Privacy Policy

1. Who we are

[Legal entity name] ("BuildPaza", "we", "us") operates buildpaza.com. Registered address: [Registered address]. We are the data controller for personal data processed about visitors and account holders. Contact: privacy@buildpaza.com.

When you use BuildPaza to build an app that itself processes other people's personal data, you are the controller of that data and BuildPaza acts as your processor — see our Data Processing Addendum.

2. What we collect

• Account data — your email address (required for the magic-link sign-in) and optional display name.
• Build content — the prompts you send, the files the AI team generates, chat transcripts, and per-build settings.
• Usage & metering — token counts and action counts used to operate credit limits and billing.
• Billing data — plan, subscription status, and the Stripe customer/subscription identifiers. We never see or store full card numbers; payments are handled by Stripe.
• Technical data — IP address, browser user-agent, session and rate-limit records, and server logs, kept for security and abuse prevention.

3. Why we process it & legal bases

4. AI model processing

Your prompts and build content are sent to EU-sovereign large-language models served via Depaza on European infrastructure to generate your app. We do not sell your content, and we do not use it to train third-party foundation models. See our sovereignty page and sub-processor list.

5. Who we share data with

We use a small number of vetted sub-processors (e.g. AI inference, email delivery, payments, hosting, CDN/TLS). The current list, their function and location is at /subprocessors. Where a sub-processor is outside the EEA (e.g. Stripe), transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

6. International transfers

We aim to keep processing within the EU/EEA. Where a transfer to a third country is necessary, we rely on adequacy decisions or Standard Contractual Clauses with supplementary measures.

7. Retention

• Account & builds — kept while your account is active; deleted when you delete your account.
• Billing/tax records — retained for the period required by applicable law (typically up to [5–7] years).
• Logs & security data — kept for a limited period then rotated.

8. Your rights

Under the GDPR you may access, rectify, erase, restrict, or object to processing, and request portability. You can do the two most important ones yourself, instantly, from your account settings:

• Export your data — a complete machine-readable download (Art. 20).
• Delete your account — permanent erasure of your account and all builds (Art. 17).

For anything else, email privacy@buildpaza.com. You also have the right to lodge a complaint with your local supervisory authority.

9. Security

We use TLS in transit, hashed single-use sign-in tokens, session-id rotation on login, scoped per-build isolation, least-privilege database access, and rate limiting. No system is perfectly secure, but we take reasonable, industry-standard measures.

10. Children

BuildPaza is not directed at children under 16 and we do not knowingly collect their data.

11. Changes

We will update this page and revise the "last updated" date when this policy changes; material changes will be communicated to account holders.