Last revised: June 2026

This Privacy Policy explains how Essex Labs, Inc. d/b/a Basis (“Basis,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes Personal Information.

"Personal Information" means any information that identifies or relates to a particular individual, including information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws.

This Privacy Policy applies to:

• our websites and online properties;
• our self-serve product and related services;
• sales, marketing, and business development activities;
• customer onboarding, support, and account management; and
• any other interactions that link to or reference this Privacy Policy

1. Important Scope Note

When our business customers use the Services, we may process information on their behalf as a service provider, contractor, or processor. In that case:

• the customer controls how that information is handled;
• our processing is governed by our contract with that customer, including any applicable Data Processing Addendum; and
• this Privacy Policy does not override those contractual arrangements

This Privacy Policy primarily describes how we handle Personal Information when we act as a controller, business, or similar primary decision-maker under applicable privacy law.

2. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of Personal Information:

A. Contact and account information

• name
• business email address
• phone number
• company name
• job title
• account credentials
• billing and account administrator details

B. Commercial and transaction information

• subscription details
• plan and pricing selections
• purchase history
• invoice and payment status information
• records relating to support or account changes

C. Internet, device, and usage information

• IP address
• browser type
• device information
• operating system
• referring pages
• pages viewed
• clickstream information
• approximate location derived from IP address
• product usage logs
• authentication and security logs

D. Communications and support information

• support requests
• chat messages
• emails
• call notes
• meeting notes
• attachments and related records

E. Professional information

• employer
• role
• department
• business profile details

F. Information customers or users provide through the Services

• prompts
• uploaded files
• content submitted through product features
• administrative settings
• integrations and configuration data

G. Inferences and derived information

We may generate limited inferences or internal classifications based on usage patterns, account activity, support interactions, or commercial history for product improvement, support, account management, fraud prevention, and similar legitimate business purposes.

3. Sources of Personal Information

We collect Personal Information:

• directly from you
• from your employer or organization
• from our customers and their authorized users
• automatically through cookies, pixels, SDKs, logs, and similar technologies
• from payment processors and service providers
• from integrations or third-party services you connect
• from public sources and commercially available databases
• from sales, marketing, event, and referral partners

4. How We Use Personal Information

We may use Personal Information to:

• provide, operate, maintain, and secure the Services;
• create and manage accounts;
• process purchases, subscriptions, payments, refunds, and renewals;
• provide support, onboarding, and training;
• communicate with you about the Services, your Account, billing, transactions, updates, and notices;
• improve the Services, develop features, and conduct analytics;
• detect, prevent, investigate, and remediate fraud, abuse, misuse, security incidents, and other harmful activity;
• personalize user experience and product configuration;
• conduct sales, marketing, and customer relationship management activities;
• comply with law, enforce contracts, and protect rights, safety, and property; and
• carry out other purposes disclosed at or before the time of collection

We may also use Personal Information for internal reporting, troubleshooting, debugging, auditing, quality assurance, and similar operational purposes.

5. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, local storage, log files, and similar technologies to:

• keep our websites and Services functioning;
• authenticate users;
• remember preferences;
• understand how users interact with our websites and Services;
• secure our systems;
• measure performance and improve usability; and
• support marketing and communications activities

Our use of cookies and similar technologies may vary depending on the website, service, and features in use.

Where required by applicable law, we will provide additional notices, consent tools, or opt-out choices relating to cookies, advertising technologies, or similar tools.

You may be able to control cookies through your browser settings, our cookie controls if available, or applicable consent tools. Blocking some cookies may affect site or service functionality.

6. How We Disclose Personal Information

We may disclose Personal Information to:

A. Service providers and processors

Providers that help us run our business and Services, including providers of:

• cloud hosting and infrastructure
• data storage and security
• payment processing
• customer support
• analytics
• communications
• CRM and marketing operations
• professional services
• AI services

B. Customer-directed third parties

Third-party services, integrations, or destinations that a customer or user chooses to connect or authorize.

C. Advisors and transaction counterparties

Lawyers, auditors, insurers, investors, financing sources, acquirers, and counterparties involved in an actual or potential financing, merger, acquisition, restructuring, or sale of all or part of our business or assets.

