Privacy Policy

Last updated: July 18, 2026

Appraise Properties Inc. (“re-base.io,” “we,” “us,” or “our”) is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our commercial real estate appraisal platform, including our website, web application, API, Microsoft Office add-in, documentation portal, and any related services (collectively, the “Service”).

If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

Subscription pricing, included or complimentary credits, overage rates, and the rules for measuring usage in credits are commercial terms governed by our Terms of Service and the disclosures shown in the Service, not by this Privacy Policy. If a change to those terms also changes how we collect, use, disclose, or retain personal information, we will update this Privacy Policy as required.

1

Information We Collect

1.1 Information You Provide Directly

We collect information that you voluntarily provide when you:

  • •Create an account — name, email address, authentication credentials, professional credentials, and organization affiliation.
  • •Complete your profile — phone number, business address, professional license numbers, and role within your organization.
  • •Use the Service — property data, comparable sale and lease information, appraisal assignment details, client and contact information, cost approach data, income and expense data, file uploads (including photos, documents, and spreadsheets), report content, prompts, notes, comments, and other work product.
  • •Use email intake — inbound email addresses, sender and recipient information, subject lines, message bodies, signatures, and eligible attachments used to identify and create appraisal requests or related records.
  • •Use portals or submit requests — contact details, request and bid information, assignment messages, documents, and related correspondence submitted through client portals or public request forms.
  • •Communicate with us — name, email address, phone number, message content, support tickets, feedback, and limited campaign-attribution information included with a submitted contact form.
  • •Subscribe or make a payment — billing address and payment method details (processed by our third-party payment processor; we do not store full credit card numbers).

1.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information, including:

  • •Device and browser information — IP address, browser type and version, operating system, device type, and screen resolution.
  • •Usage data — pages viewed, features used, search queries (including AI-powered natural language searches), clicks, time spent on pages, and navigation paths.
  • •Log data — access times, error logs, referring URLs, and API request metadata.
  • •Location data — approximate location inferred from IP address; precise geolocation only if you use map features and grant browser permission.
  • •Cookie and browser-storage data — as described in Section 8 below.
  • •Aggregate traffic and campaign attribution — normalized page paths, event counts, referring hostnames, and selected UTM source, medium, and campaign values. Campaign values are held only in page memory during navigation and may be included with a contact-form submission.

1.3 Information from Third-Party Sources

We may receive information about you from third-party sources, including:

  • •Identity and directory providers — when your organization uses single sign-on or automated user provisioning, we may receive identifiers and attributes such as name, email address, groups, roles, and account status as configured by your organization and its identity provider.
  • •Organizations and other users — administrators, coworkers, clients, portal users, and request participants may provide information about you or other individuals when they create records, send invitations, exchange messages, or upload content.
  • •Property and parcel sources — property, ownership, assessment, transaction, and parcel data from county systems, public databases, customer-selected sources, and commercial parcel-data providers used to populate or validate records within the Service.
  • •Mapping and geocoding services — address verification and geolocation data from providers such as Google Maps.
  • •Accounting integrations — if you connect QuickBooks, Xero, or similar services, we receive invoice and payment data as necessary to facilitate synchronization.
2

How We Use Your Information

We use the information we collect for the following purposes:

  • •Provide and operate the Service — including property management, appraisal assignment tracking, comparable analysis, mapping, report generation, and Microsoft Office integration.
  • •Process transactions — manage subscriptions, process payments, and send billing-related communications.
  • •Improve and develop the Service — analyze usage patterns, diagnose technical issues, and develop new features.
  • •AI-powered features — provide natural-language search, email classification and extraction, document parsing, spreadsheet column mapping, property summaries, report-drafting assistance, and photo captions. Depending on the feature and your organization’s settings, relevant prompts, record content, emails, attachments, documents, or images may be sent to an AI service provider such as Google Gemini to generate a response. Organization administrators can disable AI features.
  • •Personalize your experience — remember your preferences, saved filters, map views, and workspace configurations.
  • •Communicate with you — send service announcements, security alerts, support responses, and, with your consent, product updates and marketing communications.
  • •Ensure security — detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.
  • •Enforce our terms — comply with our Terms of Service and other legal obligations.
  • •Audit and compliance — maintain audit logs for data integrity, regulatory compliance, and internal record-keeping.
3

Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data based on the following legal grounds:

  • •Performance of a contract — processing necessary to provide the Service under our Terms of Service.
  • •Legitimate interests — improving our Service, measuring aggregate usage without analytics storage, ensuring security, preventing fraud, and marketing our products (where not overridden by your rights).
  • •Consent — where you have given explicit consent, such as for marketing emails.
  • •Legal obligation — where processing is required to comply with applicable law.
4

How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information in the following circumstances:

4.1 Within Your Organization

If you belong to an organization on re-base.io, other members of your organization may see your name, role, and work product (including assignments, properties, comparables, reports, and messages) in accordance with the permissions set by your organization’s administrator. Organization administrators can manage member access, roles, data visibility, sharing, and certain retention settings.

