01Introduction

Build Sites Inc. ("Build Sites," "we," "our," or "us") operates an AI-powered website creation, hosting, commerce, and inbox integration platform available at build-sites.com (the "Services").

This Privacy Policy explains how we collect, use, disclose, process, and protect personal information when you use the Services.

By accessing or using Build Sites, you agree to this Privacy Policy.

Build Sites complies with applicable privacy laws including:

• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• Other applicable international data protection laws

02Categories of personal information we collect

A. Information you provide

When you use Build Sites, we may collect:

• Name and email address
• Authentication credentials via Clerk
• Account profile information
• Website content, text, media, and uploads
• AI prompts and inputs
• Communications
• Subscription selections

B. Inbox integration data (Gmail and Outlook)

If you connect a third-party email account via OAuth, we may access:

• Email metadata
• Email content through read permissions
• Send permissions to transmit emails on your behalf

We store:

• OAuth access tokens
• OAuth refresh tokens

Security safeguards:

• Tokens are encrypted at rest
• Tokens are encrypted in transit
• Tokens are deleted upon inbox disconnection
• Tokens are deleted upon account deletion

We do not:

• Store email passwords
• Persistently store full email bodies
• Download or store attachments
• Track email open rates
• Log outgoing email body content
• Use email content for AI training
• Use inbox data for advertising

Email content is rendered dynamically through provider APIs.

C. E-commerce data

If you enable e-commerce functionality, we may process:

• Customer order information
• Order status

Payment data is processed exclusively by Stripe Connect.

Under GDPR:

• You are the Data Controller
• Build Sites acts as a Data Processor

We do not use your customers' data for independent commercial purposes.

D. Automatically collected information

When you use the Services, we may collect:

• IP address
• Browser type
• Device identifiers
• Operating system
• Usage data
• Interaction metrics
• Approximate location

E. Cookies and similar technologies

We use cookies and local storage to:

• Maintain login sessions
• Store user preferences
• Enable Stripe and Clerk functionality
• Improve platform performance

We do not use cross-site behavioral advertising cookies.

You may disable cookies in your browser settings, though certain features may not function properly.

03Legal basis for processing (GDPR)

For users in the European Economic Area, we process personal data under:

• Contractual necessity
• Legitimate interests
• User consent
• Legal obligations

04How we use personal information

We use personal information to:

• Provide and operate the Services
• Authenticate and secure accounts
• Process subscriptions and billing
• Enable hosting and domain management
• Facilitate inbox integrations
• Enable commerce functionality
• Generate AI-powered content
• Improve product stability and performance
• Prevent fraud and abuse
• Comply with legal requirements

We may use anonymized and aggregated data for analytics and service improvement.

We do not sell personal information.

05AI prompts and generated content

We may temporarily store AI prompts and outputs for:

• System debugging
• Performance optimization
• Service reliability

We do not use user data to train third-party AI models.

We may use anonymized and aggregated usage insights to improve internal systems.

Build Sites does not engage in automated decision-making that produces legal or similarly significant effects.

06Data sharing and disclosure

We may share personal information with:

• Stripe
• Clerk
• DNSimple
• Vercel
• Google
• Microsoft
• Other infrastructure providers

Each service provider processes data under contractual data protection obligations.

We may also disclose information:

• When required by law
• In response to valid legal process
• In connection with a merger, acquisition, or asset transfer

We do not sell or rent personal data.

07International data transfers

Build Sites operates globally. Personal information may be processed in the United States or other jurisdictions.

Where required, we rely on:

• Standard Contractual Clauses
• Adequacy decisions
• Appropriate safeguards

By using the Services, you consent to these transfers.

08Data retention

We retain personal information:

• While your account remains active
• As necessary for compliance with legal obligations

Upon account deletion:

• Account data is deleted within 30 days
• OAuth tokens are immediately revoked and deleted
• Website data may be permanently erased

Financial and billing records may be retained for statutory compliance.

09Security measures

We implement comprehensive security measures including:

• HTTPS encrypted transmission
• AES-256 encrypted storage
• Encrypted OAuth token storage
• Role-based access controls
• Restricted internal personnel access

While no system is entirely secure, we take reasonable steps to protect data.

10Your rights

Depending on your jurisdiction, you may have the right to:

• Access personal data
• Correct inaccurate data
• Delete personal data
• Export personal data
• Restrict processing
• Object to processing

California residents may request disclosure of data categories collected.

To exercise your rights, contact admin@build-sites.com. We respond within applicable legal timeframes.

11Children's privacy

Build Sites is not intended for individuals under 16.

We do not knowingly collect personal data from minors. If we become aware of such collection, we will delete the data promptly.

12Data breach notification

In the event of a data breach:

• We will investigate promptly
• We will notify affected users where required by law

13Subprocessors

We use trusted third-party service providers to operate our platform, including but not limited to:

• Stripe
• Clerk
• DNSimple
• Vercel
• Google
• Microsoft

These providers are bound by contractual data protection obligations.

14Changes to this policy

We may update this Privacy Policy from time to time.

If material changes occur, we will notify users via email or in-app notice.

Continued use of the Services after updates constitutes acceptance.

15Contact