Privacy Policy

For the personal data of the people who use Buildly - you, and your team - the controller is Buildly, Inc., 548 Market St, Suite 41, San Francisco, CA 94104.

For the personal data of visitors to a site you build with Buildly - for example a contact form submission - you, the site owner, are the controller and we are your processor: we handle it on your instructions and under a data processing agreement. A draft is available on request from support@buildly.io.

Privacy contact: support@buildly.io [OWNER: confirm a dedicated privacy address]. Data protection officer: [OWNER: name a DPO, or state that none is required]. Representative in the UK and EU, if required: [OWNER: name and address, or state not required].

Account data - organizations, members, roles, billing, site content - and contact form submissions from visitors to your published site are held in the same database, in the same control-plane schema. They are separated from other organizations by row-level security enforced by the database, which is described below.

Anonymous visit statistics for a site, where a visitor has accepted analytics, are held in our own analytics service, separately from that database.

What you give us: your name, email, business details, and anything you upload or type into the builder.

What you say: if you use voice, the audio and its transcript while the interview runs, and the transcript afterwards.

What we generate: the content and images produced from your brief, plus a record of how many sparks each generation spent.

What your browser sends us: your IP address and request details, which appear in our server logs, and the sign-in cookies described in the Cookie Policy.

To provide the service you signed up for - creating your account, building and publishing your site, billing you - we rely on performing our contract with you.

To keep the platform secure, prevent abuse, investigate faults and keep logs, we rely on our legitimate interest in running a safe service.

For analytics on a site you built, and for browser notifications, we rely on the visitor’s or your consent, which can be withdrawn at any time.

To keep financial records, we rely on our legal obligations.

[OWNER: confirm these lawful bases with counsel before publishing.]

A published site captures contact form submissions, which are delivered to the addresses you choose and stored so a lead is never lost. We do not store the visitor’s IP address or device with a submission.

If analytics is set up for the site, a visitor sees a choice before anything is counted. Only if they accept does the analytics service record which pages they view, where they came from, their rough region, device and browser, and how fast pages load. Refusing, ignoring the choice, or sending a Global Privacy Control signal means none of that is collected. See the Cookie Policy.

If you connect analytics or advertising tools of your own, those tools collect data under their own terms - and you are responsible for consent for them.

One organization cannot read another organization’s data. That is enforced by the database itself through row-level security, not only by application code, so a mistake in our code still cannot expose your rows. We test it by issuing unscoped queries against seeded data.

We use third parties to run the service. The full, current list, with what each receives and where, is on the subprocessor page at /legal/subprocessors. In short:

OpenRouter: The AI gateway that writes site copy and answers the builder chat. It routes each request on to a model provider.

Z.ai (Zhipu AI): A model provider used directly for AI copy and for image generation.

Google (Gemini and Gemini Live): A model provider used directly for AI copy, and the live voice interview, where your microphone audio is streamed for transcription and replies.

Google (sign-in): Lets you sign in with your Google account instead of typing a password. Buildly sends your browser to Google, then exchanges the one-time code Google returns for a signed statement of who you are.

Serper: Web search used to look up your business when the builder researches it.

Public search engines, through Buildly’s own search service: Buildly’s own search service (SearXNG, self-hosted) asks public search engines - Bing, DuckDuckGo, Brave, Startpage, Mojeek, Qwant and Wikipedia - to look up your business when the builder researches it. Each engine receives the search query from Buildly’s server, not from you.

Stripe: Takes payment for plans and Spark packs, and manages subscriptions.

Cloudflare: Sits in front of the default site addresses as a CDN, clears cached pages when a site is published, and gates access to the staff console.

Email delivery (Resend, SendGrid, Plunk, MailBaby or an SMTP relay): Sends the platform’s transactional email: verification, password reset, invitations, lead notifications and receipts.

GitHub: Hosts the template repositories and carries each template release into the platform as a reviewed pull request.

Have I Been Pwned (Pwned Passwords range service): Checks, when you choose a password, whether it appears in a public list of leaked passwords, so a leaked one is refused.

Google Analytics and Google Tag Manager: Measure visits to a site, and load the owner’s own marketing tags, when the site’s owner has saved a Google ID for it. The visitor’s browser fetches Google’s script; the platform sends Google nothing.

Browser push services: Deliver the browser notifications you opt in to. The push service belongs to your browser’s maker, not to Buildly.

