Privacy Policy

This Privacy Policy explains how BuildingPP OÜ (“Bilt”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use our websites at https://bilt.me and https://app.bilt.me (the “Site”) and the services we provide through them (the “Services”). It should be read together with our Terms of Service and Acceptable Use Policy. Capitalised terms not defined here have the meaning given in the Terms of Service.

1. Who we are (data controller)

BuildingPP OÜ is the controller of the personal data described in this Policy. Our details are:

• Company: BuildingPP OÜ (registry code 17224732)

• Address: Laulupeo tn 3-2, Tallinn, 10121, Estonia

• General contact: [email protected]

• Privacy contact: [email protected]

We have not appointed a Data Protection Officer, as we are not required to do so. For any question about this Policy or your personal data, contact us at [email protected].

2. Who and what this Policy covers

This Policy applies to personal data we process about:

• users and account holders of the Services (“users” or “customers”);

• visitors to our Site;

• newsletter subscribers, prospects and other people we communicate with about the Services.

Personal data of our job applicants and staff is handled under a separate privacy notice and is not covered here.

3. What personal data we collect, why, and our legal basis

The table below summarises how we use personal data in connection with the Services and the legal basis under the EU General Data Protection Regulation (“GDPR”) for each use.

We do not aim to collect special categories of personal data (such as health data). Please do not include such data, or other people’s personal data you are not entitled to share, in your prompts or other content you submit. Where we rely on consent, you can withdraw it at any time (see Section 8); withdrawal does not affect processing carried out before withdrawal.

4. Cookies and similar technologies

We use cookies and similar technologies when you use the Site and Services. Non-essential cookies (analytics and marketing) are set only after you consent through our cookie banner, which blocks analytics and advertising trackers until you accept them. You can change your choices at any time via the user settings or your browser settings.

5. Marketing communications

If you subscribe or otherwise consent, we send newsletters and product marketing by email. Where permitted, we may also send information about similar products to existing customers on a soft opt-in basis. Every marketing email contains an unsubscribe link, and you can opt out at any time by using it or by emailing [email protected]. Opting out of marketing does not stop essential service (transactional) messages about your account.

6. Who we share personal data with

We share personal data with service providers who process it on our behalf (our processors / sub-processors) and, where required, with authorities and professional advisers. We do not sell your personal data. The main recipients are:

We keep our sub-processor list up to date and will provide the current version on request at [email protected]. Where a Bilt-managed component processes personal data on your behalf under a Data Processing Agreement, it acts as our sub-processor under that agreement (see the Terms of Service).

7. Where your data is stored and international transfers

Your personal data is stored in the European Union. Some of our providers are based in, or have parent companies or support operations in, countries outside the EEA — mainly the United States, and for one provider Switzerland. Where personal data is transferred outside the EEA — whether by us, or by a provider acting on our behalf as part of its own operations — it is protected by an appropriate safeguard recognised under the GDPR: an EU adequacy decision (for example, Switzerland), the EU Standard Contractual Clauses, or certification under the EU–U.S. Data Privacy Framework, as indicated in the table above. You can request a copy of the relevant safeguards at [email protected].

8. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;

• have inaccurate or incomplete data corrected;

• have your data erased (“right to be forgotten”);

• restrict or object to certain processing, including direct marketing;

• receive your data in a portable format and have it transferred where technically feasible;

• withdraw consent at any time where we rely on consent.

To exercise any of these rights, contact [email protected]. We may need to verify your identity first. You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, [email protected], www.aki.ee. You may also complain to the authority in your country of residence.

9. AI features and your inputs

When you use our AI features, the prompts and content you submit (Customer Content) are sent to third-party AI model providers — currently Anthropic, OpenAI and Amazon Web Services (Bedrock) — to generate the output you request. These providers are engaged as our sub-processors under contract, and none of them uses your prompts or the resulting outputs to train their models.

AI calls are logged for quality, troubleshooting and abuse detection. We also use aggregated, non-identifying metrics about AI usage (such as error rates, latency and feature usage) to improve the Services. We do not use the content of your prompts to train our own models; if that ever changes, we will update this Policy and the Terms of Service before it does.

Because output is generated from what you submit, please do not enter sensitive personal data, other people’s personal data you are not entitled to share, or confidential information into prompts. We do not seek or knowingly use such information, and we apply measures intended to avoid reproducing it, but we cannot guarantee that information you include in an input will not appear in the output. This section should be read together with the Terms of Service and Acceptable Use Policy.

10. Automated decision-making

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing within the meaning of Article 22 GDPR. Our AI features generate content at your request but do not make such decisions about you.

11. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this Policy, or longer where the law requires (for example, accounting and tax records). Indicative retention periods:

12. How we protect your data

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, multi-factor authentication for staff access, role-based and least-privilege access controls, audit logging, environment separation, regular access reviews, encrypted backups with restore testing, and a documented incident-response process with 72-hour breach notification to the supervisory authority where required.

13. Children

The Services are not directed to children. You must be at least 18, or have the consent of your legal guardian, to use the Services, as set out in the Terms of Service. We do not knowingly collect personal data from children.

14. Information for United States residents

If you are a resident of a U.S. state with a comprehensive privacy law (such as California under the CCPA/CPRA), the following applies in addition to the rest of this Policy. We collect the categories of personal information described in Section 3 (identifiers, account and commercial information, internet/usage activity, and inputs you provide). We use it for the business purposes described above.

We do not “sell” personal information for money. We may “share” personal information for cross-context behavioural advertising through advertising cookies (e.g. Meta, Google, X); you can opt out at any time through our user cookie settings. Subject to your state’s law, you may have the right to know, access, correct and delete your personal information, to opt out of sale/sharing and certain profiling, and to be free from discrimination for exercising these rights. To exercise them, contact [email protected]. You may use an authorised agent; where you do, we may require written proof of the agent's authority and may verify your identity with you directly before acting on the request.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Site and update the “Last updated” date above, and where changes are material we will notify you by email or in-app. If we ever intend to change how we use your data for training our own systems, we will update this Policy and the Terms of Service before doing so.

16. How to contact us

• Company: BuildingPP OÜ (registry code 17224732)

• Address: Laulupeo tn 3-2, Tallinn, 10121, Estonia

• Privacy enquiries and rights requests: [email protected]

• General support: [email protected]