BuildAnyDRAFT — owner must review. These pages are proposed text, with no effective date. They must be finalized before public launch.
Privacy notice
Draft prepared 22 October 2026.
Who is responsible
Owner to complete before launch: the BuildAny operating entity, address, privacy contact, applicable legal bases, any representative or data protection officer, and effective date. This draft describes the current service design; it is not a finalized privacy notice.
Data we process and why
Account data includes your email, profile name, authentication records and sessions. We use it to provide access, manage invitations, secure accounts and respond to support requests. Authentication handles passwords; passwords are not intentionally included in AI prompts.
Project data includes prompts, change requests, specifications, source code, version history, build and test diagnostics, previews and published content. We process this data to generate, test, repair, host and recover your apps. Project source and diagnostics can contain personal information you or an app put into them.
Operational data includes IP addresses and request metadata, timestamps, project and account identifiers, token usage, estimated costs, errors and security events. We use it to maintain the service, prevent abuse, enforce limits and understand resource use. Authentication rate-limit keys are hashed. Integration credentials are encrypted at rest and used to perform the provider actions you request.
AI processing
Prompts, relevant project source, specifications and diagnostics are sent to AI providers. The current routes include DeepSeek and OpenCode’s hosted inference service, which may forward content to a model provider. Configured fallbacks may use other providers, including OpenAI or Anthropic. Do not submit passwords, access tokens, confidential personal records or information you lack permission to share.
Provider processing, retention and model improvement practices depend on the service and contract. We do not promise zero retention or no training by every provider. Owner must verify the contracts, transfer safeguards and applicable settings before accepting sensitive data. See the DeepSeek privacy policy and OpenCode privacy policy.
Processing may occur outside your country, including China when DeepSeek handles the request. Owner must confirm the locations and lawful transfer arrangements for each enabled provider.
Hosting and subprocessors
Core application hosting, control-plane records, per-app Supabase databases and encrypted backups run on the KS5 host. Cloudflare handles DNS, HTTPS edge delivery and related security processing. Owner must confirm the underlying hosting supplier, physical location, contractual subprocessors and any international transfers.
| Provider | Purpose and data |
|---|---|
| KS5 hosting supplier (owner to identify) | Hosting and local backups: account, project, app and operational data. |
| Cloudflare | Edge delivery and security: IP/request metadata and traffic through its proxy. |
| DeepSeek; OpenCode / Anomaly Innovations | AI generation and review: submitted prompts, relevant source and diagnostics. |
| OpenAI; Anthropic, if enabled | Configured AI alternatives: the content sent in those model requests. |
| GitHub; Vercel; managed Supabase, if connected | Your selected integration: repository source, deployment files or app database/auth data, plus credentials supplied for that provider. |
| Email and alert providers, if configured | Account emails or owner operational alerts. Owner to name the enabled providers before launch. |
Self-hosted Supabase software does not by itself mean account or app data is sent to Supabase’s hosted service. Optional managed services have their own terms. We may also disclose information when required by law or necessary to investigate abuse and protect users. Owner must finalize any other disclosure purposes.
Retention, backups and deletion
Active account and project records are kept to operate your workspace. Deleting a project stops its hosting; cleanup and recovery may retain some records or versions separately. Usage and security records currently have no automatic account-wide erasure schedule. Owner must set and publish maximum retention periods and an account deletion procedure before launch.
Backups contain encrypted database snapshots and project/configuration history. Rotation keeps up to seven daily and four weekly successful snapshots; missed backups can extend their age. Deletion from live storage does not immediately erase existing backups. Restored data must have deletion requests reapplied. Owner must confirm the maximum backup age, off-host copies and who can restore them.
A minimal record of previously served subdomains remains reserved to prevent later apps receiving old session cookies. Third-party copies, AI provider records and exports follow their own retention rules; disconnecting an integration does not automatically delete those copies.
Cookies and local storage
The current platform uses functional authentication, Preview access and connection-state cookies, and browser storage for preferences such as theme. We have not enabled non-essential advertising or analytics cookies in this implementation, so no consent banner is shown. Owner must recheck deployed Cloudflare and other provider features before launch and add consent controls before enabling non-essential cookies.
Your requests and apps you publish
Depending on applicable law, you may have rights to access, correct, export, restrict or delete personal data, object to processing, withdraw consent or complain to a supervisory authority. Identity verification may be required. Owner to supply an accessible privacy contact and response procedure before launch.
If you publish an app, you are responsible for its visitor-facing privacy notice, lawful processing and any cookie controls it needs. This platform notice does not replace your app’s notice. The service is intended for adults and is not designed to collect children’s data.