BaseNest LLC Privacy Policy

SCOPE OF CHANGE: This version restores the canonical Version 4 section structure, resolves internal contradictions introduced in the August 2026 working file, and adds provisions for Named Co-Travelers and for Linked Spouse Accounts created under Terms of Service §3.5. It is conformed to Terms of Service v5.2, which establishes two booking products — Standard Stay of one to twenty-nine nights and Extended Stay of thirty to eighty-seven nights, billed in installments. Sections 2.4, 4, 6.1, 7.1, 7.4, 8, and 11.10 reflect the data generated by the Extended Stay product, by the Continuation Confirmation mechanism in Terms of Service §5.12, and by the duration-based tax determinations in Terms of Service §7.2. Alabama is included as an active market.

SUMMARY: This Privacy Policy explains how BaseNest LLC collects, uses, shares, and protects your personal information when you use our Platform. By using the Platform, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Platform.

BaseNest LLC is not affiliated with, endorsed by, or acting on behalf of the United States Department of Defense or any federal agency.

§1. Introduction & Scope

BaseNest LLC ("BaseNest," "we," "our," or "us") operates a verified rental marketplace serving U.S. service members, Veterans, DoD civilians, and government contractors. The Platform offers two booking products under Terms of Service §5: a Standard Stay of one (1) to twenty-nine (29) consecutive nights, and an Extended Stay of thirty (30) to eighty-seven (87) consecutive nights billed in installments. This Privacy Policy applies to all users of the Platform and to both products — both Guests (users who book lodging) and Hosts (users who list lodging). Where a data practice applies to only one booking product, this Policy says so.

This Policy also applies to Named Co-Travelers: spouses and adult dependents who stay at a Property under a booking made by a verified account holder but who do not hold a BaseNest account of their own. It applies as well to Linked Spouse Account holders: spouses who hold a limited, derivative login credential created under §3.5 of the Terms of Service, described in §2.3A below. Named Co-Travelers are described in §2.3, and their rights are described in §10 and §12.5.

Where data practices differ between Guests, Hosts, Named Co-Travelers, and Linked Spouse Account holders, this Policy identifies the difference.

§2. Information We Collect

§2.1 Account & Profile Data

Collected from all account holders at registration:

§2.2 Identity Verification Data

BaseNest's verification process differs between Guests and Hosts.

Guest Verification — Staff Review

Guests verify eligibility by submitting one of the following:

1. Permanent Change of Station (PCS) Orders
2. Temporary Duty (TDY) Orders
3. Leave and Earnings Statement (LES) — accepted where orders are unavailable

Guest verification is conducted by BaseNest staff. It is a human review process, not automated. No biometric data is collected from Guests.

Document handling:

• Submitted documents are temporarily stored in BaseNest's AWS S3 infrastructure (U.S.-based regions) while under review.
• The document is permanently and securely deleted from AWS S3 upon completion of review, regardless of approval or denial outcome.
• BaseNest does not retain the document itself after verification is complete.

Data extracted and retained from the verification document:

SSN ADVISORY: LES documents frequently contain a full or partial Social Security Number. BaseNest does not collect, store, record, or use SSN data. Guests are strongly encouraged to redact their SSN before uploading. Any SSN visible on a submitted document will not be recorded, and the document will be deleted upon completion of verification.

Host Verification — Stripe Identity (Automated)

Hosts verify identity through Stripe Identity, which uses automated government document capture and biometric face-matching. For Hosts, Stripe Identity processes and manages all verification data within Stripe's own infrastructure. BaseNest does not independently store Host identity verification documents or biometric data.

§2.3 Named Co-Traveler Data (Spouses & Adult Dependents)

A spouse or adult dependent may stay at a Property as a Named Co-Traveler on a booking made by a verified account holder (the "Sponsor"). BaseNest does not issue accounts to adult dependents and does not issue an independent Guest account to any spouse. A spouse may, separately, hold a Linked Spouse Account under §3.5 of the Terms of Service — a derivative credential with browsing and proposal rights only. That credential is described in §2.3A and is distinct from Named Co-Traveler status. A verified Sponsor account must exist before a Named Co-Traveler can be added to a booking. A Named Co-Traveler, acting in that capacity, cannot book independently, holds no account, and cannot log in to the Platform. A spouse who separately holds a Linked Spouse Account has the limited access described in §2.3A; that access never includes booking or payment authority.

Eligibility for a Named Co-Traveler is established by either:

• the Sponsor's orders listing dependents; or
• the Sponsor's attestation that the named individual is an eligible spouse or adult dependent.

