Privacy Policy

This Privacy Policy (the "Policy") describes how HomebaseDAO, Inc. ("Homebase," "we," "us," or "our") collects, uses, shares, and protects Personal Information in connection with our public website at homebasecre.com (the "Site"), our hosted syndication and fund administration platform available at app.homebasecre.com and Sponsor-branded portals (the "Platform"), our APIs and MCP interfaces, and related services (together, the "Services"). "Personal Information" means information that identifies, relates to, or could reasonably be linked to an individual.

Use of the Services is also governed by our Terms of Service at https://homebasecre.com/terms. Capitalized terms not defined here have the meanings given in the Terms of Service.

Contents

1. Who This Policy Applies To and Our Roles
2. Information We Collect
3. How We Use Personal Information
4. How We Share Personal Information
5. Cookies and Tracking Technologies
6. Artificial Intelligence and Automated Processing
7. How We Protect Personal Information
8. Data Retention
9. Your Choices and Rights
10. Additional Information for U.S. State Residents
11. Biometric Information
12. Users in Canada
13. Users in Mexico
14. Users Outside the United States, Canada, and Mexico
15. Children's Privacy
16. Third-Party Links and Services
17. Global Privacy Control and Do Not Track
18. Changes to This Policy
19. Contact Us

1. Who This Policy Applies To and Our Roles

The Services are used by three kinds of people, and our role differs for each.

Sponsors and their Authorized Users. Sponsors are real estate fund managers and syndicators that subscribe to Homebase to market, administer, and raise capital for their offerings. For the account, billing, KYB, and usage information we collect about Sponsors and the individuals who work for them, Homebase decides how and why the information is used. We are the "controller" or "business" for that information.

Investors. Investors are individuals and entities that a Sponsor invites to view, commit to, or invest in the Sponsor's offerings through a Homebase dealroom or investor portal. When you provide information in a Sponsor's dealroom (for example, your subscription details, accreditation documents, or bank account), you are providing it to the Sponsor, and Homebase processes it on the Sponsor's behalf and under the Sponsor's instructions. For that information, the Sponsor is the controller or business and Homebase is the "processor" or "service provider." Questions about how a Sponsor uses your information, and requests to access or delete information held in a Sponsor's dealroom, should be directed to the Sponsor. We will assist the Sponsor in responding.

Separately, Homebase has its own legal obligations to verify identity, screen for sanctions and politically exposed persons, prevent fraud, and keep required records. For those purposes, and for your Homebase account itself (your login, your cross-Sponsor investor profile, and your communications with us), Homebase is the controller of your Personal Information and this Policy applies directly.

Site visitors. If you visit our Site, subscribe to our newsletter, request a demo, or contact us, Homebase is the controller of the information you provide and the information collected automatically. The Site uses the analytics technologies described in Section 5; the Platform uses only first-party product analytics and support tooling. No advertising, retargeting, or visitor identification technology runs anywhere in the Services, including on Sponsor-branded portals and on any page where identity, financial, or investment information is entered.

2. Information We Collect

2.1 Information You Provide

Sponsor account and billing information. Legal entity name, business address, entity formation and beneficial ownership information (for KYB), names, titles, email addresses, and phone numbers of account administrators and Authorized Users, billing contact information, tax identification numbers, and your selected Plan. Payment card information for subscription billing is collected and stored by Stripe. Homebase receives only a token, the card brand, the last four digits, and the expiration date.

Investor identity and account information. Full name, email address, residential address, date of birth, citizenship, phone number, social security number or other taxpayer identification number, government-issued ID, employment information, information about investor accreditation and suitability, and, for entity Investors, entity formation and beneficial ownership information.

Financial and transaction information. Bank account details (collected through ZumRails or manual entry), subscription amounts, capital commitments, contributions, distributions, tax forms, and records of transactions conducted through the Services.

Documents and signatures. Offering documents, subscription agreements, accreditation letters, and other documents you upload, generate, or sign through the Services, including electronic signature records (signer name, email, IP address, timestamp, and audit trail) generated through Dropbox Sign.

