Privacy policy
Last updated: August 25, 2026
Overview
This Privacy Policy explains how Based collects, uses, stores, and shares personal information when you use Based or interact with a campaign website powered by Based. Based is a campaign management platform for municipal election candidates and campaign teams. Additional detail about storage, processing, and the safeguards applied to electoral register information is set out in our Data Residency and Compliance document.
Information we collect
When you create or use a Based account, we may collect your name, email address, phone number, municipality, the office you are seeking, billing and subscription information, content and files you create or upload, and technical information such as IP address, browser details, device information, and activity logs. Account authentication is provided through Google Firebase, and Based does not receive or store your password in readable form. Payment card details are handled by our payment provider and are not stored in full by Based. Campaigns may use Based to collect and manage information relating to residents, supporters, volunteers, donors, and other individuals, including names, addresses, contact information, canvassing activity, notes, donor records, campaign expenses, event registrations, lawn sign requests, and related supporter or voter-identification information. Some campaign data may reveal or suggest a person's political opinions or preferences. Campaign websites powered by Based may also allow people to contact a campaign, request a lawn sign, RSVP to an event, volunteer, donate, or otherwise provide information to the campaign. Where the feature is enabled and a campaign is legally entitled to use an official voter list, elector list, or voters' roll, a campaign may upload that list to Based. Depending on the jurisdiction, this may contain names, addresses, a voter identifier, and in some cases a date of birth, phone number, or email address. Electoral register information is not collected by Based from individuals; it originates with the election authority and is provided to Based by the campaign. To build canvassing maps and routes, Based uses public and licensed address, boundary, and mapping data and may send a street address or map area to mapping, geocoding, and address-validation providers. When this happens, we send address and geographic information only, not names, contact details, supporter data, or electoral register information.
How we use information
We may use personal information to provide, operate, and improve Based; create and manage accounts; process payments and transactions; provide customer support; send service, security, and account communications; maintain platform security and reliability; detect fraud, abuse, or misuse; comply with legal obligations; and enforce our Terms of Service. We do not use campaign information collected by one campaign for the benefit of another campaign. Campaigns determine what campaign information they collect and how they use it. Based provides the technology to store and process that information on their behalf. Campaigns are responsible for ensuring the information they collect and enter into Based is collected and used appropriately and in accordance with applicable law, and that they are permitted to hold and use it for the purposes for which they use Based. Based does not sell campaign information, share it with unrelated campaigns or political organizations, use it for advertising, or use identifiable campaign information to train general-purpose machine learning models.
Electoral register information
Electoral register information is treated as restricted information and handled differently from all other information in Based. It is stored in a separate, jurisdiction-specific environment, not in the main Based database. Information from a Canadian list is stored and processed in Canada; information from a United States list is stored and processed in the United States. The two environments are independent of each other, and neither is a copy or replica of the other. Electoral register information does not cross a border and is not moved out of the environment it was uploaded into. The complete original record supplied by the election authority is encrypted before it is stored using a key unique to that list. Date of birth, telephone number, email address, and any other supplied field remain inside that encrypted record. The official elector identifier issued by the election authority is never stored in readable form; only a one-way keyed value derived from it is stored so duplicates can be recognized without the identifier itself being retained. The underlying storage volume is encrypted as well. Name, address, and locality are stored in readable form within that protected environment because matching a list to a household, a canvassing route, or an existing campaign contact requires it. Where a campaign has enabled it, electoral register information may be displayed alongside an existing campaign contact or a door on a canvassing route as a read-only summary showing name, address, and a masked elector identifier. Additional fields are shown only on an explicit, individually recorded request. Electoral register information is used only for that purpose. It is never written into a campaign's general contact records, canvassing data, or address data; never used for email marketing, analytics, advertising, AI or ML, or any commercial dataset; never exported; and never sent to mapping, geocoding, address-validation, email, or analytics providers. It is never shared with another campaign or organization and is never sold. Access is limited to authenticated users of the campaign that uploaded the list, and is denied by default unless that campaign has been granted access to that specific list. Every read is recorded in an access log, and each time a user requests the full underlying record for an individual, that request is separately recorded. A retention deadline is set for each list when it is uploaded. On that deadline, or earlier at the campaign's request, the list is purged: access is blocked, the encryption key is destroyed, and the records, matches, and derived data are deleted. A record that a list was uploaded and later purged is retained as evidence, but it contains no personal information. Electoral register information originates with an election authority. Requests to access, correct, or remove an entry on an official voter list must be made to that authority, which maintains the authoritative record. If you contact Based about an electoral list matter, we can confirm how it is handled and direct your request to the applicable campaign or authority.
