Subprocessors

This list is generated from the same registry the platform’s own checks use: a build fails if the code talks to a service that is not on it. A field that says "To be confirmed by the owner" is a fact we have not yet confirmed in writing with the vendor, and we would rather say so than guess.

We will add a vendor here before we start sending it personal data, and change the version of the Privacy Policy when we do. [OWNER: choose and state how customers are notified of changes, and how long they have to object.]

This page is a draft for legal review. A draft Data Processing Agreement for customers who use Buildly as their processor is available from support@buildly.io.

The AI gateway that writes site copy and answers the builder chat. It routes each request on to a model provider.

Personal data it can receive: Business details and answers you give the builder, including voice transcripts; Text on your pages that is sent for rewriting; Text from the knowledge base used to answer questions.

When it is used: The default path for AI copy. Which model provider behind it handles a request is chosen by the gateway; the platform does not currently set no-training or zero-retention routing.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

A model provider used directly for AI copy and for image generation.

Personal data it can receive: Business details and answers you give the builder; Text sent for rewriting, and image prompts.

When it is used: Used only when the operator has set a Z.ai key. Today that is the whole switch: with a key present it is asked before the gateway for the models it serves.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

A model provider used directly for AI copy, and the live voice interview, where your microphone audio is streamed for transcription and replies.

Personal data it can receive: Business details and answers you give the builder; Voice audio from the live interview, while it is running.

When it is used: Used only when the operator has set a Gemini key. As with Z.ai, the key alone puts it ahead of the gateway for the models it serves; the live voice interview uses it whenever voice is enabled.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Web search used to look up your business when the builder researches it.

Personal data it can receive: Search queries containing your business name and location.

When it is used: Used only when the operator has set a Serper key.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Buildly’s own search service (SearXNG, self-hosted) asks public search engines - Bing, DuckDuckGo, Brave, Startpage, Mojeek, Qwant and Wikipedia - to look up your business when the builder researches it. Each engine receives the search query from Buildly’s server, not from you.

Personal data it can receive: Search queries containing your business name and location.

When it is used: Used when the operator has deployed the search service and set SEARXNG_URL.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Takes payment for plans and Spark packs, and manages subscriptions.

Personal data it can receive: Your name and email address; Billing and payment details, which are entered on Stripe and not held by Buildly; The organization and plan the payment is for.

When it is used: Used when billing is configured.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Sits in front of the default site addresses as a CDN, clears cached pages when a site is published, and gates access to the staff console.

Personal data it can receive: The IP address and request details of every visitor to a site served through it; The page addresses whose cache is cleared; Staff sign-in identity for the console.

When it is used: Used for the cache-clearing API only when a Cloudflare token is configured.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Sends the platform’s transactional email: verification, password reset, invitations, lead notifications and receipts.

Personal data it can receive: Recipient name and email address; The content of the message, which can include a visitor’s form submission when you ask for lead notifications.

When it is used: One provider is configured at a time by the operator; the adapters for all five exist. A provider you connect yourself is your own processor, not Buildly’s.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Hosts the template repositories and carries each template release into the platform as a reviewed pull request.

Personal data it can receive: Template source code and release metadata; No visitor data, and no customer content.

When it is used: Used by staff-run template release tooling only.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Checks, when you choose a password, whether it appears in a public list of leaked passwords, so a leaked one is refused.

Personal data it can receive: The first five characters of a one-way hash of the password you choose - not the password, not your address and not your account.

When it is used: Each time a password is chosen at signup or reset. If the service cannot be reached the password is accepted.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Measure visits to a site, and load the owner’s own marketing tags, when the site’s owner has saved a Google ID for it. The visitor’s browser fetches Google’s script; the platform sends Google nothing.

Personal data it can receive: What a visitor’s browser sends any script host: IP address, browser details and the page visited; Whatever the owner’s own Google account and Tag Manager container collect, which the owner controls.

When it is used: Only on a site whose owner saved a Google Analytics or Tag Manager ID, and only after that site’s visitor agrees in the cookie banner. A Google account the owner connects is the owner’s own processor, not Buildly’s.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

Deliver the browser notifications you opt in to. The push service belongs to your browser’s maker, not to Buildly.

Personal data it can receive: A push address your browser created for you; A generic notification payload with no personal detail in it.

When it is used: Only after you allow notifications in a particular browser.

Where it processes data: To be confirmed by the owner. Transfer safeguard: To be confirmed by the owner. Data Processing Agreement: To be confirmed by the owner.

These are our own software on our own servers, not separate companies, but personal data reaches them:

Server hosting provider (To be confirmed by the owner): Runs the servers, database and storage the platform is deployed on.

Site icon lookup: Fetches the public favicon of a business website the owner named, to show beside it in the interview. No personal data is sent.

Integration re-check: Fetches the public page of a business website the owner published, as any visitor would, to see that a saved analytics or verification ID is on it. No personal data is sent.

Supabase GoTrue (self-hosted): Holds sign-in credentials, sessions and two-factor enrolment.

Umami (self-hosted): Website analytics for sites whose visitors have accepted it.

Cap captcha (self-hosted): Checks that a contact form, and Buildly’s own sign-up and abuse-report forms, were submitted by a person.

Object storage (SeaweedFS, S3-compatible, self-hosted): Holds uploaded photographs and archived logs.

Loki log store (self-hosted): Holds application logs.

Healthchecks (self-hosted): Monitors that scheduled jobs and site uptime checks ran.

The platform’s own services: Calls between the app, worker and gateway, and fetches of public site pages.

The company that hosts those servers is itself a subprocessor and is not named here yet; naming it is on the owner’s list.

Higgsfield: The planned image service for enhancing uploaded photographs. Not connected: there is no adapter for it yet, so nothing is sent today. It is listed so that the list is complete the day it is switched on, and will be moved to the active list in the same change.