Content you create. Dealroom content, investor communications, notes, and other content Sponsors create in the Platform; and messages, support requests, survey responses, and other information you send to us.

Marketing and contact information. If you request a demo, subscribe to updates, or attend an event, your name, email, company, role, and communication preferences.

Representatives. Contact information for your attorney, accountant, financial adviser, or other representative if you provide it.

2.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect:

• Device and connection data: IP address, browser type and version, operating system, device type and identifiers, language, and time zone.
• Usage data: pages viewed, features used, click paths, dealrooms visited, documents opened, session duration, referring URLs, and timestamps.
• Log and security data: authentication events, API and MCP requests, error logs, and records of actions taken in the Platform, which we keep for security, audit, and support purposes.
• Cookies and similar technologies as described in Section 5.

2.3 Information From Third Parties

• Identity verification providers (currently Persona) return verification results, risk signals, and a verification token. We do not receive a copy of your ID image unless required for compliance review.
• Sanctions, PEP, and fraud screening providers return screening results and match details.
• Bank connection and payment providers (ZumRails) return account ownership verification, account and routing details, balances where you authorize it, and transaction status.
• Sponsors provide Homebase with information about their Investors, such as names, email addresses, and historical investment records, when they set up dealrooms or import investor lists.
• Business and marketing tools, including our CRM (HubSpot), may provide company and contact information about Sponsor prospects and information about how you arrived at our Site.
• Public sources such as government records and business registries, used for KYB, address verification, and understanding our users.

3. How We Use Personal Information

We use Personal Information to:

• Provide the Services, including creating and administering accounts, hosting dealrooms and investor portals, facilitating subscriptions and distributions, generating documents and reports, and providing support.
• Verify identity and comply with law, including KYC, KYB, AML, sanctions and PEP screening, tax reporting and withholding, responding to lawful requests, and maintaining records we are required to keep.
• Process payments, including billing Sponsors for subscriptions, and transmitting investor funds and distributions through our payment providers.
• Secure the Services, including authenticating users, detecting and preventing fraud, abuse, and unauthorized access, and investigating security incidents.
• Communicate with you, including sending transactional emails (account, billing, security, and document notifications), responding to inquiries, and, where you have not opted out, sending information about Homebase features, products, and events.
• Market Homebase to Sponsors, including contacting people who request a demo or subscribe to updates, and measuring Site traffic.
• Improve and develop the Services, including analyzing usage patterns, testing features, and, using de-identified and aggregated data only, developing and improving AI and automation features (see Section 6).
• Display in-product messaging, such as new-feature notices inside the Platform.
• Enforce our Terms of Service and protect the rights, property, and safety of Homebase, our users, and others.
• Complete a corporate transaction, such as a merger, financing, or sale of assets, subject to Section 4.
• Fulfill any other purpose disclosed to you at the time of collection or with your consent.

When we act as a processor for a Sponsor, we use Investor Data only as instructed by the Sponsor and as described in the Terms of Service, except where law requires otherwise. We never use Investor Data for advertising.

4. How We Share Personal Information

We do not sell Personal Information, and we do not share it for cross-context behavioral advertising or targeted advertising. We do not use third-party advertising, retargeting, or visitor identification technologies anywhere in the Services. If that ever changes, we will update this Policy and provide an opt-out before doing so.

We share Personal Information only as described below.

With Sponsors. When you interact with a Sponsor's dealroom or invest in a Sponsor's offering, the Sponsor receives the information you provide and information about your activity in that dealroom (for example, documents viewed and commitments made), as well as your identity verification result. Each Sponsor sees only information related to its own offerings and your participation in them.

With Investors. Sponsors' business contact information and dealroom content are displayed to the Investors the Sponsor invites.

With service providers. We share Personal Information with vendors that process it on our behalf and under contractual restrictions, including:

• cloud hosting and infrastructure (Amazon Web Services);
• identity verification and screening (Persona and sanctions/PEP screening providers);
• subscription billing (Stripe);
• bank connectivity and ACH processing (ZumRails);
• electronic signatures (Dropbox Sign);
• AI model providers used for AI Features (currently Amazon Web Services through Amazon Bedrock; see Section 6);
• email delivery, customer support, CRM (HubSpot), and product analytics (Amplitude); and
• professional advisers such as auditors, lawyers, and security assessors.

A current list of subprocessors that process Investor Data is available at https://homebasecre.com/subprocessors.

With ZumRails when a Sponsor enables ACH. Sponsors that enable ACH acceptance or disbursement enter into a direct agreement with ZumRails and complete ZumRails' KYB process. Information Sponsors provide for that process, and Investor bank and transaction information needed to process ACH transactions in that Sponsor's dealrooms, is shared with ZumRails and governed by ZumRails' privacy policy in addition to this Policy.

With payment providers acting on your behalf. By linking a bank account, you authorize Homebase and ZumRails to access, retrieve, and transmit your account and transaction information from your financial institution to provide the Services. ZumRails' use of your information is governed by its own privacy policy.

With affiliates. We may share Personal Information with our affiliates and subsidiaries, who will use it consistently with this Policy.

For legal, safety, and compliance reasons. We may disclose Personal Information to regulators, law enforcement, courts, or other parties when we believe in good faith that disclosure is required by law or legal process, or is reasonably necessary to comply with KYC/AML obligations, enforce our Terms of Service, detect or prevent fraud or security issues, or protect the rights, property, or safety of Homebase, our users, or the public. This may include contributing identity verification results to databases used to validate identity for AML purposes.

In a corporate transaction. If Homebase is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, Personal Information may be transferred as part of that transaction. We will notify you by email or prominent notice before your Personal Information becomes subject to a materially different privacy policy.

With your consent or at your direction, including when you connect the Services to a third-party application or AI assistant through our API or MCP interfaces. Information you expose through such connections is governed by that third party's terms and privacy practices.

Aggregated and de-identified data. We may share aggregated or de-identified data that cannot reasonably be used to identify you, for example platform usage benchmarks. We commit to maintaining such data in de-identified form and not attempting to re-identify it.

5. Cookies and Tracking Technologies

We and our service providers use cookies, scripts, local storage, and similar technologies. What runs depends on where you are.

In the Platform (app.homebasecre.com and Sponsor-branded portals):

• Strictly necessary cookies keep you logged in, remember your preferences, secure your session, and enable core functionality. These cannot be disabled without affecting the Services.
• First-party product analytics. We use Amplitude, configured as our service provider, to understand how features are used and diagnose errors.
• Customer support and messaging. Our CRM and support tool (HubSpot) may set cookies to provide in-app support and to associate your support requests with your account. It is configured as our service provider and is not used for advertising.
• No session replay. We do not use session replay or screen-recording technology in the Platform.
• No advertising, retargeting, or visitor identification technologies run in the Platform.

On the Site (homebasecre.com marketing pages):

• Strictly necessary cookies as above.
• Analytics cookies. We use Google Analytics 4 and Google Tag Manager, configured as our service providers with advertising features disabled, to measure Site traffic. You can opt out of Google Analytics using the Google Analytics Opt-Out browser add-on at https://tools.google.com/dlpage/gaoptout.
• First-party analytics. We record page views and interactions on our own Site using our own infrastructure. This information is not disclosed to advertising platforms.
• We do not use third-party advertising, retargeting, or visitor identification technologies on the Site.

Your controls. You can control cookies through your browser settings and the Google Analytics opt-out above. Blocking necessary cookies will prevent parts of the Services from working. We also recognize Global Privacy Control signals as described in Section 17.

6. Artificial Intelligence and Automated Processing

AI Features. Certain features of the Platform use machine learning and large language models to process documents (for example, extracting terms from offering documents), generate summaries and drafts, classify information, and automate workflows. To provide these features, we send the relevant content to AI model providers acting as our service providers. We currently access models through Amazon Bedrock, a service of Amazon Web Services; the model providers we use are listed on our subprocessor page. These providers are contractually prohibited from using your content to train their models and from retaining it beyond what is needed to return a result.

