Data Processing Summary
Effective August 2026 · Version 1.1 · England & Wales
This summary sets out how BuilderBuddy processes personal data on behalf of users and is intended to provide transparency in accordance with UK GDPR requirements.
1. Data Controller
Builder Buddy App Ltd is the data controller for all personal data collected through the Service. Company Number: 17240195. Registered Address: 167-169 Great Portland Street London. Contact: team@builderbuddy.co.uk.
2. Categories of Data Processed
| Data Category | Purpose | Legal Basis |
|---|---|---|
| Name & email | Account creation and login | Contract |
| Quote content | Service delivery | Contract |
| Uploaded files | Job management | Contract |
| IP address & logs | Security and fraud prevention | Legitimate interests |
| Payment reference | Subscription management | Contract |
| Support emails | Customer service | Legitimate interests |
3. Data Retention Schedule
- Account data: Retained for the duration of your account plus 30 days after deletion
- Quote and job data: Retained for the duration of your account
- Financial records: 7 years in compliance with HMRC requirements
- Support correspondence: 2 years
- Security logs: 90 days
4. Sub-Processors
We use the following sub-processors. Each processes personal data only on our instructions.
- OpenAI, L.L.C. (US): generates quotes from job descriptions, photographs and voice recordings
- Supabase, Inc. (US, managed hosting region): database, file storage and authentication
- Cloudflare, Inc. (US, local data centres): application hosting and delivery
- Stripe Payments UK Limited (UK): subscription payments
- Resend (US): transactional email
- PostHog (EU hosting): product analytics
- Sentry (EU hosting): error and crash reporting
5. International Transfers
Some of the sub-processors listed above are based in the United States or host data in the European Economic Area, so personal data is transferred outside the United Kingdom. Where that happens we rely on the transfer safeguards set out in each provider's data processing terms, which for these providers means the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. A copy of the relevant terms is available on request from team@builderbuddy.co.uk.
6. Security Measures
- Encryption of data in transit using TLS 1.2 or higher
- Encryption of data at rest
- Access controls limiting data access to authorised personnel only
- Regular security assessments
- Incident response procedures in place
7. Your Rights
Under UK GDPR you have the right to access, correct, delete, restrict, or port your data. To exercise any right contact team@builderbuddy.co.uk. You may also complain to the ICO at ico.org.uk or by calling 0303 123 1113.