Named Co-Traveler eligibility is reviewed by BaseNest staff — the same human review process applied to Guests. No automated decision-making and no biometric processing is applied to Named Co-Travelers.

Data collected about a Named Co-Traveler:

What BaseNest does not collect about a Named Co-Traveler: contact information, identity documents, payment information, biometric data, or military verification documents submitted by the co-traveler. BaseNest does not collect the names or ages of dependent children.

Where a Sponsor submits orders to establish Named Co-Traveler eligibility, that document is handled under the rules in §2.2 — stored temporarily during review and permanently deleted upon completion.

Because a Named Co-Traveler's name is recorded on the booking record, it is retained for the same period as the booking record under §8. A Named Co-Traveler has privacy rights under applicable state law even though they do not hold a BaseNest account. See §10 for those rights and §12.5 for how to exercise them.

§2.3A Linked Spouse Account Data

A Linked Spouse Account is a secondary login credential created under §3.5 of the Terms of Service and permanently associated with a single Sponsor account. Unlike a Named Co-Traveler, a Linked Spouse Account holder can log in, search listings, view pricing, save listings and searches, and assemble a Proposed Booking for the Sponsor to review. A Linked Spouse Account holder cannot confirm a booking, authorize or change payment, cancel or modify a booking, submit verification documents or military orders, exercise SCRA rights, request a refund, initiate a dispute, or change the Sponsor account settings.

Data collected about a Linked Spouse Account holder: name, email address and login credential, the Sponsor attestation record establishing the link, OFAC screening result, Proposed Bookings assembled, saved listings and searches, and device and usage data generated by that account under §2.6.

What BaseNest does not collect from a Linked Spouse Account holder: identity documents, military verification documents, biometric data, payment instruments, or documentation of the marital relationship.

Information visible across the link. As directed by the Sponsor under §3.5(g) of the Terms of Service, a Linked Spouse Account can see the saved listings, saved searches, Proposed Bookings, booking history, and stay details associated with the Sponsor account. A Linked Spouse Account cannot see the Sponsor's eligibility verification documentation, military orders, or full payment method details. Creating a Linked Spouse Account is therefore an instruction from the Sponsor to disclose that information to a second person, and the Sponsor should not create one unless they intend that result.

A Linked Spouse Account is suspended or terminated at the same time as the Sponsor account from which it derives and cannot survive it. Either the Sponsor or the Linked Spouse may end the link, and BaseNest may suspend or terminate a Linked Spouse Account independently.

No SCRA rights arise from the link. Under Terms of Service §4.3, the existence of a Linked Spouse Account does not by itself make a spouse a named party to an occupancy and does not create, expand, or evidence coverage under the Servicemembers Civil Relief Act. BaseNest therefore collects no military orders, eligibility documentation, or service record from a Linked Spouse Account holder, and holds no data capable of establishing such coverage.

NOTICE TO SPONSORS:By adding a Named Co-Traveler to a booking, you confirm that you have the authority to share that individual's information with BaseNest and that you have made them aware of this Privacy Policy. BaseNest relies on that confirmation and does not contact Named Co-Travelers directly.

§2.4 Booking & Transaction Data

§2.5 Communications & Support Data

Platform messages between Hosts and Guests; support tickets; cancellation dispute mediation records; and review and rating content submitted after a stay.

§2.6 Device & Usage Data

• IP address and approximate geolocation (city/state level only)
• Browser type, version, and operating system
• Pages visited, features used, and time spent on the Platform
• Referral source
• Session and device identifiers

§2.7 Marketing Engagement Data

When you receive communications from BaseNest via Customer.io: email open and click events; unsubscribe and opt-out actions; and subscription topic preferences.

§2.8 What We Do Not Collect

BaseNest does not collect, request, or store any of the following:

• Social Security Numbers
• Security clearance status, level, or investigation history
• DEERS records — BaseNest does not query DEERS or any government personnel system
• Bank account or routing numbers — payment processing is handled entirely by Stripe
• Biometric data from Guests or Named Co-Travelers
• Names, ages, or any information about dependent children
• Precise or device-level geolocation
• Health, medical, or disability information
• Unit assignment, deployment schedule, or operational information

§3. How We Use Your Information

§4. Third-Party Service Providers & Data Processors

BaseNest shares your information with the following service providers only to the extent necessary to operate the Platform. BaseNest does not sell your personal data to any third party.

We may also share information with law enforcement pursuant to valid legal process; successors in the event of a merger or acquisition (with advance notice); and professional advisors under confidentiality obligations.

