Privacy Policy

Bildr (operated by Bildr Labs Pty Ltd, ACN 696 230 350, ABN 80 696 230 350) is committed to transparent and careful handling of personal information. This policy explains what we collect, why we collect it, and how we use, disclose, retain and protect it. Australian privacy obligations apply to us where required by law; this policy does not by itself determine whether a particular statutory exemption or obligation applies.

Bildr does not currently sell personal information for money. We do disclose information to the service providers and other recipients described in this policy. If our practices materially change, we will update this policy and provide any notice or choice required by law.

We collect the following personal information when you sign up and use Bildr:

• Identity data: First name, last name
• Contact data: Email address and phone number
• Consent and account data: Policy versions, consent choices and timestamps, authentication identifiers, account status and subscription status
• Build data: Project details, budget information, trade contacts, inspection records, and documents you upload
• Usage and security data: Feature use, session timing, pseudonymous usage counters, IP/device/request information available in provider logs, and security or abuse events
• Payment and order data: Stripe customer, subscription, checkout and invoice identifiers; amounts, currency, status, deadlines and fulfilment metadata. For a Premium Project Pack order, we also store a server-only, fixed JSON snapshot of the in-scope project records, table row counts and a SHA-256 integrity digest. We do not store full card details
• Communications: Emails, support requests, dispute correspondence and messages you send us

Third-party contact details you provide. To manage your build, you may choose to record contact details for trades, subcontractors, and other third parties (e.g. trade name, phone number, email, licence number, insurance details, and quote amounts). This information is stored against your project and may be processed by Bildr's automated systems and contracted service providers as described below. Authorised staff access is limited as described under Operator access. You are responsible for ensuring you have the right to provide third-party information and for giving any notices required by law. We do not contact those third parties on your behalf.

We use your information to:

• Deliver and improve the Bildr service
• Personalise your build management experience
• Process payments and manage your subscription
• Send you transactional emails (receipts, onboarding, account status, service notifications)
• Send marketing emails, if you opted in at signup (you can unsubscribe any time)
• Comply with legal obligations
• Investigate fraud or misuse of the platform

Operator access to your data: Automated systems and contracted service providers process account and project data to deliver the service. Authorised personnel may access the minimum information reasonably needed for support you request, a Premium Project Pack you order, billing or disputes, security and incident response, abuse or fraud investigation, operation and maintenance of the service, or legal obligations. We do not routinely read project content for unrelated purposes, but human access is not limited to situations where you provide separate written consent.

We share your information only with the service providers required to operate Bildr:

• Supabase: database and authentication (supabase.com/privacy)
• Vercel: application hosting (vercel.com/privacy)
• Stripe: payment processing (stripe.com/privacy)
• Resend: transactional email (resend.com/privacy)
• Anthropic: AI processing for conversations and generated project outputs. Data handling is governed by the applicable commercial terms and account settings. (anthropic.com/privacy)
• OpenAI: document extraction and analysis for uploaded plans and related files. Uploaded content may include personal or third-party information contained in the document. Data handling is governed by the applicable service terms and account settings. (openai.com/privacy)
• Sentry: error monitoring and performance tracking. Sentry may receive stack traces, request metadata, a pseudonymous user identifier, and other data included in an error event. We configure filtering and masking to reduce unnecessary content, but cannot promise that every event is free of personal data. (sentry.io/privacy)
• Vercel Analytics: consent-gated traffic analytics. It is configured without Bildr account or project fields, but Vercel may process technical request and device information under its active service and policy. (vercel.com/privacy)
• Upstash Redis: rate limiting and abuse protection. Receives pseudonymous identifiers such as user UUIDs or salted email hashes with request counters. These identifiers can still be personal information in context. Rate-limit keys are configured to expire after the applicable window. (upstash.com/privacy)

We do not sell, rent, or trade your personal information. Provider company locations, processing locations, and configured data regions are not the same thing and may vary. The configured Supabase database and storage region and Vercel function region are in Sydney; some AI, payment, email, monitoring, and support providers may process data overseas under their applicable terms.