Payments and service providers
Payments made through Based are processed by third-party payment providers such as Stripe. When someone makes a campaign contribution through a Based-powered website, payment information is provided directly to the payment provider. Based does not store complete payment card numbers. We may receive transaction information, including contributor information, contribution amount, transaction date, and payment status so the transaction can be recorded and displayed to the applicable campaign. Campaigns remain responsible for their own campaign finance, reporting, recordkeeping, and other legal obligations relating to contributions. We use third-party service providers to operate Based, including Google Cloud and Firebase for application infrastructure, hosting, database services, file storage, and authentication; Mailgun for transactional email delivery; Stripe for payment processing; Google Maps Platform, Canada Post, and other address and mapping providers for address validation, geocoding, and canvassing map data; and a domain registrar for campaigns that register a domain through Based. These providers may process information as reasonably necessary to provide their services to us and are subject to their own privacy and security practices. A current list of service providers, what each processes, and where it processes it is maintained in our Data Residency and Compliance document. Electoral register information is excluded from these providers. Only the approved infrastructure provider for the applicable jurisdiction processes it. If a campaign connects Based with another service, such as an email marketing platform, information may also be transferred to that service at the campaign's direction. Electoral register information is not included in those transfers. We may disclose information where required by law, where reasonably necessary to protect Based, our users, or others, or as part of a merger, acquisition, financing, reorganization, or sale of our business. Based does not sell personal information to advertisers, political parties, campaigns, or data brokers.
Storage, security, and retention
Based's application and database infrastructure is provided by Google Cloud and Firebase. The primary campaign database is located in Canada. Files uploaded to Based, such as images and other media, and the application servers that process requests, are currently located in the United States. Electoral register information is held only in the jurisdiction it came from, as described above. Some service providers may process information in other jurisdictions. Where information is processed outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by courts, law enforcement, and government authorities there. We use reasonable administrative and technical safeguards designed to protect personal information. Access to campaign information requires authenticated user access, and users may only access campaign information for campaigns to which they have been granted access. Information is encrypted in transit, and stored information is encrypted at rest. Certain sensitive information, including electoral register records and credentials for connected services, is encrypted with additional application-level keys. We retain information only for as long as reasonably necessary to provide the service and meet legal, security, and operational requirements. Electoral register information is retained only until its retention deadline. Campaigns may have separate legal obligations requiring certain election, contribution, or financial records to be retained. If we become aware of a security incident affecting personal information, we will investigate, take steps to contain it, and provide notice to affected campaigns, individuals, and regulators where required by applicable law.
Your privacy requests
You may contact us at privacy@getbased.io to request access to, correction of, or, where applicable, deletion of personal information that Based controls. If your request relates to information collected by a particular campaign, we may direct your request to that campaign. If it relates to an official voter list, we may direct your request to the applicable election authority, as described above. You may also have the right to raise a concern with an applicable privacy regulator. If you believe a campaign using Based has information about you and you would like to access, correct, or request deletion of it, contact the campaign directly. If you cannot reach the campaign, contact us and we can assist in directing your request. For obvious operational reasons, we do not maintain voter-list data on a standalone individual request basis outside the authorized campaign process.
Cookies, analytics, and changes
Based uses cookies and similar technologies where necessary to operate and secure the platform and understand how the service is used. Based does not use information collected through campaign websites for cross-site behavioral advertising. Third-party services added or connected by a campaign may have their own privacy practices. Analytics, session recording, error reporting, and similar telemetry are disabled on the parts of Based that handle electoral register information. We may update this Privacy Policy as Based, our practices, or applicable requirements change. The date at the top will indicate when it was last updated. Questions, requests, or concerns can be directed to Based at privacy@getbased.io.