§5. Automated Decision-Making & Biometric Data

BaseNest's use of automated processing and biometric data is limited to Host identity verification only. Guest and Named Co-Traveler verification is conducted entirely by human staff review. Linked Spouse Accounts are established by Sponsor attestation and are subject to OFAC screening only.

§5.1 Guest, Named Co-Traveler & Linked Spouse Verification — No Automated Decision-Making

Guest eligibility is determined by BaseNest staff reviewing submitted orders or LES documents. Named Co-Traveler eligibility is determined by BaseNest staff reviewing the Sponsor's orders or the Sponsor's attestation. Both are human decision-making processes. Linked Spouse Account eligibility is not determined by BaseNest at all: under §3.5(c) of the Terms of Service the marital relationship is established solely by the Sponsor's attestation, and BaseNest reviews no marriage certificate, DEERS record, or dependent identification card and makes no determination that any marital relationship exists. BaseNest does screen every Linked Spouse Account against the OFAC lists described in §2.2; that screening is never waived, delegated, or satisfied by a Sponsor attestation.

No automated algorithms, machine learning, or biometric processing are used for Guest or Named Co-Traveler verification. Guests, Named Co-Travelers, and Linked Spouse Account holders have no automated decision to appeal because no automated decision is made as to any of them.

§5.2 Host Verification — Stripe Identity (Automated)

Host identity is verified through Stripe Identity, which uses machine learning to: (a) verify that a submitted government ID document is authentic and unaltered; and (b) compare a live selfie to the photo on the submitted ID document (biometric face-matching). This processing involves biometric data as defined under applicable state law.

§5.3 Host Biometric Consent

By completing Host identity verification, Hosts provide affirmative consent to the biometric processing described in §5.2. Stripe Identity processes and retains Host biometric data per Stripe's policies. BaseNest does not receive or store Host biometric data.

§5.4 Host Opt-Out Rights (Biometric)

Florida Hosts have the right to opt out of biometric data collection during Stripe Identity verification. Texas Hosts may opt out of biometric processing under Texas law. Contact support@basenest.io to request manual verification. Opting out does not affect Guest or Named Co-Traveler verification, neither of which involves biometrics.

§5.5 Host Appeal of Automated Decisions

If Stripe Identity results in denial of Host Platform access, Hosts may request human review by contacting support@basenest.io within thirty (30) days of a denial notice. BaseNest will respond within five (5) business days.

§6. Marketing Communications & Consent

§6.1 Transactional Messages (Cannot Be Opted Out)

These messages are required to operate the Platform:

• Booking confirmations, modifications, and cancellation notices
• Cancellation tier determination and refund processing updates
• Military orders release confirmations and refund status
• Itemized receipts and payment confirmations
• Extended Stay installment charge notices, failed-payment notices, and retry notifications
• Continuation Confirmation notices, reminders, and non-confirmation notifications required by Terms of Service §5.12(b) and §5.12(f)
• Tax adjustment, credit, and refund notices issued under Terms of Service §7.2
• Account security alerts
• Dispute notifications and determinations
• Verification status notifications

§6.2 Promotional & Lifecycle Messages (Opt-Out Available)

Welcome series, platform tips, promotional offers, and re-engagement messages. To opt out, click the Unsubscribe link in any promotional email. Opting out does not affect transactional messages.

§6.3 SMS & Phone Marketing (TCPA)

If BaseNest sends marketing SMS messages, we will obtain your prior express written consent as required by the TCPA, 47 U.S.C. §227. Revoke consent at any time by replying STOP. Message and data rates may apply.

§6.4 CAN-SPAM Compliance

All promotional emails include BaseNest's physical mailing address, clear identification as a BaseNest communication, and a working unsubscribe mechanism. Unsubscribe requests are honored within ten (10) business days.

Named Co-Travelers are not enrolled in any BaseNest marketing communication. BaseNest does not collect co-traveler contact information and does not market to them.

§7. Cookies & Tracking Technologies

§7.1 Cookie Categories

§7.2 Global Privacy Control (GPC)

BaseNest honors GPC signals as a valid opt-out of data sale and sharing under applicable state privacy laws including CCPA/CPRA. If your browser sends a GPC signal, we process it as an opt-out of non-essential data sharing and provide confirmation.

§7.3 Managing Cookies

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent login and Platform use.