In the event that Bildr Labs Pty Ltd is acquired, merges with another entity, or transfers its assets as part of a business sale or restructure, your personal data may be transferred to the acquiring entity as part of that transaction. In such an event:

• We will use reasonable efforts to notify you via email before your data is transferred
• We will use reasonable efforts to require the acquiring entity to handle your data in accordance with this Privacy Policy
• You will have the right to delete your account and data prior to any transfer, where practicable

Notice: We will provide notice of a material ownership or data-controller change where and when required by applicable law and where transaction restrictions permit. Available export and deletion controls remain subject to the operational, legal, security, payment, backup, and provider-retention limits described in this policy.

Your data is stored and processed using the following services:

• Supabase: database, storage, and authentication, configured in the Sydney region
• Vercel: application hosting and serverless functions, with functions pinned to Sydney (syd1)
• Anthropic and OpenAI: AI model processing, which may occur overseas under the applicable provider terms
• Stripe: payment processing; processing locations are governed by Stripe's service and privacy terms
• Resend: transactional email delivery

Some service providers may process personal information outside Australia. We take reasonable steps in relation to overseas disclosures as required by applicable Australian privacy law and rely on the provider terms and controls available for each service. See each linked provider policy for current processing and transfer information.

Bildr uses encrypted connections, access controls, user-scoped database policies, and provider-managed security features. The effectiveness and availability of provider controls can depend on account configuration and service plan. For the current, non-contractual recovery approach, see our Data Protection & Disaster Recovery page. No internet service can guarantee absolute security.

We retain account and project data while your account exists so that you can use the service and resume work. Cancelling a subscription does not itself delete the account or trigger an automatic 90-day project-data purge.

• After cancellation: The account and its project records remain stored unless you use Delete Account or ask us to start the account-deletion workflow. Access after the paid period may be limited by subscription status.
• Account deletion: The in-app deletion workflow cancels active billing and attempts to remove linked application database records, uploaded files, and authentication credentials. Payment, tax, security, provider-log, and backup records may remain where required by law or under applicable provider retention and backup-rotation policies.
• Data export: You may download a free raw JSON export of your account and project records immediately from Account settings. After we receive a complete email request and verify the account holder's identity, we will manually prepare and send the assisted raw export within five NSW business days. Uploaded binary files are handled separately through support.

Specific retention periods by data type:

• AI conversations, Walkthrough transcripts, and uploaded documents: Retained with the account unless deleted through supported account or project controls
• Payment records and invoices: Retained by Bildr and Stripe as needed for billing, accounting, disputes, fraud prevention, and applicable legal obligations
• Premium Project Pack snapshots: The project snapshot captured for a paid Premium Project Pack is retained with the order so authorised personnel can prepare and verify the files without reading later live-project changes. It is included in the active account-deletion workflow after any pending order is resolved, subject to the payment, dispute, legal, backup and provider-retention limits above
• AI usage and operational logs: Retained for service operation, cost control, abuse prevention, and troubleshooting; linked application records are included in the account-deletion workflow where supported
• Error and performance telemetry: Retention depends on the configured Sentry plan and settings and Sentry's current provider policy; Session Replay is disabled for the 1.0 launch
• Backups and provider logs: May persist after active-system deletion until the applicable provider's configured retention or rotation process completes
• Founding-offer eligibility: To enforce the lifetime limit of 50 claims, we retain the former account UUID and associated Stripe customer and checkout-session identifiers after account deletion. This ledger does not contain your name, email, address, or project content, but the identifiers remain pseudonymous personal information and are restricted to server-side administration.

