Privacy policy
Last updated: Oct 1, 2026
Basnu is operated by Mohd Yeasin Arafat. This policy covers the rental-management app and supporting website. The initial beta is for U.S. users.
What we collect
- Account: email, chosen name, sign-in identity, sessions and preferences. When you choose Google sign-in, Google supplies your account identifier, email and basic profile information, such as your name and profile picture if provided. We use this information to authenticate and identify your Basnu account.
- Rental records: property addresses, rooms, household names, invitations, leases, charges, payments, receipts and rental history, including information entered by your owner or manager.
- Content: maintenance requests, messages, announcements, activity, read/dismissal states, photos and documents, including personal details and file metadata.
- Requests: support messages and attachments, assistant questions and authorized records used for limited lease-date lookup. The separate in-app AI support chatbot uses only the text you enter and recent chat replies; it cannot access rental records or files.
- Device and service information: notification preferences; installation identifiers, registrations, push tokens, platform and delivery status when phone notifications are enabled; IP addresses and service request logs.
How we use it
To sign you in, maintain rental records, handle requests and conversations, provide support, secure the service and deliver enabled updates. Online payments are unavailable in the beta; Basnu does not collect card details for online rent payments.
Who can access it
Owners and managers can access their organization’s records. Tenants can access their household’s records and information deliberately shared with their rental or property. Other household members may see shared records. The operator and service providers may access information to support and operate Basnu.
- Supabase: sign-in, database and files.
- Google: Google sign-in and the Gmail mailbox used for support while our dedicated mailbox is being set up.
- OpenAI: typed messages and recent replies when you use AI support. API messages are not used for model training by default. Basnu requests no saved response state, but OpenAI may retain safety logs for up to 30 days, with legal or security exceptions.
- Resend: email recipients, content, links and delivery results when email delivery is enabled. Resend states that email and log data is retained for 30 days and backups for seven days.
- Expo, Apple and Google: app infrastructure; device tokens and generic notifications when push delivery is enabled.
- Cloudflare: this website’s hosting and security, including technical request information such as IP addresses.
Google sign-in information is used for account access and operation, not sold or used for advertising. We do not send your Google access token to the AI support service.
Storage, permissions and security
The app stores sign-in, preferences and pending links on your device. You choose uploaded files and grant camera or notification permission when needed. These supporting pages use no advertising or analytics scripts and set no account cookies; Google and the app’s browser version handle their own sessions.
HTTPS and server-side account and rental permissions protect access. They cannot remove copies an authorized recipient has already downloaded.
Retention and deletion
AI support chats stay in screen memory, cleared when you leave or start a new chat; Basnu does not save chat text on its server. Usage counters contain no chat text and are removed with your account. Clearing the screen does not erase provider safety logs.
Account deletion removes your sign-in account, profile, memberships, private notifications, assistant chats and message text. Shared rental history and files remain available to authorized members and may still contain personal details. Archiving does not erase records. A restricted privacy review log keeps account and record identifiers and review decisions, without copying message text or files.
Shared leases, financial records and related documents are kept while needed to administer a rental, resolve a dispute, protect legal rights or meet a legal obligation. They are not automatically erased when an account is deleted. Requests to remove personal details from shared records are reviewed individually, including the rights of other people whose information is in the same record. A proposed seven-year retention schedule is still under review and is not active. Support correspondence is kept while needed to handle the request and related follow-up or disputes. Provider logs and backup copies may remain after changes to live data; we do not promise an immediate or uniform erasure deadline for those copies. We cannot recall copies already downloaded by authorized recipients.
Delete your account or request deletion.
Your choices and contact
Manage account settings, available notification preferences and device permissions. You can request access, correction or deletion of personal information, including details in shared records. We verify your identity before disclosing or changing private information.