§7.4 Do Not Sell or Share My Personal Information

BaseNest does not sell personal data for money. Because BaseNest deploys advertising and conversion-measurement tags supplied by third-party platforms as described in §7.1, some disclosures of device and usage data to those platforms may constitute "sharing" for cross-context behavioral advertising under the California Consumer Privacy Act, and "targeted advertising" under the comprehensive privacy statutes of other states.

You may opt out of that sharing by any of the following routes, each of which BaseNest treats as a valid opt-out: declining the Advertising & Measurement category in the Platform cookie banner; transmitting a Global Privacy Control signal, which BaseNest honors under §7.2; or emailing privacy@basenest.io with the subject line "Do Not Sell or Share." BaseNest does not require an account to exercise this right and does not condition access to the Platform on your choice.

BaseNest does not sell or share the personal data of any individual it knows to be under sixteen (16) years of age. Verification documents, military orders, eligibility data, and Named Co-Traveler data are never sold, shared, or disclosed to any advertising or measurement platform.

§8. Data Retention Schedule

§9. Data Security

• Encryption in transit: TLS on all data transmitted between your browser and the Platform.
• Encryption at rest: AES-256 or equivalent for data stored in Neon and AWS S3.
• PCI-DSS 4.0.1 compliance: Payment data handling meets PCI-DSS Version 4.0.1, mandatory since March 31, 2025. Stripe is a PCI-DSS certified processor; BaseNest does not store cardholder data directly.
• Access controls: Access to user personal data is limited to personnel with a legitimate business need, governed by role-based access controls.
• Vendor security: All third-party processors are evaluated for security practices and operate under data processing agreements.

§9.1 Security Incident Notification

In the event of a security incident involving your personal data, BaseNest will contain and investigate the incident, notify affected users and applicable regulatory authorities within the timeframes required by applicable law, and provide details of the incident and remediation steps. To report a suspected security vulnerability, contact support@basenest.io.

§10. Your Privacy Rights

Regardless of your state of residence, BaseNest honors the following rights. These rights are available to Guests, Hosts, and Named Co-Travelers alike.

To exercise these rights, submit a request as described in §12.

§11. State-Specific Privacy Rights

§11.1 California (CCPA/CPRA)

• Right to limit use of sensitive personal information, including military service data
• Right to correct inaccurate personal information
• DROP mechanism: data deletion may also be requested via privacy.ca.gov
• GPC signals honored per §7.2

§11.2 Texas

• Right to access, correct, delete, and port personal data under the TDPSA
• Right to opt out of biometric processing during Host verification (§5.4)
• Guest and Named Co-Traveler verification is human-conducted; no automated decision rights apply

§11.3 Florida (FDBR)

• Hosts have the right to opt out of biometric data collection during Stripe Identity verification
• Guests and Named Co-Travelers are verified by staff review; no biometric data is collected from them
• BaseNest will respond to Florida requests within 45 days (one 15-day extension permitted with notice)

§11.4 Virginia (VCDPA)

• Right to access, correct, delete, and port personal data
• Right to opt out of profiling for decisions producing legal or significant effects

§11.5 Colorado (CPA)

• Right to access, correct, delete, and port personal data
• Right to opt out of profiling and targeted advertising

§11.6 Indiana, Kentucky & Rhode Island

Right to confirm data processing, access personal data, correct inaccuracies, and obtain a portable copy

§11.7 Montana, Maryland & Delaware

Access, correction, deletion, and portability rights consistent with §10

§11.8 North Carolina

• All-in pricing transparency: no hidden fees without prior disclosure in checkout
• Data access, correction, and deletion rights consistent with §10

§11.9 Alabama

• Alabama enacted the Alabama Personal Data Protection Act (HB 351, Act 2026-552) on April 17, 2026. The Act does not take effect until May 1, 2027. When it takes effect it will provide Alabama residents the rights to confirm processing and access their personal data, correct inaccuracies, delete personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling for solely automated significant decisions, with a 45-day response period.
• Until that date, Alabama residents may exercise the access, correction, deletion, and portability rights described in §10 on the same terms BaseNest extends to residents of every state. BaseNest does not sell personal data and does not use personal data for profiling that produces legal or similarly significant effects.
• Data breach notification. Alabama's Data Breach Notification Act of 2018 requires notice to affected Alabama residents as expeditiously as possible and no later than 45 days after determining that a qualifying breach occurred, with notice to the Alabama Attorney General and to nationwide consumer reporting agencies where more than 1,000 Alabama residents are notified. §9.1 is applied consistently with those requirements.

