ArbiBase, LLC ("ArbiBase", "we", "us") runs arbibase.com and the ArbiBase app at app.arbibase.com. ArbiBase is a marketplace for rental arbitrage: we find rental properties whose owners agree to short- and mid-term rental use, check them, and offer them to operators who pay to unlock the details. We also run a concierge sourcing service, an owner listing program, and partner programs for referral partners and supply partners.
This policy covers personal information about operators and other customers, visitors to our websites, people who fill in our forms, job applicants, our partners, and property owners and landlords we contact who don't have an account with us (section 13). It is effective October 12, 2026.
When a business customer puts other people's personal information into ArbiBase (for example a team member's details or a lease document), our Data Processing Addendum also applies.
Your account
You create an account after paying for a plan. Stripe tells us the payment went through, and we email you an activation link. When you finish setting up, we collect your name, email address, phone number, company, strategy, the number of units you run, your password and your email preferences. You can also turn on an authenticator app for two-step sign-in. If you sign in with Google, we receive your name, email address and Google profile photo. In the app we keep your role and plan, preferred markets, budget, Buy Box settings, saved and unlocked properties, pipeline, and anything you upload, such as leases, documents and a profile photo.
Forms on arbibase.com
Our website forms send what you type to our servers. Each submission is filed in our internal CRM and posted to an internal Slack channel so the right team can follow up.
- Free Greenlight check: the property address, monthly rent, bedrooms and your email. We send the address and bedrooms to our property-data provider (AirROI) to estimate revenue, email you the result, and file the request in our CRM. You join our email list only if you tick the box.
- Operator waitlist: name, email, phone, units managed, timeline, budget per unit, markets, how you heard about us, and your agreement to our terms.
- Concierge request and checkout: name, email, phone, business entity, target markets, bedrooms, rental model, rent ceiling, target return, furnishing, start date, notes and search type. Your browser keeps a copy of the brief so it survives the trip to Stripe Checkout (see the Cookie Policy).
- Landlord property submission and owner consent: whether you're the owner or an agent, company, name, email, phone, property address, listing link, bedrooms, bathrooms, square footage, furnishing, rent, HOA, move-in costs, utilities and amenities. The consent form also records your drawn signature and the date, and we email you a PDF copy of what you signed.
- Supply partner application: name, email, phone, company, role, markets, expected volume, how you'd use ArbiBase, and a real estate license number if you give one.
- Referral partner (affiliate and coach) application: name, brand, email, phone, audience or student count, the sourcing support you want, interests and notes.
- Reviews: name, email, role, rating, headline, review text, company, market, and how you want your name shown. We publish a review only if you agree to publication on the form.
- Newsletter and email sign-ups: your email address, the page you signed up on and, sometimes, a market. This includes the blog sign-up, deal alerts on the deal board, and "email me this" buttons on the calculator and comparison pages. All of these add you to our newsletter list.
- Careers: name, email, phone, role, location, LinkedIn and portfolio links, your message, your résumé, and any voice or video introduction you record. We use these to consider you for the role and for future roles.
- Pricing checkout: the plan, billing cycle and email address you enter. We record a started checkout as a sales lead even if you don't finish paying.
Payments
Stripe processes every card payment for subscriptions, property unlocks, concierge fees and other services. Stripe collects your card details, and we never receive or store full card numbers. We receive your Stripe customer ID, what you bought, amounts, billing status and invoices. If you agree to it at checkout, Stripe saves your card for later unlocks. Referral partners are paid through Stripe Connect, and Stripe collects their identity, bank and tax details, including a W-9 where one is required.
Using the app and the website
When you use ArbiBase, our systems record your actions in the app: searches, the properties you view, save and unlock, the analyses you run, and the messages you send to in-app assistants. We also record technical data such as your IP address, browser, device type and the pages you request. We use IP addresses to limit abuse (rate limiting). In the app, Sentry records errors and performance data so we can fix problems. Sentry's session replay is turned off. On arbibase.com, Cloudflare Web Analytics counts page views and visits to understand which pages people use. It uses no cookies, doesn't track you across sites and doesn't identify you. We run no advertising tracking on arbibase.com or in the app.
Messages and support
We keep your emails, texts and support chats with us, and support tickets you open, together with our replies.
Calls, recordings and AI transcription
Calls with our team on ArbiBase phone lines go through Twilio or OpenPhone. Our reps tell you at the start of each call that it's being recorded and transcribed. We record both sides of the call, and ElevenLabs converts the recording to a text transcript. Most of these calls are with property owners and landlords, but this also applies to calls with operators and partners. We store recordings and transcripts in our CRM next to the property or account they relate to. Some calls on our support and sales lines may be answered by an AI voice assistant run through Vapi. Those calls are transcribed too, and their transcripts are analyzed with AI to summarize the call and decide next steps.
