Privacy Policy and Terms of Use

This Policy explains how personal data is handled when you visit, create an account, use a tenant portal, submit or manage work orders, communicate through the Service, or connect an external service. An organization using Bases generally determines why and how its customer and work-order data is used; Bases processes that data to provide the Service on the organization’s behalf. Bases is responsible for data used for platform accounts, security, operation, support, and optional integrations where Bases determines the processing purpose. The controller is ID lausnir ehf., which can be contacted at hello@bases.is.

Depending on how you use the Service, information may include:

• identity and contact details, including name, national ID, email address, and phone number;
• account, organization membership, role, permission, verification, and authentication information;
• work orders, descriptions, locations, messages, files, images, offers, approvals, schedules, expenses, and related records;
• calendar event titles, descriptions, times, status, attendees where provided, and synchronization identifiers;
• when you connect Gmail: email headers and content, senders, recipients, dates, labels, message and thread identifiers, attachment metadata, and attachments to the extent needed to find and process receipts;
• information extracted from receipts, such as merchant, date, amount, currency, VAT or tax, receipt or invoice number, and category;
• technical and security information such as timestamps, browser information, necessary cookies, IP addresses in operational logs, and error data.

We receive information from you, authorized users in your organization, customers submitting requests, normal use of the Service, and integrations you choose to connect. We use it to authenticate users, enforce access controls, operate tenant portals, process work orders and offers, provide scheduling and communications, synchronize calendars, search for and filter email likely to contain receipts, extract and import selected receipts into expense records, send service notifications, support users, diagnose failures, protect the Service, comply with law, and establish or defend legal claims.

Where the GDPR or comparable law applies, processing may rely on performance of a contract or steps requested before entering one, compliance with legal obligations, legitimate interests in operating and securing the Service, and consent where specifically requested. You may withdraw consent at any time, without affecting processing already carried out lawfully.

Google Sign-In provides verified basic account information such as your name, email address, and Google account identifier for authentication. Access to Gmail and Google Calendar is separate, optional, and enabled only with your consent through Google's OAuth authorization flow.

Read-only Gmail access. If you connect Gmail, the Service uses the https://www.googleapis.com/auth/gmail.readonly permission to view, search, and filter messages in your Gmail account that are likely to contain receipts. For this purpose, the Service may read email headers, senders, recipients, dates, message content, labels, message and thread identifiers, attachment metadata, and attachments. This data is used only to identify receipts, extract relevant expense details, and let you review and import receipts into the Service. The permission is read-only: Bases cannot send, modify, or delete Gmail messages, drafts, labels, or settings on your behalf.

We do not retain a permanent copy of your entire mailbox. Content from messages that are not identified as receipts or that you do not choose to import is processed only for as long as needed to perform the search and filtering and is not retained as part of your expense records. For receipts you choose to import, we may retain the Gmail message and thread identifiers, a copy of the receipt or attachment, and extracted receipt information so that we can display and manage your expenses. Imported receipts are visible only to you and users with appropriate access to expense data within your organization.

Google Calendar. When you connect Google Calendar, the Service may read calendar events needed to show your schedule and may create, update, or delete events to keep work orders and portal calendar entries synchronized with your connected calendar.

We may store your Google email address, encrypted access and refresh tokens, granted scopes, calendar and event identifiers, synchronization tokens, and a limited event-data mirror needed for synchronization. Imported private events remain associated with the connected user and are not exposed to other tenant administrators. Shared portal events remain visible only to users with appropriate tenant access.

Google user data, including raw, derived, and aggregated Gmail data, is used only to provide or improve the authentication, receipt, and calendar features described here and visible to the user. It is not sold; used or transferred for advertising; transferred to data brokers; used to determine creditworthiness or lending eligibility; or used to create, train, or improve general-purpose artificial-intelligence or machine-learning models. Employees, contractors, and other humans do not read Google user data unless you give affirmative consent to view specific data for support, or access is necessary for a security investigation or to comply with applicable law. Our use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Sign in with Apple provides your name, email address, and Apple account identifier. If you choose to hide your email address, we receive only a relay address from Apple. Signing in with an Icelandic electronic ID (Kenni) provides your name and national ID number (kennitala). This information is used to verify your identity, link the sign-in to your account, and, where applicable, confirm acceptance of offers. It is not used for any other purpose.

The Bases mobile app is intended for staff of organizations that use the Service. Accounts cannot be created in the app; an organization creates accounts for its staff in the web portal.

The app asks for camera and photo library access only when you choose to take or attach a photo to a work order or message, and only the photos and files you select are sent to the Service. The app does not collect your device's location. Sign-in credentials are kept in the device's secure storage and are deleted when you sign out.

The app contains no analytics, advertising, or tracking tools, and information from it is not used to track you across other companies' apps or websites.

We do not sell personal data. We may use providers for hosting, databases, storage, authentication, email delivery, monitoring, and other infrastructure necessary to operate the Service. Access is limited to what those providers need and is subject to appropriate confidentiality and data-protection terms. Google user data is transferred to a service provider only when necessary to provide or improve the visible features described in this Policy and with user consent, for a security investigation, to comply with law, or as part of a merger, acquisition, or sale of assets after obtaining the user's explicit prior consent. Such providers may not use the data for their own purposes. Other information may also be disclosed when you request it, to provide the Service, investigate security, complete a corporate transaction with appropriate safeguards, or comply with law. Where data is transferred outside the EEA, we use an appropriate legal transfer mechanism where required.

