Your records support the services you choose. Workspace access is controlled, assessment evidence is processed when you request an assessment, and you can contact us about access, correction or deletion.
1. Who we are and what this covers
BasisRail (“we”, “us” or “our”) provides a private-asset registry and related assessment services. This policy explains how we handle personal information when you visit our website, create or join a workspace, store asset records, request an assessment, make a payment or contact us. Our privacy contact is privacy@basisrail.com.
Personal information is information about an identified or reasonably identifiable individual. Asset records about businesses can also contain personal information, such as an owner’s name or a beneficiary’s details. This policy should be read with our Terms of Service and Legal Disclaimer.
A workspace owner may be a separate organisation with its own privacy responsibilities. Its handling of information outside BasisRail is governed by its own policies. Authentication, payment and other external providers may also handle some information for their own purposes under their policies.
2. Information we collect
- Account and access information: your authenticated user identifier, name and email supplied by the sign-in provider; your workspace name, role, invitations, professional cohort, first and most recent activity dates and account-creation status.
- Asset and workflow information: asset descriptions, classifications, identifiers, ownership and interests, custom attributes, documents, contacts, authority records, transaction context, review dates, assignment details and version history.
- Assessment information: the selected asset snapshot, valuation date and purpose, evidence you enter, generated estimates and explanations, public-source references, review factors and comments, acceptance or rejection, payment status and human-review requests.
- Billing information: the chosen plan and capacity, subscription and invoice identifiers, payment amounts, taxes, dates, status and supporting commercial records. Card entry is handled by Stripe; our application does not store full card numbers or card security codes.
- Communications: enquiries, support correspondence, feedback, service requests and associated delivery records.
- Technical information: hosting and security providers may process IP addresses, browser and device information, request times, service errors, authentication cookies and security logs to deliver and protect the service.
We collect information directly from you, from people authorised to contribute to your workspace, from our authentication and payment providers and, when relevant to a requested assessment, from public sources. We may receive information about someone who has not created an account, for example where you identify a co-owner in a record.
3. How we use information
We use information to authenticate users; create and operate workspaces; enforce access permissions; maintain asset records and their history; provide requested assessments and reviews; administer subscriptions and payments; respond to enquiries; investigate errors, misuse and disputes; and meet applicable legal obligations.
We also use account activity, workspace counts and commercial records to understand adoption, operate the business and improve the service. The owner dashboard includes registration and activity metrics, workspace information, payment records and submitted feedback. We do not sell personal information or operate advertising profiles based on your asset records.
Providing information is generally your choice. Without information needed for a particular service, we may be unable to create an account, assess an asset, process a payment or resolve a request. We will not treat acceptance of this policy as blanket consent for unrelated uses of sensitive information.
4. AI assessments and review
When you request an automated assessment, the selected asset details and evidence entered in the assessment form are sent to OpenAI’s API to generate the result. A review also sends the previous assessment and the additional factors and explanation you provide. Relevant public web searches may be used to support the assessment. Search queries can contain context needed to identify relevant sources.
Uploaded registry documents are not automatically read by the current assessment flow. You decide which relevant excerpts or links to enter into the evidence field. Include only information necessary for the assessment and redact unrelated personal details.
We request that the API response not be stored as a retrievable response object. This does not mean that no provider processing or security retention occurs. OpenAI’s applicable API data controls and retention terms govern its handling of requests. Our own system stores the evidence, result, source references and review history with the asset snapshot. We do not use your private asset records to train a BasisRail foundation model.
AI outputs can contain inaccurate information about people as well as assets. You may request correction of personal information or raise concerns using the contact below. The assessment flow also offers a review and, after rejection and feedback, an optional no-charge human-review request. An estimate is not used by BasisRail to decide your eligibility for credit, insurance or employment.
6. Storage and overseas processing
BasisRail uses international cloud and service providers. Information may be stored in, accessed from or processed in the United States and other countries in which those providers and their service providers operate. The location can depend on the feature, account configuration, support requirements and provider routing. We do not promise that all information remains in Australia.
We consider the nature of the information, access controls and provider contractual terms when arranging overseas processing, and take steps required by applicable privacy law. Contact us before uploading information subject to a mandatory location restriction so we can discuss whether the service is suitable. You can request further information about the providers and locations relevant to your use.
8. Security and retention
Our safeguards include authenticated access, workspace membership checks, role controls, server-side secret handling, version history and verified payment notifications. We use hosting and storage services with their own security controls. No internet service can guarantee that unauthorised access, loss or disruption will never occur. Let us know promptly if you suspect an account or data-security issue.
We keep account and workspace information while needed to provide the service and maintain the records you ask us to hold. Historical asset and assessment records remain part of the audit history; editing a current record does not automatically erase earlier versions. Billing, dispute, security and transaction records may need to be retained after account closure for legal or legitimate operational reasons.
We assess deletion requests individually. Where information is no longer required and there is no lawful reason to retain it, we will take reasonable steps to delete it or make it no longer identifiable. Backups, legal holds and third-party retention obligations may mean deletion is not immediate. We do not currently provide a single self-service action that erases every historical record.
If a breach occurs, we will investigate and make notifications required by applicable law.
9. Your access, correction and deletion requests
You can update available account and asset fields through the service. For access to personal information, correction, account closure, deletion or an explanation of a particular use, email privacy@basisrail.com with enough detail to identify the request. Do not email passwords, full card details or unnecessary identity documents.
We may need to verify your identity and authority before acting, especially where a request affects a shared workspace or another person’s records. We will respond within a reasonable period and any applicable legal deadline. If we cannot comply in full, we will explain the reason where permitted and any available complaint options.
Rights depend on the law that applies. This policy does not remove statutory rights or promise that every jurisdiction’s privacy regime applies to every user. Workspace owners remain responsible for appropriately handling requests concerning information they supply or control.
10. Information about others and children
Only upload information you are entitled to use and share. Where necessary, inform other people that their information will be stored in BasisRail and obtain the authority or consent required for the relevant use. Avoid uploading tax file numbers, authentication secrets, complete payment-card details, health information or unrelated sensitive records.
BasisRail is intended for adults and authorised business users, not children. If you believe a child has supplied personal information without appropriate authority, contact us so we can investigate and take suitable action.
11. Complaints and policy updates
Send privacy complaints to privacy@basisrail.com, describing what happened and the outcome you are seeking. We will acknowledge and investigate the concern and aim to provide a substantive response within 30 days, or explain if more time is needed.
If you are dissatisfied, you may contact the Office of the Australian Information Commissioner where it has jurisdiction, or the relevant privacy authority in your location.
We may update this policy when services, providers, practices or legal requirements change. The current version and effective date will be published here. We will take additional notification or consent steps where required for material changes; a policy update does not authorise an otherwise unlawful use of information.
Contact BasisRail at privacy@basisrail.com.