Privacy Policy

This Privacy Policy explains how Buildra ("we," "us," or "our") collects, uses, shares, and protects information about you when you use our website, applications, and related services (the "Service"). By using the Service you agree to the practices described in this Policy.

We collect the following categories of information:

• Account information: name, email address, password (hashed), profile photo, and TOTP/2FA settings.
• Project data: plans, drawings, photos, decisions, RFIs, daily logs, change orders, and any other content you upload or generate inside the Service.
• Usage analytics: page views, feature interactions, and high-level performance telemetry to help us improve the product.
• Device and connection data: IP address, browser type, operating system, and approximate IP-based geolocation (city/region) for security and fraud detection.

We use information to:

• Provide, operate, and improve the Service.
• Personalize your experience (e.g. surfacing relevant decisions, photos, and AI suggestions on your projects).
• Send transactional and product communications (you can opt out of marketing emails at any time).
• Detect, investigate, and prevent abuse or fraud.
• Comply with legal obligations.

We share data only with service providers who help us run the Service, all of whom are bound by confidentiality and data- processing agreements:

• OpenAI and Anthropic— large-language-model providers used to power AI features (Q&A, summaries, conflict detection, etc.).
• Pinecone — vector database used to store embeddings for retrieval-augmented generation.
• Cloudflare R2 — object storage for plans, photos, and other uploaded files.
• Stripe — processes subscription payments; card data is handled by Stripe and never stored on our servers.
• Resend (where applicable) — transactional email delivery.

We do not sell personal information. We may disclose data when required by law, to enforce our Terms, or to protect the rights, property, or safety of users or the public.

For deliverability monitoring and to support audit-friendly workflows, we log email metadata for messages we send or process on your behalf. Specifically, we keep recipient address, subject line, delivery status, and timestamps for up to 90 days, after which the metadata is deleted. We do not store the body content of emails routed through this system.

When you start a paid Buildra subscription, the following billing-related data is collected and processed:

• Card and bank details are collected and stored by Stripe(PCI-DSS Level 1 compliant) — never on Buildra's servers. We store only a Stripe customer/subscription id reference.
• Billing email for receipts, renewal notices, and price-change disclosures.
• Invoice and payment history(amounts, dates, status, refund records) — retained for seven (7) years for tax and accounting compliance, in line with IRS recordkeeping guidance.
• Cancellation feedback(the reason you choose and any optional comments) — retained indefinitely in aggregated form to help us improve. You can request redaction of personally-identifying free-text comments at any time.
• Subscription event log(created, renewed, upgraded, canceled, refunded, etc.) — retained for seven (7) years.

We do not share billing data with third parties except Stripe (the processor) and our tax/accounting providers under confidentiality. We do not use billing data for advertising.

We retain account and project data for as long as your account is active. After account or subscription cancellation, your project data is held for 90 days in case you reactivate, then deleted or anonymized. Backups are purged on a rolling schedule and are typically gone within 35 days.

Specific retention exceptions:

• Billing records (invoices, payments, subscription events): 7 years (tax / accounting compliance).
• Email metadata (recipient, subject, status, timestamps): 90 days.
• Audit logs of admin actions: 2 years.
• Cancellation feedback: indefinite, in aggregated form. Free-text comments can be redacted on request.

Where you have a deletion right under applicable law (e.g. EU GDPR Article 17, California CCPA), we honor it within the statutory timeframes — though we may retain narrow categories of data where law requires (e.g. tax records).

Depending on your location (including the EEA, UK, and California), you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Export your data in a portable format.
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us via the in-app support page.

We use first-party cookies for authentication sessions (essential cookies that cannot be disabled without breaking login) and a small number of analytics cookies to understand aggregate usage. We do not use third-party advertising cookies.

The Service is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.

Buildra is operated from the United States. If you access the Service from outside the U.S., you understand that your data will be transferred to and processed in the U.S. and other countries where our service providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, notify you via email or an in-app banner. Continued use of the Service after changes take effect constitutes your acceptance of the updated Policy.

For privacy-related questions, contact us via the in-app support page or email privacy@buildra.app.