendar.
• We do not sell Google user data, use it for advertising, or use it to determine credit-worthiness or for lending.
• We transfer Google user data to third parties only as necessary to provide those features (the hosting and model providers in section 8), for security purposes, to comply with law, or as part of a merger or acquisition with prior notice to you.
• We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models, and we do not permit our providers to.
• Humans at Base PM do not read your Google user data unless you have given us express permission for a specific support request, it is necessary for security purposes (such as investigating abuse), it is required to comply with law, or the data has been aggregated and de-identified for internal operations.

6.4 Storage and security of Google credentials

The access and refresh tokens Google issues are encrypted by our application (AES-256-GCM, under a key held outside the database) before they are stored, in a database that is itself encrypted at rest and reachable only by our application servers and by personnel with production access under confidentiality obligations. Tokens are decrypted only in memory, only to make the Google API requests described above, and are never shared with any other party.

6.5 Disconnecting and deleting Google data

• You can disconnect Gmail or Google Calendar at any time from Settings → Integrations. Disconnecting cancels Base PM's access with Google, deletes the tokens we hold and stops all further reading, sending and syncing immediately.
• You can also revoke Base PM's access from your Google Account at myaccount.google.com/permissions, which has the same effect.
• Messages, attachments and receipts that were already brought into your workspace remain there after you disconnect, because they have become part of your organisation's project records. To have them deleted, your organisation's administrator can delete the relevant records in the app, or you can email support@basemanagement.org and we will delete the Google-derived data you specify within 30 days, subject to section 14.
• Events Base PM created in your Google Calendar remain in your calendar after you disconnect; you can delete them there.

7. Microsoft user data (Outlook)

The optional Outlook connection works the same way as Gmail: with the Mail.Read, Mail.Send and User.Read permissions, Base PM polls your mailbox for new messages, stores them and their attachments in your workspace, processes them with the model providers in section 5, and sends mail from your address when you (or an expressly enabled automation) ask it to. Base PM never moves, flags or deletes a message in your mailbox. Everything in sections 6.2, 6.4 and 6.5 applies equally to Outlook data, except that disconnecting deletes the tokens we hold without cancelling the grant at Microsoft — you can do that from your Microsoft account's app permissions page.

8. Who we share information with

We do not sell personal information. We share it only with service providers that help us operate the Service, with parties you direct us to share it with, and as otherwise described here. Every provider below acts on our instructions and may not use your data for its own purposes.

We may also disclose personal information where required or authorised by law, in connection with a sale or restructure of our business (subject to confidentiality protections), or with your consent.

9. Overseas disclosure

Most of our service providers store and process data outside Australia, principally in the United States; some AI model operators reached through OpenRouter are based elsewhere. Where personal information is disclosed overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the APPs, including through contractual data-protection terms, no-training settings and reliance on industry-standard certifications.

10. Sensitive information

Site safety features can involve "sensitive information" as defined in the Privacy Act — in particular health information in incident reports (injuries, first aid and medical treatment), and fitness-for-work or health declarations an organisation may add to its own sign-in forms. We collect this only where your organisation configures the feature, only for the purpose of its work health and safety obligations, and we treat the individual's completion of the form as their consent. Your organisation is responsible for collecting no more than the law requires and for telling workers and visitors why it is collected. Site photos may show identifiable people and are analysed by an AI model to describe the work shown (including whether people and safety equipment are visible); they are not used for facial recognition or to identify individuals. Please do not upload other sensitive information to Base PM.

11. People who are not Base PM customers

We hold personal information about people who never sign up for Base PM, because our customers deal with them through the Service:

• Contacts in a customer's workspace — clients, subcontractors, suppliers, crew, and anyone who emails or messages a connected mailbox. The customer is responsible for the lawful basis for holding that information; we hold it on their behalf.
• Portal users — people who view a client portal, respond to a tender, submit a claim, complete a company profile, sign in at a site, fill in a form or sign a document. We record what they submit and, for signatures and decisions, evidence of who acted and when (section 2).
• Business directory — business listings (business name, category, service area, contact details, ratings and reviews) compiled from public trade directories and business registers so customers can find and verify trades. If you are listed and would like your listing corrected or removed, contact us.

