Privacy Policy

This Privacy Policy explains how BuildingPP OÜ (“Bilt”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use our websites at https://bilt.me and https://app.bilt.me (the “Site”) and the services we provide through them (the “Services”). It should be read together with our Terms of Service and Acceptable Use Policy. Capitalised terms not defined here have the meaning given in the Terms of Service.

1. Who we are (data controller)

BuildingPP OÜ is the controller of the personal data described in this Policy. Our details are:

• Company: BuildingPP OÜ (registry code 17224732)

• Address: Laulupeo tn 3-2, Tallinn, 10121, Estonia

• General contact: [email protected]

• Privacy contact: [email protected]

We have not appointed a Data Protection Officer, as we are not required to do so. For any question about this Policy or your personal data, contact us at [email protected].

2. Who and what this Policy covers

This Policy applies to personal data we process about:

• users and account holders of the Services (“users” or “customers”), including people whose account has closed within the last 30 days;

• visitors to our Site;

• newsletter subscribers, prospects and other people we communicate with about the Services.

Personal data of our job applicants and staff is handled under a separate privacy notice and is not covered here.

The Bilt Mobile app for iOS has its own privacy notice — the Bilt Mobile Privacy Notice — which describes the app's specific data practices. This Policy continues to apply to your Bilt account and to the Services themselves, however you reach them.

3. What personal data we collect, why, and our legal basis

The table below summarises how we use personal data in connection with the Services and the legal basis under the EU General Data Protection Regulation (“GDPR”) for each use.

We do not aim to collect special categories of personal data (such as health data). Please do not include such data, or other people’s personal data you are not entitled to share, in your prompts or other content you submit. Where we rely on consent, you can withdraw it at any time (see Section 8); withdrawal does not affect processing carried out before withdrawal.

4. Cookies and similar technologies

We use cookies and similar technologies when you use the Site and Services. Non-essential cookies (analytics and marketing) are set only after you consent through our cookie banner, which blocks analytics and advertising trackers until you accept them. You can change your choices at any time via the user settings or your browser settings.

5. Marketing communications

If you subscribe or otherwise consent, we send newsletters and product marketing by email. Where permitted, we may also send information about similar products to existing customers on a soft opt-in basis. Every marketing email contains an unsubscribe link, and you can opt out at any time by using it or by emailing [email protected]. Opting out of marketing does not stop essential service (transactional) messages about your account.

Personal messages from our team. We are a small team and we get in touch with customers directly, by email. Someone from Bilt may write to ask how a build is going, to offer help with publishing, or to point you at something that solves a problem you appear to be hitting. To make that help useful rather than generic, the person contacting you looks at your account first — how you have been using the Services, and your project itself, which means your prompts, your activity and a preview of the app you are building. This never extends to the data your own app holds about its users. That data belongs to you, and we access it only when you ask us to help with something specific, under our Data Processing Agreement.

We also do this after you contact support: we may follow up on a closed ticket to check the fix worked and offer further help.

If you close your account, we email to ask why you left, and to offer help if something we could have fixed is what drove you away. Most email goes unread, so this is an automated short series rather than a single message: up to three emails, all of them within 30 days of your account closing. The series stops as soon as you reply, and stops if you unsubscribe or tell us to. It ends in any case at the close of those 30 days, when your account data is deleted or anonymised as described in Section 11. Every one of these emails carries an unsubscribe link.

What deleting your account does and does not erase. Closing your account stops us contacting you, but it does not wipe every record that mentions you. Invoices and payment records for seven years under Estonian accounting and tax law we are required to keep and some we keep for a limited period to run the service, such as the delivery logs for emails we have already sent you and any support conversations you had with us. Those records can still contain your name and email address. We do not use them to reach out to you: they are kept for accounting, legal and operational purposes only, and are not a mailing list. Separately, if you have unsubscribed or asked us to stop, we keep a minimal suppression record for exactly one reason: so that you are not contacted again by mistake. Section 11 sets out how long each type of record is kept.

When the answer turns out to be one of our own products. We do not write to you in order to sell you something — when we get in touch, it is to help, and the message has nothing to promote. But if you write back and the conversation gets to a specific problem, sometimes the fix, or the next thing to try, is something we ourselves offer: if your app's backend is what keeps breaking, our own backend service may genuinely be the answer. When that happens we will say so, and we will be straightforward that it is ours. It is still an answer to your question rather than a pitch, and you are free to ignore it.