Bildr uses automated model processing to produce assessments that may influence your decisions:

• Quote Checker: Reviews supplied quote scope against saved project information and identifies gaps, exclusions and questions; it does not determine a current market price
• Budget Generation: Produces planning estimates from supplied project information and internal static references, with provenance and uncertainty labels for customer review
• Compliance Tracking: Generates state- and project-based prompts that require confirmation with the relevant authority, council, certifier, or licensed professional

These assessments are generated by AI models based on the information you provide and the internal reference material available to the system. That material is not live market data and may be incomplete, stale, or inapplicable. The outputs are guidance only and should not be relied upon as professional advice. Verify them with current written evidence and appropriately qualified professionals before making financial or construction decisions.

No automated decision made by Bildr has binding legal or financial effect. All decisions about your build remain yours.

When you use Bildr AI features, project details and conversation content may be sent to Anthropic. Uploaded documents and derived page content may also be sent to OpenAI for document extraction and analysis. Depending on the feature, this can include:

• Project specifications (build type, size, location, finishes)
• Budget and cost information
• Trade quotes and contact details you provide
• Conversation history within the platform
• Uploaded documents (architectural plans, engineering reports)

These providers process the supplied content to return model outputs. Their handling is governed by the applicable commercial terms, account settings, and privacy policies: Anthropic and OpenAI.

Redaction is applied in specific prompt paths, not to every possible input. Structured contractor records are minimised or redacted in supported AI prompts, and selected free-form text is scanned for common phone, email, and ABN patterns. These controls reduce exposure but are not guaranteed to detect every identifier. Uploaded documents are processed as supplied and can contain designer, consultant, owner, or trade names and contact details; relevant document content may therefore be processed by the AI providers. Remove information you do not want processed before uploading a file.

Subject to applicable law, identity verification, and permitted exceptions, you may ask us to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Start the service's account-deletion workflow, noting the retention limits described above
• Opt out of marketing communications at any time
• Use the available raw data export or request supported export assistance
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, contact us at support@bildr.au. We may need to verify your identity before fulfilling a request and will respond within the timeframe required by applicable law.

Bildr uses cookies and localStorage for the following current purposes:

• Essential cookies: Required for authentication (Supabase session cookies), session management, and basic platform functionality. These cannot be disabled without breaking the service.
• Preference and interface storage: Theme, consent, tutorial state, and dismissed-help keys are stored in browser localStorage.
• Progress storage: Onboarding answers may be stored in localStorage so an interrupted setup can be resumed. These answers can contain personal or project information.
• Analytics (consent-gated): Vercel Analytics loads only after you accept optional analytics on the consent banner.
• Error and performance telemetry: Sentry diagnostic telemetry can operate without optional analytics consent. Session Replay is disabled for the 1.0 launch.

We do not use advertising cookies or share cookie data with advertisers. We do not use third-party tracking pixels.

For the currently documented keys, telemetry distinction, and steps to change optional consent, see our Cookies Policy.

Bildr is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from minors.

Depending on the applicable law and processing activity, our reasons for handling personal information include:

• Providing the service: Account management, requested AI features, file handling, support, and payment processing
• Consent: Marketing communications (opt-in at signup, unsubscribe any time)
• Operations and security: Platform security, fraud and abuse prevention, service improvement, rate limiting, and error monitoring
• Legal obligations and rights: Tax and accounting records, lawful requests, disputes, and regulatory compliance

In the event of a data breach that is likely to result in serious harm to you, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988
• Notify affected individuals as soon as practicable, including a description of the breach, the types of information involved, and recommended steps to reduce potential harm
• Take reasonable steps to contain the breach and mitigate any damage

We may update this Privacy Policy periodically. We will notify you of material changes via email. The updated policy will be posted on this page with a revised date.

For privacy-related questions or complaints, contact our Privacy Officer at:

support@bildr.au
Bildr Labs Pty Ltd, PO Box 261, Hunters Hill NSW 2110, Australia

If we cannot resolve your complaint, you may contact the OAIC at oaic.gov.au.