Privacy Policy

• Account — your name, email address and a securely hashed password.
• Projects & content — the prompts you write, the code and files Buildy generates, your chat messages, and project settings (including any backend keys you choose to store, such as a Supabase anon key).
• Billing — handled by Paddle, our reseller and Merchant of Record. We store your plan, subscription status and Paddle customer/subscription identifiers, but we never see or store your full card number — Paddle processes payment under its own privacy policy.
• Technical — log data, IP address, timestamps and basic usage metrics, used for security and reliability.

We use your data to:

• provide and operate the Service, including generating code with AI;
• authenticate you and keep your account secure;
• process payments and manage subscriptions;
• enforce plan quotas and prevent abuse;
• provide support and send essential service emails (e.g. password reset).

Our legal bases under the GDPR, mapped to each purpose:

• Performance of our contract — providing the Service, your account, authentication and billing.
• Legitimate interests — keeping the Service secure and preventing abuse. You can object to this processing.
• Consent — analytics cookies only; you can withdraw consent at any time via Cookie settings in the footer.
• Legal obligation — keeping invoicing and tax records as required by Spanish law.

We do not use your prompts or generated code to train AI models.

To generate code, the prompts you submit and the relevant parts of your project are sent to our AI provider, Anthropic, which processes them to return a result. Please review Anthropic's privacy policy for details of how they handle data submitted through their API. We send only what is needed to fulfil your request.

Some features send your data to third parties at your direction. If you connect GitHub, your project code is pushed to a repository (and managed one-click builds run on GitHub Actions). If you connect Supabase, the app talks to your own Supabase project using your keys. These services process that data under their own terms.

We don't sell your data. We share it only with the service providers we need to run Buildy:

Several of our providers process data outside the European Economic Area — Anthropic, Google, GitHub (Microsoft) and Expo/EAS (mainly in the United States), and Paddle (our payments Merchant of Record, in the United Kingdom). Where a provider is certified under the EU–US Data Privacy Framework, transfers to it rely on that adequacy mechanism; transfers to the UK rely on the UK adequacy decision. Otherwise they rely on the European Commission's Standard Contractual Clauses together with appropriate supplementary measures.

How long we keep data:

• Account & project data — while your account is active; deleted or anonymized within a short period after you delete a project or close your account.
• Billing & invoice records — retained for the period required by Spanish tax and commercial law (generally 4–6 years).
• Technical logs — kept for a short period (up to about 12 months) for security and reliability.

If you are in the EEA or UK, you have the right to access, correct, delete, restrict or port your data, to object to certain processing, and to withdraw consent. To exercise any of these, email hello@buildy.me; we respond within one month (GDPR art. 12). You can also lodge a complaint with your data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD, aepd.es).

We keep cookies to a minimum and set no advertising or cross-site tracking cookies. Analytics cookies are set only if you accept, and you can change or withdraw your choice at any time via Cookie settings in the footer (which also clears the analytics cookies).

Data is encrypted in transit over HTTPS, passwords are stored hashed, and access is restricted. No system is perfectly secure, but we take reasonable measures to protect your data.

Buildy sets a minimum age of 16 to use the Service (an eligibility rule; Spain's age of digital consent is 14). It is not directed to children under 16, and we do not knowingly collect their personal data.

We may update this policy. We will post the new version with an updated date and, for material changes, take reasonable steps to notify you.

Email hello@buildy.me with any privacy questions.