Information from other sources
- Referral partners: if you followed a partner's link, PromoteBoost passes the partner's referral code to us, and we match it to your account by email so the partner can be credited.
- Public listings: we collect property listing details, such as address, rent, photos and the listing agent or owner's published contact details, from public rental sites, including through Apify. When you ask us to check a listing, we fetch that listing.
- Owner contact lookup: we use BatchData to look up owners' names, phone numbers and mailing addresses from property records (skip tracing).
- Property data: AirROI and similar sources give us rental revenue estimates for a property's address. These estimates don't include personal information about you.
- To run the service: create and secure your account, show you properties, run Greenlight underwriting and lease analysis, deliver unlock packets and concierge matches, and provide support.
- To bill you: process payments, keep invoices and tax records, and credit referral partners.
- To source and verify properties: find properties, contact owners, record owner consent, check revenue against rent and check local rules.
- To communicate: send account, security and billing emails, reply to your forms and messages, and, unless you opt out, send newsletters and deal emails (section 06).
- To improve ArbiBase: fix errors, understand which features get used, and plan new ones.
- To protect people and the service: prevent fraud and abuse, enforce our Terms of Service, and meet legal, tax and accounting obligations.
- To recruit: review job applications.
Several ArbiBase features send your data to AI providers through their business APIs. The data is processed under each provider's API terms. We don't sell your data to them.
- Anthropic (Claude): the lease analyzer (receives the full text of the lease you upload); the operator Copilot (receives your listings, Buy Box, pipeline and saved documents); regulation research; checking listing photos for details that reveal an address; summarizing news; and drafting marketing and social content for our staff.
- xAI (Grok): the in-app chat assistant (receives your messages and a stored summary of your activity); lease analysis and lease chat (receives the lease text); email drafts; market, return and risk analysis; the support chat; reading listing links; negotiation suggestions; analyzing AI voice-call transcripts; and the weekly newsletter text, which is written from overall counts, not your personal data.
- Google (Gemini): images you upload in chat, and market research.
- OpenAI: local rule lookups. Only a city and state are sent.
- ElevenLabs: turning call recordings into transcripts (section 02).
- Vapi: the AI voice assistant on some support and sales calls.
Activity memory. The app keeps a short summary of your activity, written by AI, so the assistant can give answers that fit your situation. Email [email protected] to see it or have it cleared.
AI-written articles. Some articles on our blog are written with AI and published automatically.
AI output can be wrong. Treat AI analysis in ArbiBase as a starting point, not legal, financial or lease advice.
We send account holders and newsletter subscribers marketing email. That includes the weekly newsletter, the deal digest, market updates and blog articles. Every marketing email has a one-click unsubscribe link and our postal address. You can also turn off each type of email in your account settings in the app.
Account, security, billing and transaction emails aren't marketing. They don't have an unsubscribe link, and we keep sending them while you have an account. This includes sign-in codes, receipts, unlock packets and consent confirmations.
If we text you, reply STOP to stop texts from that number. Most of our texts go to property owners about their property (section 13). You can also ask us to stop calling or texting you, either during a call or by emailing [email protected]. We'll mark you as do-not-contact.
We don't run automatic deletion schedules today. Here is what we actually do:
- Account data: kept while your account is active. After you cancel, we keep it until you ask us to delete it, or for as long as we need it for the reasons below.
- Payment and tax records: kept for as long as tax and accounting laws require.
- Form submissions, leads and CRM records (including owner records, call recordings and transcripts): kept while they're useful for the deal, property or relationship they relate to, or until you ask us to delete them.
- Job applications: kept so we can consider you for future roles, unless you ask us to delete yours.
- Newsletter sign-ups: kept until you unsubscribe. After that we keep only enough to make sure we don't email you again.
When you ask us to delete your information, we delete it or remove what identifies you. We keep only what we need to meet legal obligations, resolve disputes, prevent fraud, or honor an opt-out. Copies in our providers' backups expire on their own backup schedules.
Every database table has row-level security rules that limit who can read each record. Public forms and APIs are rate-limited, and forms on arbibase.com use Cloudflare Turnstile to block bots. Tokens for connected accounts, such as staff Gmail, are encrypted, and links in emails and portals are signed and expire. Two-step sign-in with an authenticator app is available, and all traffic uses HTTPS. Stripe holds card data, not us.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires. Our Security page explains how to report a vulnerability.