No training on identifiable data. Homebase does not train AI models on Personal Information, Sponsor Data, or Investor Data in identifiable form. We may use de-identified and aggregated data to evaluate and improve AI Features.

Human review. AI output is presented to Sponsors for review. Sponsors are responsible for reviewing AI output before relying on it.

Automated decisions. Identity verification and sanctions screening use automated systems to compare the information you provide against your ID and against screening lists. A verification failure or screening match does not by itself result in a final adverse decision; it triggers review by Homebase or the Sponsor, and you may contact us to contest a result or provide additional documentation. We do not otherwise make decisions producing legal or similarly significant effects about you solely by automated means.

7. How We Protect Personal Information

We maintain an information security program with administrative, technical, and physical safeguards designed to protect Personal Information, including encryption in transit and at rest, role-based access controls, logging and monitoring, and incident response procedures. Sponsors may request information about our security program, including any third-party assessment reports when available, under the confidentiality terms of the Terms of Service.

No system is completely secure. You are responsible for keeping your credentials confidential, enabling multi-factor authentication where available, and signing out after using the Services. If you believe your account or information has been compromised, contact us immediately at info@homebasecre.com.

8. Data Retention

We retain Personal Information for as long as necessary to provide the Services, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. In general:

• Account and transaction records are retained while your account is active and for as long as needed thereafter to support the Sponsor's and Homebase's record-keeping obligations.
• KYC, KYB, AML, and sanctions screening records (including identity verification results and dates) are retained for at least five (5) years after account closure or the end of the relationship, or longer if required by applicable law.
• Electronic signature records and executed documents are retained for as long as the Sponsor's dealroom is active and thereafter as described in the Terms of Service, and Investors may download their own copies at any time.
• Billing records are retained as required by tax and accounting law, generally seven (7) years.
• Site visitor and marketing information is retained until you unsubscribe or for a reasonable period after your last interaction with us.

When you close your account, we delete or anonymize Personal Information for which we are the controller within sixty (60) days, except information we need to retain for the purposes above, which we securely isolate until the retention need ends. Sponsor Data is exported and deleted on the schedule described in the Terms of Service (30-day retrieval period, then deletion within 60 days, subject to legal retention requirements). Data in routine backups is overwritten in the ordinary course.

9. Your Choices and Rights

Access, correction, deletion, and portability. You may request access to, correction of, or deletion of your Personal Information, or a copy in a portable, machine-readable format, by emailing info@homebasecre.com or through the privacy request form at https://homebasecre.com/privacy-request. You can also update much of your information directly in your account settings. If your request concerns information held in a Sponsor's dealroom, we will forward it to the Sponsor and assist the Sponsor in responding.

Verification. To protect your information, we will verify your identity before acting on an access, correction, or deletion request, typically by confirming control of the email address associated with your account and, for sensitive requests, by asking for additional information. An authorized agent may submit a request on your behalf with written authorization that we can verify.

Limits. We may decline or limit a request where we are required to retain information by law (for example, KYC/AML records), where the information is necessary to complete a transaction you requested or to defend legal claims, or where the request is manifestly unfounded or excessive. We will explain the basis for any denial.

Marketing communications. You may opt out of marketing emails using the unsubscribe link in any message or by contacting us. You will continue to receive transactional and legally required communications, such as billing, security, document, and legal-notice emails.

Sponsor communications. Emails sent by Sponsors through the Platform include an unsubscribe link for the Sponsor's marketing messages. Transactional notices related to your investments (for example, capital calls, distributions, and K-1 availability) will continue.

Account closure. You may close your account by emailing info@homebasecre.com or through account settings where available. Closing an Investor account does not cancel investments you have made; contact the Sponsor regarding your investment.

Non-discrimination. We will not discriminate against you for exercising your privacy rights.

