Privacy Policy

Who we are

Buildful is operated by LinearBytes Inc., 8 The Green, Ste 300, Dover, DE, USA (“we”, “us”). LinearBytes Inc. is responsible for the personal data described in this policy.

Your repos, environment variables and app can contain other people's personal data, such as your own users'. We process that data on your behalf, only to run your tasks. If your company needs a data processing agreement, email hello@buildful.ai.

What we collect

• Account details. Your name and email address. If you sign up with an email address, we keep your password only as a secure hash. If you sign in with another account, such as Google, we receive your name, email address and profile picture from it. We may add other sign-in methods, such as GitHub, Apple or LinkedIn; the same applies to them.
• Your repositories. For the repos you connect through the Buildful GitHub App, we read code and metadata and write branches and pull requests. Only the repos you select are accessible.
• Task content. The change you describe, any screenshots you attach, the code and logs produced while running it, the pull request it opens, and its QA recording, if one is made.
• Repository settings. Base branch, working directory, setup and check commands, notes for the agent, environment variables, and a captured login (the signed-in session for your app) used to start browser tests signed in.
• Keys and connected accounts. API keys you save for model providers, and the credentials of a ChatGPT subscription you connect for Codex.
• Team memories. Facts the agent learned about your repos on tasks whose pull requests were merged, kept so later tasks on your team start with them.
• Integrations. If you connect Slack or Linear, the messages and issues that start tasks (in Slack, with the thread they were posted in), and the details needed to reply there.
• Billing data. Your Stripe customer record: plan, invoices and prepaid credit balance. Card numbers are handled by Stripe and never reach us.
• Usage and analytics. Product events (pages viewed, buttons clicked, tasks created) and standard technical logs such as IP address and user agent.
• Ad clicks. When you arrive from an ad, the ad's click ID and campaign tags, kept with your account.

How we use it

• To run the service: connect your repos, execute your tasks, and ship pull requests.
• To bill you: keep your plan, usage and credit records accurate.
• To support you: answer email you send us and investigate problems you report.
• To improve Buildful: understand which features are used and where tasks fail. We do not use your code or task content to train models, and we do not sell your data.
• To measure our marketing: see which ads and pages bring people to Buildful.
• To keep the service safe: detect abuse, enforce rate limits and scope, and secure accounts.

Who we share it with

Service providers that process data on our behalf, only to run Buildful:

• Vercel: hosting for the site, the sandboxes where tasks run, and Vercel AI Gateway, which routes model requests.
• AI model providers, and the companies that host their models, mostly reached through Vercel AI Gateway: the code and instructions for a task, so models can plan, write, review and describe the change. Which providers handle a task depends on the model used, and can change as we update Buildful.
• Cloudflare: networking, storage for QA recordings and attachments, and delivery of account emails.
• MongoDB Atlas: our application database, which stores accounts, teams, tasks and run logs.
• Axiom: server logs, which can include task instructions.
• Stripe: payments and invoices.
• PostHog: product analytics.
• Composio: connects the integrations you turn on, such as Linear.
• Slack: our team's internal notifications, including the name, email address and country of each new account.

Analytics and advertising partners that also use data for their own purposes, under their own privacy policies:

• Google: Google Tag Manager, Google Analytics and Google Ads, to understand how Buildful is used and to measure our ads. If you sign in with Google, Google also knows you use Buildful.
• Meta: the Meta Pixel, to measure our ads on Facebook and Instagram.

When you arrive from an ad, we tell that ad platform about key account events, such as signing up or subscribing, so we can see which ads work. We never share your code or task content for this.

Services you connect, which receive data because you ask us to send it, under your own agreement with them: GitHub, Slack, Linear, and a model provider you use with your own API key or ChatGPT subscription. Those model requests go straight to the provider, and the provider's terms apply.

When a task makes a QA recording, its pull request on GitHub includes a short animated preview through a link that works for 7 days. Anyone who can see the pull request can see the preview, including the public if the repository is public, and it can show your app as the captured login sees it.

We may also disclose data if the law requires it. Everything in your account is scoped to your team: members of your team can see its repos, tasks, pull requests, environment variables and memories; nobody else's team can.

Cookies and analytics

• Essential. Cookies that keep you signed in and secure your session.
• Analytics. PostHog and Google Analytics (loaded through Google Tag Manager) measure how the site and the app are used.
• Advertising measurement. The Meta Pixel and Google Ads tell us which ads work.

You can block or delete cookies in your browser settings. Blocking essential cookies will sign you out. We don't sell personal data, but some US state laws treat advertising tags like the Meta Pixel and Google Ads as “sharing” for advertising. To opt out, block those cookies in your browser, or change your ad settings with Google and Meta. We don't change our analytics or advertising tags in response to a browser's Do Not Track signal.

Data retention

Your tasks and logs, memories, repository settings, environment variables, saved keys, connected ChatGPT credentials, QA recordings, attachments and integration connections are kept while your account is open, so you can review your history. They are deleted within 30 days of your account being deleted. Pull requests already opened on GitHub stay there until you delete them. Sandbox workspaces are destroyed when a task finishes. Billing records are kept as long as tax and accounting law requires. Backups roll off within 90 days.

Your rights

To get a copy of your data, correct it, delete it, or delete your account, email hello@buildful.ai from the address on your account. Depending on where you live, you may also have the right to port your data or to object to certain processing; the same address works for those, and we will respond within the time the law requires.

If you are in the EEA, UK or Switzerland

We process your data to perform our contract with you (running your tasks, billing you), and for our legitimate interests in supporting you, securing and improving Buildful, and measuring our marketing. You can object to processing based on legitimate interests by emailing hello@buildful.ai.

We are based in the United States, and our providers process data in the US and other countries. Where the law requires, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses. You also have the right to complain to your local data protection authority.

Children

Buildful is not for children under 13, and we don't knowingly collect their data. Users under 18 need a parent or guardian's consent. If you believe a child under 13 has given us personal data, email hello@buildful.ai and we will delete it.

Security

We encrypt data in transit and at rest and scope every resource to your team. Your keys and environment variables are encrypted at rest. When a task runs, they are injected into a sandbox dedicated to that task, and the sandbox is destroyed when the task ends. No system is perfectly secure, but we take incidents seriously and will notify affected users where the law requires.

Changes to this policy

As the product changes, this policy may too. If a change is material, we will announce it on the site or by email before it takes effect.

Contact

Privacy questions? Email hello@buildful.ai, or write to LinearBytes Inc., 8 The Green, Ste 300, Dover, DE, USA.