Privacy Policy

There are no cookies on this site and no cookie banner, since nothing here needs your consent. Traffic is measured with aggregated, cookieless analytics that cannot single you out. The only personal data we handle is what you choose to send through the request-access form or by email, and it is used solely to reply to you.

If you use the Basin platform itself, with an account, through the console, or by connecting Basin to an AI assistant, the platform sections below also apply: we process your account identity and your transaction records to run the service, we never see your AI conversations, and we never sell or share personal information.

The business responsible for this site is Basin, Inc., a Delaware corporation based in San Francisco, CA. For anything covered by this policy, contact privacy@basinmedia.ai — it goes straight to our privacy team.

Technical access logs. To serve the site and defend it against abuse, our hosting provider keeps standard request records (IP address, user agent, requested URL). They are collected for security and operations only, live only for the brief window security requires, and are then removed.

Traffic analytics. We run Vercel Web Analytics in cookieless mode — no cookies, no advertising identifiers, no cross-site tracking. A short-lived hash counts visits, is thrown away, and cannot be traced to a person; all we ever see are aggregate figures like page views and referrers. It exists for one purpose: knowing how the site is used.

The request-access form. Submitting it means we process your name, work email, company, role and whatever you write, so we can assess the request and respond. The submission passes through our own server, which retains nothing, and lands in two places: a lead register hosted on Notion where the conversation is tracked, and our inbox via a single notification email sent through Resend. An invisible Cloudflare Turnstile check runs behind the form to keep bots away. The submission is used only to evaluate and answer your request, and the anti-abuse check only to keep the form usable.

Email correspondence. When you email us directly, your address and message are processed so we can answer, and for no other purpose. Correspondence is retained only while the exchange stays relevant.

Nothing else. No advertising identifiers, no profiling, and no selling or sharing of personal information as the CCPA/CPRA defines those terms — and none of it is used to train AI models.

Signing in to Basin, on the web console or when connecting Basin to an AI assistant, is handled by our identity provider, WorkOS, Inc. (AuthKit). We receive and store your name, email address, and a unique account identifier. We use them to operate your account, attribute your activity, and contact you about the service, and for nothing else.

Using Basin creates business records: inventory searches, quotes, negotiation logs, orders, creative references you supply (asset URLs and landing pages), delivery metrics, and an append-only audit trail that attributes each action to the account that took it. These records exist because an advertising transaction needs a durable, auditable history. They are retained for as long as your account is active and for any period business and legal record-keeping requires, then deleted.

Basin can be connected to AI assistants such as Claude or ChatGPT over the Model Context Protocol. When your assistant uses Basin, we receive only the structured requests it sends to our tools, for example a search filter, a budget, or a creative URL, together with your account identity. We do not receive, store, or have any access to your conversations with the assistant. What the assistant itself collects is governed by its provider's own privacy policy, not this one. Basin's responses go back to your assistant; our copy of the exchange is limited to the transaction records described above, and none of it is used to train AI models.

Six providers work for us, each bound by a written service-provider agreement: Vercel Inc. (hosting this site, plus the cookieless analytics above), Google LLC (Google Cloud, hosting the Basin platform), WorkOS, Inc. (sign-in and account identity), Notion Labs, Inc. (the register that tracks access requests), Resend (delivering the notification email), and Cloudflare, Inc. (Turnstile, the invisible anti-abuse check on the form). Turnstile separates humans from bots in the background; Cloudflare handles limited technical data for that one purpose under its Turnstile Privacy Addendum and never for advertising or cross-site tracking. These providers process data in the United States, each acting as a service provider as the CCPA/CPRA defines the term: contractually limited to the services described here, and barred from using your data for purposes of their own.

Form submissions and correspondence stay with us while the request is being evaluated and for as long as the relationship remains active; after that they are deleted. Aggregated analytics hold no personal data, so no deletion clock applies. Hosting logs follow the provider's short security retention window.

US privacy law — including the California Consumer Privacy Act, as amended by the CPRA — gives you the right to know what personal information we hold, and to request access, correction and deletion. You may also opt out of any sale or sharing, though we do neither. Email privacy@basinmedia.ai and you will hear back within 45 days. You may also complain to your state regulator — in California, the California Privacy Protection Agency.

Any change to this policy will appear on this page with a fresh date. We will not weaken it quietly.