§11.10 Georgia, Missouri, Arkansas & Other States Without a Comprehensive Privacy Statute

BaseNest is organised in Georgia and operates in Georgia, Missouri, and Arkansas, none of which had a comprehensive consumer privacy statute in force as at the effective date of this Policy. Residents of those states, and of any other state without such a statute, may exercise the access, correction, deletion, and portability rights described in §10, and the advertising opt-out in §7.4, on the same terms BaseNest extends to residents of every state. BaseNest does not condition the availability of those rights on the existence of a statute requiring them.

Where a state enacts a comprehensive privacy statute after the effective date of this Policy, BaseNest will apply that statute's requirements from its effective date and will update this §11 at the next revision.

§12. Data Subject Access Request (DSAR) Process

HOW TO SUBMIT: Email privacy@basenest.io with the subject line "Privacy Request." Include your full name, the email address on your account, and a description of the right or rights you wish to exercise. Requests sent to support@basenest.io will be routed to the same queue.

§12.1 Identity Verification

Before processing a request, BaseNest will verify your identity. We may request confirmation of the email address on your account and one additional verification factor.

§12.2 Response Timelines

§12.3 Appeal Process

If your request is denied, appeal to privacy@basenest.io with the subject line "Privacy Appeal" within thirty (30) days of the denial. BaseNest responds within sixty (60) days. If the appeal is denied, you may contact your state Attorney General's office where applicable law provides this right.

§12.4 Limitations on Deletion

• Transaction records, including cancellation records and Named Co-Traveler names recorded on those records, must be retained 7 years minimum
• OFAC screening logs must be retained 5 years minimum
• Data subject to an active legal hold, dispute, or law enforcement investigation will not be deleted until the matter is resolved

§12.5 Requests from Individuals Without a BaseNest Account

A Named Co-Traveler, or any other individual whose personal information appears in BaseNest records without holding an account, may exercise the rights in §10.

Because such an individual has no account email to verify against, BaseNest will verify identity using the booking reference number, the name as recorded on the booking, and one additional verification factor. BaseNest may contact the Sponsoring account holder to confirm the request before acting on it.

Submit these requests to privacy@basenest.io with the subject line "Privacy Request — Non-Account Holder." The response timelines in §12.2 apply. The deletion limitations in §12.4 apply equally, which means a Named Co-Traveler's name recorded on a booking record cannot be deleted before the 7-year retention period expires.

§13. OFAC & Compliance Screening

BaseNest screens all account holders against the OFAC SDN List and other restricted-party lists at account creation and on subsequent transactions. Screening records (the fact of screening and the outcome) are retained for a minimum of 5 years per Bank Secrecy Act requirements. OFAC screening results are not shared with other users. Accounts flagged may be denied, suspended, or terminated without advance disclosure of the specific flag.

§14. Age Requirement & Minors' Privacy

The Platform is intended solely for users eighteen (18) years of age or older. BaseNest does not knowingly collect personal information from persons under 18. A Named Co-Traveler must also be 18 or older; BaseNest does not collect the names or ages of dependent children traveling with a Sponsor.

If we become aware that a minor's data has been collected, we will delete it promptly. Contact support@basenest.io with the subject line "Minor Data Concern" if you believe a minor's data has been submitted.

Note on COPPA:the Children's Online Privacy Protection Act applies to children under 13. Because the Platform is restricted to adults, COPPA is not the operative framework here. This section states BaseNest's age restriction and minor-data handling directly rather than relying on a COPPA citation.

§15. U.S.-Based Data Storage & Processing

All BaseNest infrastructure is hosted in the United States. No personal data is intentionally transferred outside the United States.

OCONUS service members who access the Platform while stationed abroad should be aware that data submitted to the Platform will be processed and stored in U.S.-based infrastructure.

§16. No Government Agency Status

BaseNest is a private entity and does not represent the DoD, VA, or any federal agency. Verification of military status does not imply a security clearance check or DoD affiliation. BaseNest cannot guarantee DTS voucher approval or reimbursement of any lodging expense. Receipts are provided in a format intended to support voucher submission but do not guarantee approval.

Entitlements and reimbursement rates vary by orders, location, rank, and dependents. Verify entitlements and reimbursement eligibility with your finance or travel office.

§17. Changes to This Policy

BaseNest may update this Privacy Policy at any time. When material changes are made, we will post the updated Policy with a new effective date and send email notification to registered users at least thirty (30) days before changes take effect where required by applicable law. Continued use of the Platform after the effective date constitutes acceptance.

§18. Contact Us

BaseNest LLC | www.basenest.io | support@basenest.io | 904-206-7553

Veteran-Owned & Minority-Owned Business