Two separate choices, and you control both.

• Opting out of marketing stops newsletters, promotional email and product announcements. Because our personal messages do not promote anything, this choice does not stop them — if you want those stopped too, use the second choice.

• Telling us you do not want to be contacted unprompted stops us reaching out to you at all.

Either choice is honoured without our asking you for a reason. Neither one affects our replies when you contact us, and neither affects essential service messages about your account. To set either, use the unsubscribe link in any email or write to [email protected].

6. Who we share personal data with

We share personal data with service providers who process it on our behalf (our processors / sub-processors) and, where required, with authorities and professional advisers. We do not sell your personal data. Not every recipient below is our processor — where a company decides for itself how it uses the data, it is a controller in its own right, and the Meta advertising tools are a case where we and Meta are joint controllers. That arrangement is explained after the table. The main recipients are:

We keep our sub-processor list up to date and will provide the current version on request at [email protected]. Where a Bilt-managed component processes personal data on your behalf under a Data Processing Agreement, it acts as our sub-processor under that agreement (see the Terms of Service).

The Meta advertising tools: Meta is a joint controller with us

When you consent to marketing cookies, our Site loads the Meta advertising tools (the Meta Pixel). For the data those tools collect, Meta is not acting on our behalf. Meta and we are joint controllers under Article 26 GDPR, which means we are responsible together. This section is the information Article 26 requires us to give you.

Which Meta company, and where the data goes. It depends where you are. If you are in the EU/EEA or Switzerland, the joint controller is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you are in the United Kingdom, it is Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA — there is no European Meta company in that arrangement, so UK visitors' data is sent directly to the United States. For that transfer we rely on the UK Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner.

What we use the tools for, and what is shared. We use them to measure how our advertising performs and to show relevant ads. Where you have consented, the tools send Meta a record of what you did on our Site — for example that you viewed a page, signed up, or made a purchase — together with online identifiers such as cookie identifiers, your IP address and your browser information.

What the joint responsibility covers, and what it does not. It covers only the collection of that data on our Site and its transmission to Meta. Everything Meta does with the data afterwards is Meta's own responsibility, as a controller in its own right, under Meta's Privacy Policy.

The essence of our arrangement with Meta. We and Meta have entered into Meta's Controller Addendum, which determines our respective responsibilities for this processing. Under it:

• we are responsible for giving you the information in this section, and for having a valid legal basis for the collection and transmission — which is your consent;

• as between us and Meta, Meta is responsible for handling your rights of access, rectification, erasure, restriction, portability and objection (Articles 15 to 20 GDPR) for the data Meta holds once it has been transmitted;

• each of us is responsible for our own security obligations and our own breach-reporting obligations for this processing.

Meta's own information. Meta's identity and contact details, the information required by Article 13(1)(a) and (b), the legal basis Meta relies on, and how to exercise your rights against Meta are all set out in Meta's Privacy Policy at https://www.facebook.com/about/privacy.

Your choices, and how to reach us. Whatever we and Meta have agreed between ourselves, you may exercise your rights against either of us (Article 26(3)). If you contact us about this processing we will answer for our own part, forward your request to Meta, and tell you that we have done so — we are not permitted to answer on Meta's behalf. Write to [email protected]. You can stop this processing at any time by withdrawing your marketing-cookie consent in your cookie settings; withdrawal does not affect anything that happened before it.

7. Where your data is stored and international transfers

Your personal data is stored in the European Union. Some of our providers have parent companies or support operations outside the EEA (mainly in the United States and, for one provider, Switzerland). Where personal data is transferred outside the EEA, we rely on an appropriate safeguard: an EU adequacy decision (e.g. Switzerland), the EU Standard Contractual Clauses, and/or certification under the EU–U.S. Data Privacy Framework, as indicated in the table above. You can request a copy of the relevant safeguards at [email protected]. One transfer does not run through the EU: for visitors in the United Kingdom, the Meta advertising tools send data directly to Meta Platforms, Inc. in the United States, under the UK Addendum to the Standard Contractual Clauses (see Section 6).

8. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;

• have inaccurate or incomplete data corrected;

• have your data erased (“right to be forgotten”);

• restrict or object to certain processing, including direct marketing;

• receive your data in a portable format and have it transferred where technically feasible;

• withdraw consent at any time where we rely on consent.

To exercise any of these rights, contact [email protected]. We may need to verify your identity first. You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, [email protected], www.aki.ee. You may also complain to the authority in your country of residence.