D. Authorities and others for legal reasons

Government authorities, regulators, courts, law enforcement, and other parties when we believe disclosure is necessary to:

• comply with law or legal process;
• respond to lawful requests;
• enforce our terms and policies;
• protect our rights, property, systems, or safety; or
• investigate or prevent fraud, abuse, or security issues

E. Affiliates

Our corporate affiliates for lawful business, security, administrative, and operational purposes consistent with this Privacy Policy.

F. Aggregated and deidentified information

We may disclose aggregated or deidentified information that does not identify you or reasonably identify a household.

7. Sales, Sharing, and Targeted Advertising

We do not sell Personal Information for money.

Depending on how our websites and Services use analytics, advertising, and similar technologies, some privacy laws may treat certain disclosures of Personal Information as sale, sharing, or targeted advertising.

Where required by applicable law, we will provide the notices and opt-out rights required for those activities.

8. Retention

We retain Personal Information for as long as reasonably necessary to:

• provide the Services;
• maintain the customer relationship;
• complete transactions and meet contractual obligations;
• comply with law, tax, accounting, and recordkeeping requirements;
• resolve disputes; and
• protect or enforce our rights

Retention periods vary based on the type of information, the context in which it was collected, the sensitivity of the information, and our legal and operational obligations.

9. Security

We use reasonable administrative, technical, and physical safeguards designed to protect Personal Information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Data Transfers

We may process Personal Information in the United States and other countries where we or our service providers operate.

If we transfer Personal Information across borders, we will use appropriate safeguards where required by applicable law. These may include contractual measures such as the European Commission’s Standard Contractual Clauses and the UK Addendum, where applicable.

11. Your Privacy Rights

Depending on where you live and the context of our processing, you may have rights such as:

• to know or access the Personal Information we process about you;
• to request correction of inaccurate Personal Information;
• to request deletion of Personal Information;
• to receive a portable copy of certain Personal Information;
• to object to or restrict certain processing;
• to opt out of certain profiling, targeted advertising, or sales/sharing where applicable; and
• to withdraw consent where processing is based on consent

We will not discriminate against you for exercising rights granted by applicable law.

To exercise privacy rights, contact us at:

• email: privacy@ofbasis.com

We may need to verify your identity and authority before processing a request. If permitted by law, you may also use an authorized agent.

12. U.S. State Privacy Disclosures

If you are a resident of a U.S. state with privacy rights, we may process the categories of Personal Information described in Section 2 for the purposes described in Section 4 and may disclose those categories to the recipients described in Section 6.

Depending on the websites, Services, and tools in use during the relevant period, certain disclosures involving cookies, analytics, advertising, or similar technologies may be treated as sale, sharing, or targeted advertising under applicable U.S. state privacy law.

If required by applicable law, we will provide:

• a notice at collection;
• methods for submitting rights requests;
• appeal rights where required; and
• opt-out tools for targeted advertising, sale, or sharing where applicable

13. California-Specific Notice

If you are a California resident, California law may give you additional rights, including rights to know, access, correct, delete, and receive information about certain disclosures of Personal Information. California law may also require us to describe:

• the categories of Personal Information collected;
• the purposes for which the categories are used;
• the categories of sources from which the information is collected;
• the categories of third parties to whom the information is disclosed; and
• whether we sell or share Personal Information

These items are addressed generally in this Privacy Policy. If required, we may provide supplemental California-specific notices or links on the relevant website or service page.

14. EEA, UK, and Similar Jurisdiction Disclosures

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar privacy rights, we may process your Personal Information on bases such as:

• performance of a contract;
• our legitimate interests;
• compliance with legal obligations; or
• your consent, where required

You may also have the right to lodge a complaint with a supervisory authority.

15. Children’s Privacy

Our websites and Services are not directed to children, and we do not knowingly collect Personal Information

from children under 16 in connection with the self-serve Services.

16. Third-Party Sites and Services

Our websites or Services may link to third-party sites, content, or services. We are not responsible for the

privacy practices of third parties.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by applicable law, such as by posting the updated policy, updating the effective date, or providing additional notice through the Services or by email.

18. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

• Basis / Essex Labs, Inc.
• privacy email: privacy@ofbasis.com

‍

‍