10. Additional Information for U.S. State Residents

This Section applies to residents of California and other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia, among others). It supplements the rest of this Policy. Certain financial information collected in connection with securities transactions may be subject to the Gramm-Leach-Bliley Act or other financial privacy laws and exempt from some state privacy laws; where an exemption applies, we will still honor your requests to the extent feasible and lawful.

Categories of Personal Information collected. In the preceding twelve months, we have collected the following categories of Personal Information (as those categories are described in the California Consumer Privacy Act): identifiers (name, email, address, IP address, government ID number, online identifiers and cookie IDs); customer records (bank account, signature, financial information); characteristics of protected classifications (date of birth, citizenship, where collected for compliance); commercial information (investments, transactions, subscriptions); internet or network activity (Site and Platform usage data, logs); geolocation data (approximate, from IP address); professional or employment information; audio or visual information (ID and selfie images processed by our verification provider); inferences drawn from the above for fraud and risk purposes; and sensitive Personal Information (social security number, government ID, account credentials, financial account information, and biometric information processed for identity verification).

Sources. We collect this information from you, from Sponsors, automatically through your use of the Services, and from the third parties described in Section 2.3.

Purposes. We use each category for the business and commercial purposes described in Section 3.

Disclosures for business purposes. We disclose each category to the categories of service providers and other recipients described in Section 4.

Sale and sharing. We do not sell Personal Information and have not done so in the preceding twelve months. We do not share Personal Information for cross-context behavioral advertising and have not done so in the preceding twelve months. We do not knowingly sell or share the Personal Information of anyone under 16.

Right to opt out. Because we do not sell or share Personal Information or engage in targeted advertising or profiling that produces legal or similarly significant effects, there is currently nothing to opt out of. If that changes, we will update this Policy and provide an opt-out mechanism before beginning.

Sensitive Personal Information. We use sensitive Personal Information only for the purposes permitted by law without a right to limit, including providing the Services you request, verifying identity, preventing fraud, ensuring security, and complying with legal obligations. We do not use it to infer characteristics about you and do not sell or share it.

Your rights. Depending on your state, you have the right to (a) know what Personal Information we collect, use, and disclose about you; (b) access it and obtain a portable copy; (c) correct inaccurate information; (d) delete it, subject to exceptions; (e) opt out of sales, sharing for targeted advertising, and certain profiling (we do not engage in these activities); (f) not be discriminated against for exercising your rights; and (g) appeal a denial of your request. To exercise these rights, use the methods in Section 9. If we deny your request and your state provides a right of appeal, you may appeal by replying to our decision email with "Appeal" in the subject line; we will respond within the period required by your state's law. If your appeal is denied, you may contact your state attorney general.

California "Shine the Light." California residents may request information about disclosures of Personal Information to third parties for their own direct marketing purposes. We do not make such disclosures.

Notice at collection. This Policy serves as our notice at collection for California residents. We retain each category of Personal Information for the periods described in Section 8.

Financial incentives. We do not offer financial incentives in exchange for Personal Information.

Request metrics. We publish metrics on privacy requests received in the prior calendar year at https://homebasecre.com/privacy-request when required by law.

11. Biometric Information

To verify your identity, our verification provider (Persona) may compare a live selfie with the photo on your government-issued ID. This process may involve creating and comparing facial geometry data, which is a biometric identifier under some laws (including the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act).

What we do. Homebase does not itself capture, store, or possess biometric identifiers. Persona performs the comparison and returns a result and a verification token to Homebase. Persona's retention and destruction of biometric data is governed by Persona's privacy policy at https://withpersona.com/legal/privacy-policy and its agreement with Homebase, under which biometric data is retained no longer than necessary to complete verification and is permanently destroyed within the period required by applicable biometric law (for example, no later than three years after your last interaction under Illinois law, and within a reasonable time not exceeding one year after the verification purpose expires under Texas law), whichever is shortest. Homebase does not sell, lease, or trade biometric information and does not use it for any purpose other than identity verification.

Consent. Before biometric verification begins, you will be asked to consent. If you do not wish to provide biometric information, contact us at info@homebasecre.com and we will offer an alternative verification method where available, which may take longer.

