This policy explains what personal data BuildX collects, why, who we share it with, and your rights. We follow UK data protection law, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.
1. Who we are
BUILDX TOOLS LTD, a company registered in England and Wales with company number 17568602, registered office 66 Paul Street, London, EC2A 4NA. Email: [email protected].
We play two different roles:
- Controller: for information about the businesses that use BuildX, their team members' login accounts, and visitors to our website. This policy covers that information.
- Processor: for the information businesses keep about their customers and staff in BuildX, such as client names, addresses, jobs, quotes and invoices. The business is the controller of that information, and we process it on its behalf under our Data Processing Terms. If you're a customer of a business that uses BuildX, see section 10.
2. Information we collect
- Account details: your name, email address, phone number, role, and a securely hashed version of your password (we never store your password itself).
- Business details: business name, address, VAT number, logo, and payment details you choose to show on your invoices.
- Billing information: your plan, subscription status and payment history. Card payments are handled by Stripe. We never see or store full card numbers.
- How you use BuildX: activity in your account, such as jobs created, time clocked and documents sent, and technical information such as your IP address, browser type and the pages you use. We keep this for security, troubleshooting and improving the service.
- Communications: messages you send us through the support chat or by email.
- Website visitors: technical information such as your IP address and browser, and the cookies described in our Cookie Policy.
3. How we use it, and our lawful bases
| What we do | Lawful basis |
|---|---|
| Create and run your account, provide the service, and take subscription payments | Contract |
| Send service emails, such as email confirmation, password resets, billing notices and important changes | Contract |
| Keep the service secure: prevent fraud, abuse and unauthorised access, for example by limiting repeated sign-in attempts | Legitimate interests |
| Provide support, and understand how BuildX is used so we can improve it | Legitimate interests |
| Tell you about new features that are relevant to your account (you can opt out at any time) | Legitimate interests |
| Keep financial records, and meet tax and other legal obligations | Legal obligation |
We don't sell personal data, and we don't use it for advertising. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
4. Who we share it with
We use trusted service providers to run BuildX. They may only use personal data to provide their service to us:
| Provider | What they do |
|---|---|
| fasthosts.co.uk (UK) | Hosts our servers and database |
| Cloudflare | Delivers the website securely and protects it from attacks |
| Stripe | Processes subscription payments, and customer payments for businesses that turn on online payments |
| Resend | Sends our emails, and the emails businesses send to their customers through BuildX |
| Geoapify and OpenStreetMap search services | Find suppliers near a job site (we send the site's map position, not names) |
| CARTO and unpkg | Provide map images and the mapping library your browser loads |
| Open-Meteo | Provides weather forecasts for job sites (your browser sends the site's map position) |
| Google Fonts | Provides the fonts used on the website |
When your browser loads maps, weather or fonts, those providers receive your IP address, as with any website. We may also share information with professional advisers, with authorities where the law requires it, or with a buyer if our business is sold (in which case this policy will continue to apply).
5. International transfers
Some providers, such as Stripe, Cloudflare and Resend, may process data outside the UK, including in the United States. Where they do, the transfer is protected by UK adequacy regulations (including the UK–US data bridge) or by the UK's International Data Transfer Agreement or Addendum, or equivalent safeguards.
6. How long we keep it
- Account and business data: while your subscription is active, and for up to 12 months after it ends in case you return. If you ask us to delete it, we'll do so within 30 days of your request. Either way, we keep the records below.
- Billing and financial records: 6 years, to meet UK tax and accounting rules.
- Security and server logs: a short period, normally no longer than 90 days, unless needed to investigate a security issue.
- Support messages: while your account is open, and up to 12 months afterwards.
- Backups: overwritten on a rolling basis, so deleted data disappears from backups over time.
7. How we protect it
We use encryption in transit (HTTPS), hashed passwords, access controls that keep each business's data separate, limits on repeated sign-in attempts, and regular backups. No system is perfectly secure, but we work to protect your information, and we'll tell you and the ICO about a personal data breach where the law requires it.
8. Your rights
You have the right to ask for a copy of your personal data, and to ask us to correct it, delete it, restrict how we use it, or send it to you or another organisation in a portable format. You can also object to how we use it, including for marketing. To make a request, email [email protected]. We'll respond within one month. We may need to confirm your identity first.
9. Complaints
If you're unhappy with how we've handled your personal data, please contact us first and we'll do our best to put it right. We'll acknowledge your complaint within 30 days. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. If you're a customer of a business that uses BuildX
If a tradesperson or building company sends you a quote, invoice, form or report through BuildX, or you send them an enquiry using their BuildX form, that business controls your information. BuildX processes it on their behalf. Please contact the business directly about your information. If you contact us instead, we'll pass your request on to them. If you pay online, Stripe processes your payment details under the Stripe Privacy Policy.
11. Children
BuildX is for businesses and isn't intended for anyone under 18.
12. Changes to this policy
We may update this policy from time to time. We'll post the new version here, and tell you about significant changes by email or in the app.