We retain account, tenant, work-order, and transaction data while needed to provide the Service, meet contractual or legal obligations, maintain auditability, resolve disputes, and protect legal rights. Security and diagnostic logs are kept for a limited operational period. When Gmail is disconnected, active access and refresh tokens are deleted from the active system and no new messages are retrieved. Imported receipts and expense records you chose to create may remain until you or your organization deletes them or requests deletion, unless retention is required by law or for legal claims. When Google Calendar is disconnected, the active connection token and private imported-event mirror are removed from the active system. Events already written to Google Calendar may remain there until you delete them or a specific synchronization action removes them. Backup copies expire through normal backup rotation.

We use reasonable technical and organizational safeguards, including tenant separation, role-based access controls, encrypted network connections, protected session cookies, one-way password hashing, and encryption of sensitive integration tokens. No system is completely risk-free, and users should promptly report suspected unauthorized access.

The Service uses cookies and local browser storage that are necessary for secure authentication, OAuth state protection, selected interface settings, and core functionality. These technologies are not used for behavioral advertising.

Depending on applicable law, you may have rights to access, correct, delete, restrict, or transfer your personal data, and to object to certain processing. You can delete your account yourself under “Mín síða” at bases.is/min-sida. Deletion removes your name, email address, national ID number, and all sign-in methods. Records that belong to the organization, such as work orders, time entries, and invoices, remain but are no longer linked to you, in part because of bookkeeping obligations. You can disconnect Gmail and Google Calendar in the Service's integration settings and can also revoke Bases access in your Google Account's security settings. Disconnecting stops new access to Google data but does not automatically delete expense records or receipts you already imported; you can delete them in the Service or request deletion. Requests can be sent to hello@bases.is. We may need to verify your identity and may refer tenant-controlled requests to the relevant organization.

The Service is intended for authorized business users and customers able to use it lawfully. Guardians are responsible where a minor’s use is permitted. You may contact us first with a concern and may also complain to the Icelandic Data Protection Authority or another competent supervisory authority. We may update this Policy for legal, security, operational, or feature changes; the current version and date will remain available here.

By accessing or using the Service, you agree to these Terms. If you use it for an organization, you confirm that you are authorized to do so. Do not use the Service if you do not agree. Mandatory consumer and statutory rights are not waived by these Terms.

You must provide accurate account information, protect your login methods, use only the access granted to you, and notify us promptly of suspected misuse. Access is determined by tenant membership, customer access, roles, and permissions. You may not impersonate another person or share access in a way that defeats those controls.

Bases supplies the software platform. Each tenant organization is responsible for the services it offers, its customer relationships, staff actions, work descriptions, quotations, pricing, schedules, invoices, and legal obligations. Unless expressly agreed otherwise, Bases is not a party to a contract between a tenant and its customer and does not guarantee that work will be accepted, performed, or paid for.

You are responsible for the legality, accuracy, and permissions associated with content you submit, including personal information about others. You retain ownership of your content and grant Bases a limited right to host, copy, process, and display it only as needed to operate, secure, and provide the Service to authorized users.

Offers, prices, estimates, and schedules are based on information supplied by tenants and users. Their binding effect depends on their wording, the parties’ agreement, and applicable law. A calendar entry alone is not a guarantee of attendance, delivery, or performance. Users should verify important dates, amounts, and records with the relevant organization.

Third-party integrations, including Gmail and Google Calendar, are optional and are also governed by the provider’s terms. You must have authority to connect an account. Synchronization can be delayed, duplicated, or temporarily fail because of network conditions, expired authorization, provider changes, or outages. Verify important calendar entries in the relevant system. The Gmail integration gives Bases read-only access and does not authorize Bases to send, modify, or delete email. Automated searching, filtering, and extraction may miss receipts, misclassify messages, or read amounts, dates, taxes, or other details incorrectly. You are responsible for reviewing imported receipts and expense records, comparing them with the source records in Gmail, and correcting errors before using the data for accounting, tax filings, reimbursement, or another important purpose. This feature does not provide accounting, tax, or legal advice. Bases is not responsible for an independent provider’s availability or decisions, although we remain responsible for addressing failures in our own Service as required by law.

You may not use the Service unlawfully or fraudulently; violate privacy, confidentiality, intellectual property, or other rights; bypass access controls; access another tenant’s data; upload malicious code; disrupt or overload the Service; perform unauthorized security testing; resell or copy the Service to create a competing product; or submit content you have no right to process or share.

The Service’s software, design, branding, documentation, and platform content are protected by intellectual-property law. Subject to these Terms, you receive a limited, revocable, non-transferable right to use the Service. No ownership rights transfer unless agreed in writing.

We work to provide a secure and reliable Service but do not promise uninterrupted or error-free operation. We may perform maintenance, deploy security updates, change functionality, or temporarily restrict parts of the Service. Where practical, we will provide reasonable notice of material planned interruptions.

The Service is provided on an “as available” basis to the extent permitted by law. Users remain responsible for their decisions, lawful records, appropriate backups, and verification of important information. To the extent permitted by mandatory Icelandic law, Bases is not liable for indirect or consequential loss, loss caused by inaccurate user data, unauthorized account use, preventable data loss, network failure, or independent third-party services. Nothing excludes liability that cannot legally be excluded, including liability arising from intent, gross negligence, fraud, or personal injury.

Access may be restricted or terminated for security risk, suspected abuse, material breach, legal requirements, non-payment where applicable, or the end of a tenant or user relationship. Where circumstances permit, an opportunity to explain or correct the issue will be provided. Some information may be retained after termination where required for law, settlement, security, or legal claims.

We may update these Terms for legal, security, operational, or feature changes. Material changes will be communicated when required. Icelandic law governs these Terms, subject to mandatory consumer rights. The parties should first try to resolve disputes informally; otherwise, Icelandic courts have jurisdiction under ordinary venue rules. The Service is operated by ID lausnir ehf. Questions and notices may be sent to hello@bases.is.