12. Users in Canada

Homebase offers the Services to Sponsors and Investors in Canada. For Investors, the Sponsor is generally the organization responsible for your Personal Information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, and Homebase acts as its service provider. For account, verification, and compliance information, Homebase is responsible.

We collect, use, and disclose Personal Information with your consent or as otherwise permitted by law, for the purposes described in this Policy. Your Personal Information is stored and processed in the United States and may be accessed by U.S. authorities under U.S. law. You may withdraw consent, subject to legal and contractual restrictions, and may request access to or correction of your Personal Information, by contacting us. Identity verification for Canadian users may be conducted with reference to FINTRAC requirements. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial commissioner.

13. Users in Mexico

Homebase offers the Services to Investors in Mexico for Reg S and other applicable offerings. This Section serves as a summary privacy notice (aviso de privacidad) under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, as in force from time to time. The full privacy notice is this Policy.

Responsible party. HomebaseDAO, Inc., 5529 N McColl Rd, McAllen, Texas 78504, USA, is the responsible party for account, verification, and compliance information; the Sponsor is the responsible party for information collected in its dealroom.

Purposes. Primary purposes are providing the Services, identity verification, and legal compliance. Secondary purposes are improving the Services and sending you information about Homebase. You may object to secondary purposes by contacting us.

Sensitive and financial data. We process financial and asset data and, for identity verification, biometric data. By providing this information you expressly consent to its processing for the purposes stated.

ARCO rights. You may exercise your rights of access, rectification, cancellation, and opposition (ARCO), revoke consent, or limit use or disclosure by emailing info@homebasecre.com with your name, a copy of an identification document, a clear description of your request, and any documents supporting it. We will respond within twenty (20) business days.

Transfers. Your Personal Information is transferred to and processed in the United States by Homebase and the service providers described in Section 4. Transfers to service providers acting on our behalf do not require your consent under Mexican law; by using the Services you consent to any other transfers described in this Policy.

Identity verification for Mexican users may be conducted with reference to CNBV requirements.

14. Users Outside the United States, Canada, and Mexico

Homebase is based in the United States, and the Services are controlled and operated from the United States. Investors located elsewhere may access Reg S offerings only. Your Personal Information will be transferred to, stored, and processed in the United States and in any other country where we or our service providers operate, which may have data protection laws different from those of your country. By using the Services, you acknowledge this transfer. Where required by applicable law, we rely on appropriate safeguards such as standard contractual clauses for transfers to our service providers.

15. Children's Privacy

The Services are intended for adults. We do not knowingly collect Personal Information from anyone under 18. If you believe a child has provided us with Personal Information, contact us at info@homebasecre.com and we will delete it.

16. Third-Party Links and Services

The Services may link to third-party websites and services, including Sponsors' own websites and the sites of our payment and verification providers. We do not control and are not responsible for their content or privacy practices. Review their privacy policies before providing information.

17. Global Privacy Control and Do Not Track

Global Privacy Control. We do not sell or share Personal Information, so there is currently no sale or sharing for a Global Privacy Control (GPC) signal to opt you out of. Our Site nonetheless recognizes GPC signals, and if we ever begin sharing Personal Information for cross-context behavioral advertising, we will treat a GPC signal as a valid opt-out request for that browser.

Do Not Track. We do not respond to browser "Do Not Track" signals, for which there is no accepted standard. Use GPC or the Site footer links instead.

18. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new "Last Updated" date. If we make material changes, we will notify you by email to the address on your account or by a prominent notice on the Services at least thirty (30) days before the changes take effect, and, where required by law, will obtain your consent. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

19. Contact Us

Questions, requests, or complaints regarding this Policy or our privacy practices:

• Email: info@homebasecre.com
• Privacy request form: https://homebasecre.com/privacy-request
• Mail: HomebaseDAO, Inc., Attn: Privacy, 5529 N McColl Rd, McAllen, Texas 78504, USA

If you have an unresolved privacy concern that we have not addressed satisfactorily, you may contact your state attorney general or applicable privacy regulator.