Whatever state you live in, you can ask us to:
- Access: tell you what personal information we hold about you and give you a copy.
- Export: give you your data in a common, machine-readable file.
- Correct: fix information that's wrong.
- Delete: delete your information and, if you want, your account.
- Opt out: stop marketing emails, texts and calls.
Account deletion and data export aren't self-service in the app yet. Email [email protected] from the address on your account, or include enough detail for us to find your records. We'll check that the request comes from you before we act on it. We respond within 30 days. Where state law gives us longer, for example 45 days under California law, we'll tell you if we need the extra time.
An authorized agent can make a request for you if they show us your written permission. We may still ask you to confirm your identity with us directly. If we turn down your request, we'll explain why. You can appeal by replying to our answer, and we'll respond to the appeal within the time your state's law allows. We won't treat you differently or charge you more for using your rights.
California's privacy law (the CCPA, as amended by the CPRA) and similar laws in other states give residents the rights listed in section 10. They also give the right to opt out of the "sale" or "sharing" of personal information, and of targeted advertising. We don't sell personal information, we don't share it for cross-context behavioral advertising, and we don't use it for targeted advertising. We have not done so in the past 12 months. We don't knowingly sell or share information about anyone under 16.
This table shows the categories of personal information we collected in the past 12 months, where they come from, and who we disclose them to for business purposes:
| Category | Examples | Sources | Disclosed to |
|---|---|---|---|
| Identifiers | Name, email, phone, postal address, account ID, IP address | You; Google sign-in; BatchData; public listings | Hosting, email, phone and payment providers; operators who unlock a property (owner details) |
| Customer records | Signature, billing details, partners' tax and bank details | You; Stripe | Stripe; Supabase; DocuSeal |
| Commercial information | Plan, purchases, unlocks, concierge orders, referral history | You; Stripe; PromoteBoost | Stripe; referral partners (plan and amount paid only) |
| Internet activity | Actions in the app, pages requested, browser and device, errors | Your device | Supabase; AWS; Sentry; Upstash |
| Audio and electronic information | Call recordings and transcripts | Calls with us | Twilio; OpenPhone; ElevenLabs; Vapi; xAI |
| Professional information | Company, role, units managed, license number, job application details | You | Supabase; Slack; Google Workspace |
| Property information linked to a person | Property owned, rent, terms, consent status | Owners; public listings; BatchData | Operators who unlock the property; AI providers for analysis |
| Inferences | The AI activity summary, Buy Box preferences | Our systems | xAI |
| Sensitive personal information | Account password; tax ID for partner payouts | You | Supabase Auth; Stripe |
We don't collect precise geolocation, health, biometric or financial account data beyond what's listed here. We use sensitive personal information only to provide the service and as the law allows, not to infer anything about you. To use your rights, follow section 10.
ArbiBase is for adults. You must be 18 or older to use it. We don't knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, email [email protected] and we'll delete it.
This section is for property owners, landlords and their agents, including people who have never used ArbiBase.
What we collect
- Details from public rental listings: address, rent, photos, and the published contact details of the owner or listing agent.
- Owner names, phone numbers and mailing addresses from property-record data providers (BatchData).
- What you tell us by email, text or phone, and recordings and transcripts of our calls.
- If you list a property with us: the details on the submission or consent form, your signature, and the email address you use to sign in to your owner status page.
How we use it
We contact owners by email, phone and text to ask whether they'd lease to a rental operator. If you sign our owner consent, we offer your property to vetted operators. An operator who unlocks the property receives your name, contact details and the property details you agreed to share, and then contacts you directly. We advertise listed properties without the street address. We also use what we collect to check the property and keep our records accurate.
Calls
Our reps tell you at the start of each call that it's being recorded and transcribed. ElevenLabs creates the transcripts. We keep recordings and transcripts with the property record.
Opting out
Reply STOP to any text, tell the rep during a call, or email [email protected]. We'll mark you as do-not-contact. Consent to list a property is non-binding and you can withdraw it. Email us to have the property taken down. You have the same rights to access, correct and delete your information as everyone else (section 10).
ArbiBase serves the United States, and our main systems are hosted there. Some of our service providers may process data in other countries under their own terms. If you use ArbiBase from outside the United States, your information will be transferred to and processed in the United States.
When we change this policy, we update the effective date at the top and add a line to the revision history below. If a change materially affects how we use your information, we'll email account holders, or tell them in the app, before it takes effect.
Send questions, requests and complaints about privacy to: