Privacy Policy

Last updated: 15 July 2026. This policy applies to all visitors, users and customers of Basis Research, Inc. and its services at basisresearch.tech.

Who we are

The data controller is Basis Research, Inc., a Delaware corporation. Our principal offices are at 631 Brannan Street, Suite 300, San Francisco, CA 94107, United States.

You can reach our privacy contact at privacy@basisresearch.tech.

Data we collect

Account data

When you create an account we collect your name, email address, organisation name and, where applicable, billing address and business tax identification number. Payment card details are handled directly by our payment processor and are never stored on our systems.

Usage data

We collect information about how you use our platform: pages visited, features used, API call counts, inference volume, error logs and timestamps. We also collect standard server logs including IP address, browser type and referring URL. This data is processed in aggregate to operate and improve the service.

Customer-provided training data

When you upload a corpus, style guide or evaluation examples to fit a private model, we process that data on your behalf. This data is used solely to fine-tune and evaluate your private model. It is not used to train our shared base models, is not used to train any other customer's model, and is not retained beyond the period needed to complete and support your fitting unless you instruct us to store it.

Communications

If you contact us by email or through a form, we retain the content of that communication to respond to your query and to keep a record of our interactions.

Cookies

We use essential cookies only: session tokens to keep you signed in and CSRF tokens for security. We do not set tracking, advertising or analytics cookies. See the Cookies section below for more detail.

Lawful bases for processing

We process your personal data under the following bases, consistent with applicable data protection laws, including the California Consumer Privacy Act (CCPA/CPRA) and, for individuals in the EU and UK, the EU and UK GDPR:

• Contract. Processing your account data and customer-provided training data is necessary to perform the contract we have with you and to provide the service you have engaged us to deliver.
• Legitimate interests. We process usage data and server logs to operate, secure, monitor and improve our platform. We have assessed that this does not override your interests or fundamental rights.
• Consent. Where we send you marketing communications, we will ask for your consent first and you may withdraw it at any time.
• Legal obligation. We may process certain data to comply with our obligations under applicable US law, including tax and accounting requirements.

How we use your data

• To create and manage your account and to provide the fine-tuning, evaluation and deployment service described in our Terms of Service.
• To process payments and issue invoices.
• To send transactional communications such as account notices, receipts and service updates.
• To monitor the security of our platform, investigate suspicious activity and prevent abuse.
• To improve our platform based on aggregated, de-identified usage patterns.
• To comply with applicable law and to respond to lawful requests from public authorities.

Your training data and model isolation

This is fundamental to the Kethra service. The corpus, examples and evaluation cases you provide are used to fit and score your private model weights only. Your training data is never used to update or fine-tune our shared base models. It is never shared with, or used to train, any other customer's model. This isolation is a contractual commitment and is enforced at the infrastructure level.

Sub-processors

We engage a small number of third-party sub-processors to provide the service. Current categories include: cloud infrastructure and compute (GPU hosting), payment processing, transactional email and error monitoring. We maintain a sub-processor list and will notify you of material changes. You may request the current list by writing to privacy@basisresearch.tech.

International transfers

Kethra is based in the United States. Some of our sub-processors operate infrastructure in the European Economic Area or in other countries. Where personal data is transferred outside the United States, we rely on standard contractual clauses, data privacy frameworks (such as the EU-US Data Privacy Framework) or other appropriate safeguards to ensure an equivalent level of protection. You may request details of the safeguards we rely on by writing to privacy@basisresearch.tech.

Retention

We keep your account data for as long as your account is active and for a reasonable period thereafter in case you return or in case of disputes. We keep financial records for seven years to comply with applicable US tax and accounting law. We keep server logs for 90 days. Training data uploaded to fit a model is retained for the duration of your active plan and for 30 days after cancellation, after which it is deleted unless you have instructed us to remove it sooner. You may request early deletion at any time.

Your privacy rights

Depending on where you are located, you may have the following rights in relation to your personal data. To exercise any of them, write to privacy@basisresearch.tech. We will respond within 45 days (or within one month where EU or UK GDPR applies).

California residents (CCPA/CPRA) have the right to:

• Know. You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties with whom we share it.
• Delete. You may request deletion of personal information we hold about you, subject to certain exceptions permitted by law.
• Opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising. If this changes, we will provide a clear opt-out mechanism.
• Non-discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

EU and UK residents (GDPR) have the right to:

• Access. You may request a copy of the personal data we hold about you.
• Rectification. You may ask us to correct inaccurate or incomplete personal data.
• Erasure. You may ask us to delete your personal data where there is no legitimate reason for us to continue processing it.
• Portability. Where processing is based on consent or contract and is carried out by automated means, you may ask us to provide your data in a structured, commonly used and machine-readable format.
• Objection. You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Restriction. You may ask us to restrict processing in certain circumstances, for example whilst a rectification request is under consideration.
• Withdrawal of consent. Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Cookies

We use only the cookies that are strictly necessary to operate the service:

• A session token to keep you authenticated whilst you are signed in.
• A CSRF token to protect form submissions from cross-site request forgery.

We do not set advertising cookies, tracking pixels, or third-party analytics cookies. We do not use fingerprinting or other non-cookie tracking methods for advertising or analytics purposes.

Children

Our service is directed at businesses and is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Changes to this policy

We may update this policy from time to time. Where a change is material, we will notify you by email or by a prominent notice in the platform before the change takes effect. The date at the top of this page reflects when the policy was last updated.

Complaints

If you are unhappy with how we handle your personal data, we would appreciate the opportunity to address your concern first. Please write to us at privacy@basisresearch.tech.

If you are a California resident, you may also contact the California Attorney General's office. If you are located in the EU or UK, you have the right to lodge a complaint with your local supervisory authority; UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Contact

For any questions about this policy or about your personal data, please contact our privacy team:

• Email: privacy@basisresearch.tech
• Post: Basis Research, Inc., 631 Brannan Street, Suite 300, San Francisco, CA 94107, United States