Privacy policy
Last updated 2026-10-27
This explains what Homebase collects, why, who sees it, and the choices you have. We collect only what a maintenance request needs.
1. Who we are, and whose data this is
Homebase is a product of AIRE. Contact us at support@investingaire.com. See also our Terms, text messaging terms and cookie policy.
There are two roles. For property managers and their staff, we decide how account data is used and are the "business" or controller. For residents and vendors, the property manager who invited you decides why your information is collected, and AIRE processes it for that property manager as its service provider. Requests about a resident's or vendor's data can come to us or to the property manager; we will help route them.
2. Information we collect
Property managers and staff
- Name, email, phone, company name, role, and sign-in credentials (passwords are handled by our authentication provider and never visible to us).
- Properties and units, vendor lists, spend caps, response targets and other settings, and plan and billing details.
- Actions you take in the dashboard, kept in an audit log.
Residents
- Name, email, phone number, unit and property, supplied by the property manager or by you.
- Maintenance reports: your description, photos and video, answers to the assistant's follow-up questions, and messages.
- Access preferences and the time windows you pick for visits.
- Notification choices and your text-message consent record (when and how you agreed or stopped).
- A flag, set by the property manager, that a household member may be vulnerable (for example an infant or a person with a medical need), used only to raise urgency.
Vendors
- Business name, contact name, phone, email, trade, service area, licence and insurance documents and expiry dates.
- Quotes, availability, job proof (photos, notes, invoices) and performance history.
- Public business listing details (such as ratings and phone number) from a places directory, used to help a property manager find vendors.
Collected automatically
Standard server logs (IP address, browser, pages and requests) and the sign-in cookies in our cookie policy. We do not use analytics or advertising trackers.
Photos and video you upload may show the inside of your home or people in it. Upload only what is needed to show the problem. We do not ask for government IDs, financial account numbers or health information, and ask you not to include them in reports. Homebase does not process payments between parties.
3. How we use it
- To triage requests, find and book approved vendors, schedule visits, track jobs and detect patterns across a building.
- To send you the emails and text messages described in the settings you control.
- To keep the service secure, prevent abuse, fix problems and keep the audit log.
- To bill property managers and to meet legal obligations.
We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for profiling that has legal or similarly significant effects.
4. AI processing
Reports and chat messages are sent to a third-party AI inference provider (currently NVIDIA NIM) to classify urgency, ask follow-up questions and draft messages. We send the report content and what is needed to judge it, not your password or payment details. We do not use your data to train the underlying models, and our provider does not either under our agreement with it. A fixed safety rule for words such as gas and smoke runs before the AI and cannot be turned off. AI output is a recommendation; the property manager supervises and can step in at any time.
5. Who we share it with
With the property manager responsible for your building, with the vendor assigned to your repair (limited to what the job needs: the issue, unit, access window and a contact route), and with these providers acting for us:
| Provider | Purpose | What is shared |
|---|---|---|
| Supabase | Sign-in, database and file storage | Accounts, all records above, uploaded photos and video |
| Vercel | Website hosting | Traffic to the site, including IP address |
| Oracle Cloud Infrastructure | Hosts our AI and job service | Requests and records the service processes |
| NVIDIA NIM | AI triage, chat and drafting | Report text and related context |
| Telnyx | Text messages | Phone number and message content |
| Resend | Email address and message content | |
| Google Places | Vendor search | Search terms and location (no resident data) |
| Stripe | Subscription billing, when enabled | Property manager billing details (no resident data) |
We may also disclose information to comply with law or legal process, to protect safety, or in a merger or sale of the business (we would tell you and this policy would continue to apply). We do not share it with anyone else for their own marketing.
6. Retention
- Account and request records: kept while the property manager's account is active so that repair history stays available. A property manager can delete a resident record, including their reports and uploaded media, and can close the account.
- Deleted records: removed from our systems when deleted. Copies in provider backups are overwritten in their normal backup cycles. Requests sent to us are completed within 45 days.
- Consent and audit records: consent logs and the audit log are kept as proof of consent and of what the system did on a property manager's behalf. We keep what is needed to show a consent was given or withdrawn, even after a resident is removed.
- Server logs: kept for a limited period under our hosting providers' log settings.
- Vendor links: secure job links stop working once they expire or the job is closed.
7. Your choices and rights
Depending on where you live, laws such as the CCPA/CPRA and those in Colorado, Connecticut, Texas, Virginia and other states may give you the rights below. We honor these requests from all U.S. users.
- Know and access: residents can download their data from the resident portal settings; or ask us.
- Correct: edit your profile in the portal, or ask us or your property manager.
- Delete: ask us or your property manager (see section 6 for what we keep).
- Text messages and email: change them in portal settings, or reply STOP to a text. See the text messaging terms.
- Opt out of sale, targeted advertising and profiling: we do none of these. We treat browser opt-out signals such as Global Privacy Control as valid requests.
- Non-discrimination: we will not deny service or change pricing because you used a privacy right.
How to make a request
Email support@investingaire.com, ideally from the address on your account, and say what you would like. We may ask you to confirm by replying to a message we send there. An authorized agent needs your written permission. We confirm receipt within 10 business days and respond within 45 days, and may extend once by up to 45 more days after telling you why.
Appeals
If we deny a request, reply with "Appeal" in the subject. We respond in writing within 45 days. You may also contact your state attorney general.
8. Children
Homebase is not directed at anyone under 18 and we do not knowingly collect their data. A resident account is for an adult household member.
9. Security
We use encrypted connections, per-organization access controls in the database so one property manager cannot see another's data, residents limited to their own records, and provider-managed security. No system is perfectly secure. If a breach affects you we will notify you and your property manager as the law requires.
10. Changes
If we make material changes we will change the date above and give at least 30 days' notice by email or in the app, except where a change is required by law or needed to address a security or abuse issue.