9. AI features and your inputs

When you use our AI features, the prompts and content you submit (Customer Content) are sent to third-party AI model providers — currently Anthropic, OpenAI and Amazon Web Services (Bedrock) — to generate the output you request. These providers are engaged as our sub-processors under contract, and none of them uses your prompts or the resulting outputs to train their models.

AI calls are logged for quality, troubleshooting and abuse detection. We also use aggregated, non-identifying metrics about AI usage (such as error rates, latency and feature usage) to improve the Services. We do not use the content of your prompts to train our own models; if that ever changes, we will update this Policy and the Terms of Service before it does.

Dictating a prompt with the microphone. The prompt box in the web app has a microphone button. Nothing is recorded until you press it, and the first time you do, your browser asks you for microphone permission. While a recording is running you see a live audio indicator in place of the prompt box, so it is always visible that the microphone is on. There is no wake word, no background listening and no recording at any other time.

You then choose what happens to the recording. If you cancel it, the audio is discarded on your device and never leaves it. If you finish it, the audio is sent to our transcription provider, OpenAI, which returns the text; the text lands in the prompt box for you to edit or delete before you send it, and once you send it, it is handled like any other prompt.

We do not store the recording. It is not saved to your project, your history or our databases — it exists only for as long as the transcription request takes, and what we keep afterwards is the text. Our provider may hold a copy for a limited period for abuse monitoring under its standard terms; we do not currently have zero-retention terms in place for this feature.

The audio is used to transcribe what was said, and for nothing else. We do not identify or verify people by their voice, we do not analyse tone or emotion, and neither we nor our provider uses your recordings to train models. Because the microphone records everything within range, please do not record other people without their agreement, and treat a recording the way you would treat anything else you type into a prompt.

Our team may also read your prompts and look at your project when helping you — either because you asked us to, or as part of the proactive assistance described in Section 5. Access is limited to the people doing that work. If we come across anything in your project that goes beyond what we need to help you, we do not use it, copy it or record it.

Because output is generated from what you submit, please do not enter sensitive personal data, other people’s personal data you are not entitled to share, or confidential information into prompts. We do not seek or knowingly use such information, and we apply measures intended to avoid reproducing it, but we cannot guarantee that information you include in an input will not appear in the output. This section should be read together with the Terms of Service and Acceptable Use Policy.

10. Automated decision-making

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing within the meaning of Article 22 GDPR. Our AI features generate content at your request but do not make such decisions about you.

11. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this Policy, or longer where the law requires (for example, accounting and tax records). Indicative retention periods:

12. How we protect your data

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, multi-factor authentication for staff access, role-based and least-privilege access controls, audit logging, environment separation, regular access reviews, encrypted backups with restore testing, and a documented incident-response process with 72-hour breach notification to the supervisory authority where required.

13. Children

The Services are not directed to children. You must be at least 18, or have the consent of your legal guardian, to use the Services, as set out in the Terms of Service. We do not knowingly collect personal data from children.

14. Information for United States residents

If you are a resident of a U.S. state with a comprehensive privacy law (such as California under the CCPA/CPRA), the following applies in addition to the rest of this Policy. We collect the categories of personal information described in Section 3 (identifiers, account and commercial information, internet/usage activity, and inputs you provide). We use it for the business purposes described above.

We do not “sell” personal information for money. We may “share” personal information for cross-context behavioural advertising through advertising cookies (e.g. Meta, Google, X); you can opt out at any time through our user cookie settings. Subject to your state’s law, you may have the right to know, access, correct and delete your personal information, to opt out of sale/sharing and certain profiling, and to be free from discrimination for exercising these rights. To exercise them, contact [email protected]. You may use an authorised agent; where you do, we may require written proof of the agent's authority and may verify your identity with you directly before acting on the request.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Site and update the “Last updated” date above, and where changes are material we will notify you by email or in-app. If we ever intend to change how we use your data for training our own systems, we will update this Policy and the Terms of Service before doing so.

16. How to contact us

• Company: BuildingPP OÜ (registry code 17224732)

• Address: Laulupeo tn 3-2, Tallinn, 10121, Estonia

• Privacy enquiries and rights requests: [email protected]

• General support: [email protected]

• United Kingdom: we are in the process of appointing a UK representative under Article 27 UK GDPR. Until the appointment is complete, please contact us directly about UK matters at [email protected]; we will update this Policy with the representative's name and address once appointed.