If you are one of these people, you can exercise the rights in section 15 by contacting us or the Base PM customer you dealt with.

12. Connecting other AI assistants

You may connect Base PM to a third-party AI assistant of your choice (for example Claude or an OpenAI product) so that it can act in your workspace on your instructions. When you do, that assistant can read and change the same data you can — including connected mailboxes — and everything it receives is governed by its operator's privacy terms, not ours. Connections are listed and can be revoked in your settings.

13. How we hold and secure information

We hold personal information in encrypted cloud databases and object storage. We implement administrative, technical and physical safeguards including:

• Transport encryption (TLS) for data in transit and encryption at rest in our database and storage layers;
• Row-level security and role-based access controls so that workspace data is segregated between organisations;
• Application-layer authentication backed by Supabase, verified mobile numbers, and one-time codes for portal decisions and signatures;
• Hashing of sign-in PINs, account verification codes and portal IP addresses;
• Logging, monitoring and alerting on access to production systems;
• Periodic review of vendors and integration scopes; and
• Confidentiality obligations for personnel with access to production data.

Despite these measures, no method of transmission or storage is completely secure. You can help protect your information by using a strong, unique password, connecting work rather than personal mailboxes, and reporting any suspicious activity to us promptly.

14. How long we keep personal information

We retain personal information for as long as your organisation's account is active and for a reasonable period afterwards to meet legal, tax and accounting obligations, to resolve disputes and to enforce our agreements.

• Active workspaces: while the subscription is in effect. Email, documents, site records and messages are kept as project records until your organisation deletes them.
• After an organisation ends its subscription: Customer Data is retained for at least 30 days, during which an administrator can ask us for an export; it is then deleted in the ordinary course of our retention practices.
• Integration tokens: deleted immediately when you disconnect the integration.
• Billing records: at least 7 years, in line with Australian taxation requirements.
• Site safety and signature records: your organisation may be required to keep these for statutory periods; we keep them while the workspace does.
• Backups and logs: rotated on a rolling basis, typically within 90 days.

When we no longer need personal information, we take reasonable steps to delete or de-identify it.

15. Your rights

Under the Privacy Act and APPs, you have rights to:

• Request access to personal information we hold about you;
• Request correction of inaccurate or out-of-date personal information;
• Opt out of marketing communications at any time using the unsubscribe link or by contacting us;
• Disconnect any integration and have its credentials deleted immediately;
• Request deletion of your account, your personal information, or data derived from an account you connected, subject to the retention obligations described above; and
• Make a privacy complaint (see below).

To exercise a right, email support@basemanagement.org. We will respond within a reasonable period (usually within 30 days). We may need to verify your identity before acting on your request. If you ask us to delete information we are required to keep (for example, tax records), we will explain why and what remains. Where the information is held in an organisation's workspace, we may refer your request to that organisation's administrator.

16. Cookies and analytics

We use a small number of cookies and similar technologies that are necessary for the Service to function (authentication and session cookies set by Supabase, a bot-protection challenge at sign-up), and to remember your preferences. Usage measurement is first-party: we do not load third-party analytics, session-replay or advertising scripts, and we do not build profiles for targeted advertising. You can disable non-essential cookies through your browser settings, although some features may not work correctly.

17. Data breach notification

If a data breach occurs that is likely to result in serious harm to affected individuals, we will assess and notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

18. Children

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

19. Changes to this statement

We may update this Privacy Statement from time to time. The "last updated" date at the top of the page reflects the latest revision. Where changes are material — including a change to the providers that process Google or Microsoft mailbox data — we will notify you by email or by an in-app notice before they take effect.

20. Contact us & complaints

If you have a question, request, or complaint about how we handle personal information, please email support@basemanagement.org. We will acknowledge your complaint within 7 business days and aim to resolve it within 30 days.

The entity responsible for your personal information is Base Management Trading Pty Ltd, ABN 73 700 115 466 (ACN 700 115 466).

If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by phone on 1300 363 992.