Privacy Policy

Basset is a daily field reporting application operated by Basset, Inc. (“Basset,” “we,” or “us”) and used by construction and underground utility companies (“Customers”). This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices available to you.

Basset is a workplace tool: almost all information in it is submitted by a Customer or by its employees and contractors in the course of work. By using the Service, you acknowledge the practices described in this policy.

Effective date: September 11, 2026.

1. Information we collect

1.1 Account and authentication information

When a Customer administrator invites a user, we collect the user’s name, work email address, assigned role (field, office, or admin), company membership, and project assignments. Accounts are invite-only. Passwords are stored as salted hashes by our authentication provider and are never visible to Basset staff or to Customer administrators. We also send account emails such as invitations, password resets, and magic sign-in links from our own domain.

1.2 Work records submitted by users

Users create records that belong to the Customer, including daily reports (date, project, crew size, hours worked, notes), production entries (line names, stations, linear footage, structure installs), crew time entries (employee names, positions, and hours), locate tickets, safety forms (such as JHA, toolbox talk, and equipment checklists), and support tickets. Each report is attributed to the user who submitted it.

1.3 Photos and files

Users may attach job site photographs and captions to reports and locate tickets. Plan-sheet PDFs may be uploaded per project. Uploaded images are resized server-side and HEIC files are converted so they can be viewed on any device. These files are stored in a private bucket and served through short-lived signed links.

1.4 Device location and weather

Project location coordinates may be entered by a Customer administrator. When a field user chooses to attach weather to a report, the app may request the device’s location to look up historical weather conditions for that location and report date. Location is requested only for that purpose and is not stored separately as a precise user location history.

1.5 Billing information

We collect subscription status, seat counts, and billing contact details. Payment card information is collected and stored by Stripe, our payment processor. Basset does not receive or store full payment card numbers.

1.6 Automatically collected diagnostic and operational data

We collect timestamps for creation and edits, app and browser identifiers needed for support, standard server and error logs, and submission-stage diagnostics (for example, the failing stage, report or submission identifier, app version, browser, and connectivity state). These logs are used to operate and protect the Service and to diagnose failures. We do not log report contents or photo data in diagnostic traces.

1.7 Data stored on your device for offline use

Basset is designed to work on job sites with poor or no signal. To support this, the app stores unsent report drafts, draft photos, cached plan sheets, signed-in session and identity information, user preferences, and app assets locally on the device using IndexedDB, localStorage, and a service worker. Queued reports are sent automatically when connectivity returns. Users can sign out to clear the local session, and administrators can remove accounts.

2. How we use information

• To provide the reporting, gallery, PDF export, Excel export, and plan-sheet features;
• To authenticate users and enforce role, company, and project access rules;
• To send account emails such as invitations, password resets, and sign-in links;
• To attach historical weather conditions to reports when requested;
• To translate report notes into another language when a user requests translation;
• To bill subscriptions, manage seats, and support administrators;
• To diagnose errors, improve reliability, and protect the Service from abuse;
• To alert Basset support staff by SMS and email when a user submits an error or support report, including the reporter’s name, company, category, and message text.

Basset does not sell personal information, does not share it with advertisers, and does not use Customer work records to build products for other customers. We do not use tracking pixels, advertising SDKs, or analytics providers for cross-app or cross-site tracking.

3. How we share information

We share information only with service providers that help us operate the Service, and only to the extent necessary for their function. We may also share information if required by law or to protect our rights or users.

4. Service providers

Basset relies on the following third-party providers:

• Cloud hosting, database, authentication, and photo storage provider — hosts the application, stores data, authenticates users, and stores report photos and files;
• Stripe — payment processing, subscriptions, invoices, and billing portal;
• Email delivery provider — sends account and transactional emails from notify.usebasset.com;
• Twilio — sends SMS alerts to a Basset phone number when a user submits an error or support report;
• Open-Meteo — retrieves historical weather data when weather is attached to a report;
• Google Cloud Translation — translates report notes when a user explicitly requests it.

Each provider receives only the data needed to perform its function.

5. Data security

Traffic between the app and our servers is encrypted in transit using HTTPS. Data is encrypted at rest by our hosting provider. Access rules are enforced at the database level, not only in the user interface, so a user cannot read or modify another company’s records. Administrative actions such as inviting users, changing emails, or deleting accounts are restricted to authorized roles. Report photos and files are stored in a private bucket and served through short-lived signed links.

6. Data retention and deletion

Basset retains information for as long as reasonably necessary to provide the Service, support customer operations, maintain business records, comply with legal or contractual obligations, and resolve disputes.

While a Customer’s subscription is active, work records are retained as the Customer’s business records. When a user is removed from a company, their historical reports are preserved under the Customer’s account because they are business records of the Customer. After a Customer’s subscription ends, data is retained so the Customer can export it, and may be deleted on request subject to applicable retention requirements and the organization’s need to preserve historical business records.

Server and error logs are kept for a short operational window and then aged out.

7. Your choices and rights

Because most Basset data is processed on behalf of an employer, the fastest way to update or remove information is usually through the Customer’s administrator, who can update names, emails, roles, project assignments, and remove accounts.

Administrators and individuals may also contact us directly to request access, correction, export, or deletion of personal information. We will respond in coordination with the Customer and subject to the Customer’s business-record retention needs and applicable law.

8. Children’s privacy

The Service is intended for workplace use by adults and is not directed to anyone under 18. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Customer administrators by email or in the application before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

10. Contact us

For privacy questions, access requests, correction requests, deletion requests, or other privacy-related inquiries, contact:

Basset, Inc. — dakota@usebasset.com

For general support questions, contact support@usebasset.com.