Privacy Policy

The short version

We collect what we need to run builderG and nothing for advertising. We do not sell your data. Your builds are private to your account. We use a small number of contracted providers — an AI provider, a database and authentication provider, a payment processor and a hosting provider — and no one else receives your content.

What we collect

• Account details — your email address, handled by our authentication provider. We never see or store your password. If you use builderG without signing up, we create an anonymous guest account so your conversation survives a page refresh; it holds no personal details until you convert it into a real account.
• Your builds — the conversations you have with builderG, the materials lists generated from them, the matched products, cost breakdowns and build guides.
• Photos you upload — if you ask for a before-and-after visual, the photo you provide, and the image generated from it. See Visuals and photos, which contains something important.
• Billing records — if you buy a Build Pass or subscribe, we store your payment processor’s customer reference, your subscription status and dates, and records of passes bought and used. We never receive or store your card details; those go directly to our payment processor.
• Tradesperson listings — if you list your business, the details you enter. See Tradesperson listings, which are public by design.
• Usage records — which operations you ran and their computational cost, so we can keep the service running sustainably and spot abuse.
• Support messages — anything you send us, plus the technical diagnostics you explicitly opt into when reporting an issue.

Why we are allowed to use it

Under UK GDPR we rely on:

• Performance of a contract — running your account, generating and storing your builds, taking payment and providing support.
• Legitimate interests — keeping the service secure and working, understanding usage and cost in aggregate, and preventing abuse. We have considered these against your interests and keep the data involved to a minimum.
• Consent — optional diagnostics attached to a support report, and publishing a tradesperson listing. You can withdraw either at any time.
• Legal obligation — keeping transaction records for tax and accounting.

Who else sees it

We use the following processors, acting on our instructions and under contract. They may not use your content for their own purposes.

• OpenAI — your build description, conversation and materials list are sent to generate replies, materials lists, product matches, cost commentary, build guides and visuals. Photos you upload for a before-and-after are sent to generate the edited image.
• Supabase — database, authentication and file storage.
• Stripe — payments, subscriptions and the billing portal. Stripe receives your email and card details directly and is a controller in its own right for payment data.
• Google Cloud (Cloud Run) and Vercel — hosting for the API and the website.
• Resend — sending sign-in and account emails.
• Cloudflare — bot protection on our sign-in and sign-up pages. See Bot protection below.

We do not use advertising networks, and we have no third-party analytics or tracking scripts on the site.

Where your data goes

Our database and API are hosted in the UK/EU. Some processors — notably our AI provider and payment processor — process data in the United States. Those transfers rely on the UK International Data Transfer Addendum or Standard Contractual Clauses.

Visuals and photos

When builderG pictures your finished build, the generated image is stored in a storage bucket that is publicly readable to anyone who has the exact link. Links are long and effectively unguessable, and we never publish them — but they are not protected by your login. The same applies to a photo you upload for a before-and-after comparison.

So please do not upload photos containing anything you would not want seen if the link were shared — faces, documents, number plates, or the inside of rooms you would rather keep private. If you want an image removed, ask us and we will delete it.

Tradesperson listings

A tradesperson listing is public: your company name, trades, town, region, the first part of your postcode, and any website, public email or phone number you enter are shown to anyone searching the directory. Only the postcode area is displayed, never the full postcode. Untick “Show my listing” to hide it, or delete the listing entirely from your profile — your account and builds are unaffected.

How long we keep it

• Your builds — kept while your account is open. On the Free plan, builds may be removed after 30 days; on a paid plan they are kept.
• Billing records — kept for as long as the law requires for tax and accounting, normally six years.
• Support messages — kept while we deal with your query and for a reasonable period afterwards.
• Guest accounts — abandoned anonymous accounts are deleted periodically.

Bot protection

We use Cloudflare Turnstile to tell people apart from bots when you sign in, sign up, request a sign-in link, reset a password, or start a build without an account. It runs in invisible mode: there is normally nothing to click, and most visitors will never notice it.

To decide whether a request is genuine, Cloudflare receives your IP address, your browser and device characteristics, and signals about how the page was used. Turnstile is designed not to track people across websites and is not used for advertising. Cloudflare acts as our processor for this, and its handling of that data is described in Cloudflare’s Turnstile Privacy Addendum, which forms part of this policy.

We use it because our costs scale with use: without it, anyone could script thousands of throwaway accounts and run up the bill behind builderG. It protects the service rather than profiling you.

Cookies and local storage

We use no advertising or tracking cookies. Your browser stores a sign-in session from our authentication provider, and a few small preferences: your chosen interview depth, light or dark theme, a remembered region for the tradesperson directory, and whether you dismissed the “install the app” prompt. Clearing your browser data removes them and signs you out. Cloudflare Turnstile may also store a short-lived value while it verifies a sign-in request; see Bot protection.

Access control

Builds, materials lists and matches are readable only by the account that created them. This is enforced by row-level security in the database, not just in the application.

Diagnostics

When you report an issue you can choose to include diagnostics: the page you were on, your browser, and recent client-side errors. Authentication tokens, passwords, keys and secrets are stripped before the report is stored. Leave the box unticked and none of it is sent.

Your rights

You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where we rely on it. Deleting a build removes its conversation, materials lists, matches, guide and visuals. To delete your account and everything attached to it, email support@terredyme.com.

We aim to respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.

Children

builderG is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Changes

If we change this policy we will update the date above, and tell you directly if the change is significant.

Contact

Questions about this policy: support@terredyme.com, or via the support page. See also our Terms of Use and the frequently asked questions.