4.2 Portals and Recipients You Select

You and your organization may choose to make information available to clients, prospective clients, appraisers, or other recipients through client portals, public request and bid forms, invitations, shared correspondence, and similar collaboration features. The information available to a recipient depends on the content shared and the access settings, credentials, or links used for that feature.

4.3 Service Providers

We share data with trusted third-party service providers who assist us in operating the Service, including:

  • •Cloud infrastructure and email — Amazon Web Services (AWS) for hosting, compute, file storage, backups, and inbound and transactional email processing.
  • •Database hosting — Neon for PostgreSQL database services (US-East-2 region).
  • •Website and documentation hosting — Cloudflare Pages for public website and documentation delivery.
  • •Payment processing — Stripe for subscription management, invoicing, and payment processing.
  • •Security and abuse prevention — Google Cloud reCAPTCHA Enterprise to evaluate authentication and public-form requests for fraud, spam, and automated abuse.
  • •Mapping services — Google Maps Platform for geocoding, mapping, and address verification.
  • •AI services — Google Gemini to process content for the AI-powered features described in Section 2.
  • •Property and parcel data — commercial data providers such as Realie to retrieve and standardize parcel and property information.

These providers receive information as necessary for the relevant service or integration to function. Their processing is governed by applicable agreements and their own terms and privacy practices.

4.4 Legal Requirements

We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to:

  • •Comply with a legal obligation, subpoena, court order, or government request.
  • •Protect and defend our rights or property.
  • •Prevent or investigate possible wrongdoing in connection with the Service.
  • •Protect the personal safety of users or the public.

4.5 Business Transfers

If Appraise Properties Inc. is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

4.6 With Your Consent

We may share your information for other purposes with your explicit consent.

5

Data Retention

We retain information for as long as reasonably necessary to provide the Service, follow organization settings, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service. Retention depends on the type of information and how it is used:

  • •Account and membership data — retained while needed to maintain an account, membership, security history, or organization records. Removing a user or membership does not necessarily delete work product or records owned by the organization.
  • •Organization data — property, appraisal, client, report, file, message, and related records are generally retained while the organization uses the Service. Subscription cancellation or suspension disables normal access but does not itself constitute a verified deletion request.
  • •Deleted records, comments, and audit history — organization administrators can configure retention within limits provided by the Service. Current supported ranges are 7 to 365 days for soft-deleted records, 30 to 3,650 days for deleted comments and audit history, and optional retention of all comments for up to 3,650 days.
  • •Email intake — raw inbound email objects are generally scheduled to expire after 90 days, and completed or failed email-intake records are generally scheduled for deletion after 180 days. Content saved into organization records follows the retention applicable to those records.
  • •Operational and security records — authentication artifacts, webhook events, import sessions, duplicate scans, usage-metering records, and platform audit records use category-specific cleanup periods that generally range from 7 to 365 days after expiration or completion.
  • •Billing records — retained as required by applicable tax and accounting laws.
  • •Backups — retained for up to 30 days and then automatically deleted.

A legal hold, security investigation, unresolved transaction, technical dependency, or applicable law may require us to retain particular information longer. When information is no longer required, we delete or de-identify it in accordance with our retention processes.

6

Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

  • •Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
  • •Encryption at rest — data stored in our databases and file storage systems is encrypted using AES-256 encryption.
  • •Access controls — role-based access control (RBAC) and row-level security (RLS) ensure users can only access data they are authorized to view.
  • •Authentication security — support for passkeys (WebAuthn), multi-factor authentication (MFA/2FA), single sign-on (SSO), and secure session management.
  • •Audit logging — comprehensive audit trails track data access and modifications for accountability.
  • •Infrastructure security — our cloud infrastructure is hosted in SOC 2-certified data centers with physical security controls, firewalls, and intrusion detection systems.
  • •Regular security assessments — we conduct periodic security reviews and vulnerability assessments.

