Data controller for website/account data: Ryan Brown trading as BuildPilot AI, sole trader. Email: admin@buildpilotai.co.uk. Address: 38 Marigold Place, Stafford, ST16 1LH, United Kingdom.
Information we collect
- Account, identity and business contact details.
- Business profile, team membership and permissions.
- Subscription identifiers, plan, invoices and payment status (not full card numbers).
- Leads, enquiries, emails, messages, quotations, follow-ups and appointments.
- Tender documents, extracted findings, estimates and company rate data.
- Marketing contacts, campaign activity, consent and opt-out records.
- Work Feed profiles, opportunities, applications, messages and reviews.
- Support correspondence, audit records, IP hashes, security and diagnostic information.
Why we use personal information
We use information to create and administer accounts, provide requested workflows, process subscriptions, secure the service, generate AI-assisted output, send transactional messages, provide support, prevent misuse, keep audit records and improve reliability.
Lawful bases
We rely on contract where processing is needed to provide an account or subscribed service; legitimate interests for proportionate security, fraud prevention, service administration and business improvement; legal obligation where records must be kept or disclosures made; and consent where the law requires consent, including certain marketing or non-essential storage technologies.
When we act as processor
For personal data that a business customer uploads into its private workspace for BuildPilot to process on that customer's instructions, the customer will normally be the controller and BuildPilot will normally act as processor. Customers remain responsible for deciding what information they upload and ensuring they have a lawful basis for doing so. Where applicable, our Data Processing Agreement contains the processor terms.
AI processing
Where AI features are enabled, the content needed for the requested task may be sent to an AI model provider. BuildPilot currently supports OpenAI-compatible providers and may use OpenAI when configured. Do not upload unnecessary special-category data, criminal-offence data, identity documents or confidential personal information that is not required for the task.
Service providers and recipients
We use service providers for cloud hosting, databases, authentication, storage, AI processing, transactional email, monitoring, rate limiting and payments. Stripe handles payment-card processing; Resend may deliver transactional email where configured; OpenAI or another configured AI provider may process AI requests; and Vercel may provide application hosting/infrastructure. Our current provider categories are listed on the Subprocessors page. We do not sell personal data.
International transfers
Some service providers may process personal information outside the UK. Where UK data-protection law requires a transfer safeguard, we use or rely on an appropriate lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, as applicable to the provider.
Retention
Account and workspace information is generally retained while the account is active. After closure or deletion, information may be retained for a limited period for restoration, security, fraud prevention, disputes and legal/accounting obligations before deletion or backup rotation. Audit, billing and tax-related records may need to be kept longer where law or legitimate claims require it. We periodically review retention and should not keep personal information longer than necessary.
Security
Measures include authenticated access, password hashing, encrypted transport, workspace-scoped access controls, rate limiting, audit records and restricted file handling. No online service can guarantee absolute security.
Your UK data-protection rights
Depending on the circumstances, you may have rights to access, correct, erase or restrict personal data, object to processing, request portability and withdraw consent where consent is the basis. Rights are subject to legal exceptions.
Requests and complaints
Logged-in users can submit requests through the Privacy & data centre or email admin@buildpilotai.co.uk. We may need to verify identity. We aim to respond without undue delay and normally within one month, subject to lawful extensions or exceptions. You can also complain to the Information Commissioner's Office (ICO) if you are unhappy with how your personal information is handled.
Changes to this notice
We may update this notice as BuildPilot, its providers or legal requirements change. The latest revision date appears at the top of this page.