Some of these can receive the text you type into the builder and, for the live voice interview, your voice. Which AI provider handles a request is decided by how the platform is configured: where we hold a key for a provider directly, that provider is tried before the gateway. We do not currently set no-training or zero-retention options with these providers, and we do not yet have a transfer safeguard on file for each (to be confirmed by the owner).

Where you connect your own provider - your email sender, for example - that provider is your own processor, your credentials are encrypted before storage and they are used only for the integration you connected them for.

A small number of Buildly staff roles can open an organization in the staff console and read what you gave the builder - the business brief and the interview transcript - and your site drafts, in order to give support and keep the service running.

We do not currently offer consent-based, time-limited access to your site, and we do not yet promise a log of every staff view that you can read. Staff cannot read your password, and stored integration keys are masked.

Application logs, which contain IP addresses and request details, are kept searchable for 30 days and then in a compressed archive for 180 days by default, after which they are deleted.

Account data and site content are kept while your account exists, and are deleted when you delete your account or the Owner deletes the organization. Contact form submissions (leads) are kept for 12 months by default, or for the period the site’s owner chooses, and 0 means until they delete them; the owner decides what is done with them and can delete, export or erase them at any time. The words of an interview, and the answers, are removed 90 days after the interview is finished. The text of a support request is removed 730 days after the request closes. Dashboard notifications are kept 180 days, email delivery records 90 days, the address and device of your sign-ins 90 days, and push notification registrations one year.

Abuse reports, and the reporter’s details, are deleted 12 months after a report is closed (or 12 months after it was filed if it is never closed).

Payment records are held by Stripe under its own retention rules.

API keys and OAuth tokens are encrypted at rest. Keys you enter are masked once saved and never shown again. Our logs redact known secret fields by name, and we try to keep secrets out of error messages, but we cannot promise that no secret value can ever appear in a log.

Under the UK and EU GDPR you have the right to be informed, to access your personal data, to have it corrected, to have it erased, to restrict or object to our processing, to receive it in a portable format, and to withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. We make none: content is generated by AI but you review and publish it, and moderation decisions are made by people.

You can download a copy of your data and erase your account yourself from your account menu, under Your data. Erasing removes your name, email address, picture, sign-in records, devices, assistant memories and conversations and the text of your support requests; an organization you are the only Owner of must be handed over or deleted first. For anything else, or if you cannot sign in, email support@buildly.io. We will reply within one month.

You have the right to complain to your data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in your country. We would like the chance to put things right first.

Disconnecting an integration removes the record of it from the platform.

Some of the subprocessors above may process data outside the UK and the European Economic Area. Where they do, we intend to rely on the safeguards the law provides, such as the standard contractual clauses or the UK addendum. [OWNER: record the safeguard for each provider on the subprocessor page before publishing.]

Categories of personal information we collect, as the California Consumer Privacy Act (as amended by the CPRA) names them: identifiers (name, email, IP address); commercial information (your plan and purchases); internet activity (server logs, and site analytics only where a visitor accepted); audio data (your voice during the live interview, if you use it); professional information (your business details); and content you provide. We collect it from you, from your browser, and from your visitors on your behalf.

We use it to provide and secure the service, as described above. We do not sell your personal information and we do not share it for cross-context behavioral advertising, and we have no advertising partners. For that reason there is nothing to opt out of, and no "Do Not Sell or Share" link.

On a site we serve where analytics is set up, we treat a Global Privacy Control signal from your browser as a refusal: analytics does not load.

You can ask us to tell you what we hold, to delete it, to correct it, and to limit use of sensitive information, and we will not treat you differently for asking. Email support@buildly.io. We will verify it is you and reply within 45 days. You can appeal a refusal by replying to our answer.

These rights apply to what we hold as the controller. A visitor to a site built with Buildly should ask the site owner, who decides what is done with their data; we will help the owner respond.

If you report an abusive website through our form, we keep your report, any email, business name and link you give us, and what we decide, so that we can act on it and show we did. Reports are read by our staff only and are sent through our email provider. Please do not include more personal information than is needed. Contact abuse@buildly.io or support@buildly.io to ask what we hold about you or to have it removed. See "How long we keep it" for retention.

This is version 2026-10-20-draft-2. When it changes in a way that matters we will change the version and tell account holders. These pages are drafts and have not yet been reviewed by a lawyer.