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

7

Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

When information is controlled by an organization that uses the Service, the organization’s administrator may be the appropriate contact for access, correction, export, retention, or deletion requests. We may direct or coordinate those requests with the organization where appropriate.

7.1 All Users

  • •Access and portability — request a copy of the personal data we hold about you in a structured, machine-readable format.
  • •Correction — request that we correct inaccurate or incomplete personal data.
  • •Deletion — request deletion of your personal data, subject to legal retention requirements.
  • •Account or membership closure — request closure by contacting your organization administrator or reaching us through the contact information in Section 13. Closing an individual account does not automatically delete records owned by an organization.
  • •Marketing opt-out — unsubscribe from marketing emails using the link in any marketing email, or by updating your communication preferences in account settings.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • •Right to know — request information about the categories and specific pieces of personal information we have collected, the sources from which it was collected, the business purpose for collection, and the categories of third parties with whom we share it.
  • •Right to delete — request deletion of your personal information, subject to certain exceptions.
  • •Right to correct — request correction of inaccurate personal information.
  • •Right to opt out of sale or sharing — we do not sell or share your personal information for cross-context behavioral advertising.
  • •Right to limit use of sensitive personal information — where applicable.
  • •Non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us using the information in Section 13. We will verify your identity before processing your request.

7.3 EEA/UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

  • •Right to restriction — request restriction of processing of your personal data.
  • •Right to object — object to processing based on legitimate interests or for direct marketing.
  • •Right to withdraw consent — withdraw consent at any time where processing is based on consent.
  • •Right to lodge a complaint — file a complaint with your local data protection authority.
8

Cookies, Browser Storage, and Similar Technologies

8.1 Technologies We Use

  • •Essential cookies — required for authentication, session management, security, and core functionality. These include the _GRECAPTCHA cookie used by reCAPTCHA Enterprise for risk analysis and abuse prevention. These cookies cannot be disabled through the Service.
  • •Local storage — retains preferences on your device, such as theme, table and column settings, saved filters, map configurations, search preferences, and similar workspace choices. These values generally remain until you clear browser data or the Service replaces or removes them.
  • •Session storage — temporarily holds navigation context, one-time handoffs, report-builder content, and drafts for forms such as public requests or portal bids. These values are generally removed after use, when a form is submitted, or when the browser session ends.
  • •First-party aggregate analytics — our own API increments daily counters for normalized page paths, product surfaces, contact events, referring hostnames, and selected UTM source, medium, and campaign values. Analytics does not set or read cookies or browser storage and does not store visitor IDs, session IDs, raw IP addresses, or user agents.
  • •In-memory campaign attribution — tagged marketing values may be held in page memory while you navigate and attached to a contact inquiry only if you submit the form. They are not persisted in cookies, local storage, or session storage.

8.2 Managing Cookies and Browser Storage

Most browsers allow you to block or delete cookies and clear local or session storage. Disabling essential cookies or browser storage may prevent authentication, preferences, drafts, or other parts of the Service from working as expected. Consult your browser’s help documentation for available controls.

8.3 Do Not Track

We currently do not respond to Do Not Track (DNT) browser signals, as there is no universally accepted standard for how to respond to such signals. You can manage cookies, browser storage, and third-party requests using the browser controls described above.

9

International Data Transfers

Appraise Properties Inc. is based in the United States, and our core database and application infrastructure is located primarily in the United States. We also use service providers that operate infrastructure in multiple regions. Depending on the feature you use, your information may be transferred to or processed in the United States and other countries where those providers operate.

Where applicable law requires a transfer mechanism, we use appropriate safeguards, which may include Standard Contractual Clauses, adequacy decisions, or another lawful transfer mechanism.

10

Children’s Privacy

The Service is designed for professional use and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us using the information in Section 13.

11

Third-Party Links and Integrations

The Service may contain links to third-party websites or integrate with third-party services (such as Google Maps, Google Gemini, Stripe, Realie, QuickBooks, Xero, Microsoft Office, and identity providers selected by an organization). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.

12

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

  • •Update the “Last updated” date at the top of this page.
  • •Notify you by email or through a prominent notice within the Service.
  • •Where required by law, obtain your consent before applying material changes.

The revised Privacy Policy applies from its stated effective date. Where applicable law requires consent for a new use of information, we will request it before that use begins.

13

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out through our contact page.

We will respond to privacy-related inquiries within 30 days, or sooner where required by applicable law.