Privacy Policy

1. Who we are

1.1 Build Intelligence Group, LLC, a Texas limited liability company of 5900 Balcones Drive, Suite 100, Austin, TX 78731, trading as Build IG ("we", "us").

1.2 Privacy contact: privacy@buildig.ai. We have not appointed a Data Protection Officer; privacy enquiries are handled by our privacy contact at that address.

1.3 EU and UK representatives (GDPR and UK GDPR Article 27). Where the GDPR or the UK GDPR applies to our processing, we apply the standards described in this policy. Where we act as a controller of personal information about individuals located in the European Economic Area or the United Kingdom — for example the account contacts of a client established there — this policy governs that processing. Where we process personal data as a processor for a client, the Data Processing Addendum governs it. Where we are required to appoint a representative under Article 27, we will appoint one and name it in this clause. Enquiries may be addressed to us directly at privacy@buildig.ai, from any jurisdiction.

1.4 Business contacts are covered. Under the California Consumer Privacy Act, information about individuals acting in a business capacity — a customer's or prospect's work name, email, title and employer — is personal information, and those individuals have full rights under that Act. The temporary exemption for business-to-business data expired on 1 January 2023. Because Build IG sells only to businesses, most of the personal information we hold as a controller is business contact information, and it is fully in scope. Where this policy describes your rights under California law, those rights apply to you even though your relationship with us is a business one.

2. What we collect, why, and for how long

2.1 The table below is also our notice at collection. Where we collect information directly from you online, this table is linked at or before the point of collection.

2.2 Sensitive information. We do not seek and do not knowingly collect sensitive personal information, special category data under GDPR Article 9, or government identifiers. We do not use or disclose sensitive personal information for any purpose other than those permitted by 11 CCR §7027(m), and we do not use it to infer characteristics. Accordingly we are not required to offer, and do not offer, a separate "Limit the Use of My Sensitive Personal Information" link.

2.3 Where a legitimate interest is relied on, the specific interests are: keeping the Platform secure and available; diagnosing and fixing faults; understanding which features are used so we can improve them; preventing fraud and misuse; and communicating with existing business customers about the service they buy. We balance these against your interests and rights, and you may object under clause 7.

2.4 Providing information. Account and billing information is required to enter into and perform our contract with your organisation. If it is not provided, we cannot provide the Platform. Everything else is optional.

2.5 Information obtained indirectly. Where we obtain personal information about you from a source other than you — from your employer's account administrator, or from public and commercial screening sources — the categories, sources, purposes, legal bases, recipients and retention periods are those shown in the table at clause 2.1. We will provide this notice within one month of obtaining the information, or at our first communication with you, whichever is earlier.

2.6 Right to object. Where we rely on legitimate interests, you have the right to object to that processing at any time on grounds relating to your particular situation, and to object at any time and without reason to processing for direct marketing. Contact privacy@buildig.ai. This right is also set out at clause 7.1.

2.7 No automated decision-making. We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not use automated decision-making technology to make significant decisions as defined in the California regulations.

3. Who we share it with

3.1 We share personal information with the categories of recipients below. We maintain a current list of subprocessors, with their function and location, at buildig.ai/subprocessors, and you can subscribe there for notice of changes.

3.2 Where a recipient processes personal information on our behalf, as a processor or service provider, we require it by contract to process that information only for authorised purposes, to keep it confidential, to protect it with appropriate security and to comply with applicable data protection law. Other recipients listed above — including our professional advisers, insurers, authorities and courts, and any acquirer or successor — may process personal information as independent controllers where that is appropriate to their role or required by law, and their own obligations apply to that processing.

4. Sale, sharing and advertising

4.1 We do not sell personal information, and we have not sold personal information in the preceding twelve months. We have no actual knowledge of selling or sharing the personal information of any person under 16.

4.2 "Sharing" for cross-context behavioural advertising. Disclosing identifiers to an advertising partner for cross-context behavioural advertising is "sharing" under California law even though no money changes hands. We have not shared personal information for cross-context behavioural advertising in the preceding twelve months. If that changes we will update this policy before doing so, and in any event we:

• (a) will obtain your consent through our cookie banner before setting any advertising cookie;
• (b) will publish a "Your Privacy Choices" link, with the required opt-out icon, in the footer of every page, from which you can opt out of sharing; and
• (c) honour opt-out preference signals, including Global Privacy Control (GPC), as a valid opt-out of sale and sharing for the browser and, where you are signed in, for your account. We honour GPC now, whether or not we share.

4.3 The Platform functions normally without advertising cookies. If we ever use them and you would prefer we did not, decline them in the banner or send a GPC signal.

5. Cookies

5.1 We use strictly necessary cookies for authentication, session management and security; preference cookies to remember your settings; analytics cookies to measure performance; and, where you consent, advertising and remarketing cookies. Strictly necessary cookies are set without consent because the service cannot work without them.

5.2 You can manage your choices at any time through the cookie preferences link in our footer, or through your browser. Full details, including the specific cookies, their purposes and their lifespans, are in our Cookie Notice at buildig.ai/cookies.

6. International transfers

6.1 We are established in the United States, and personal information is processed there and in other countries where our subprocessors operate. The subprocessor list identifies each location.

6.2 For transfers of personal data out of the European Economic Area, the United Kingdom or Switzerland for which we are responsible as a controller, we rely on the safeguards below. Where we act as a processor for a client, the transfer mechanisms in clause 12 of the Data Processing Addendum apply instead. Personal information is processed in the United States and in the other countries where our subprocessors operate, wherever the individual is located. The safeguards are:

• (a) the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, together with a documented transfer impact assessment;
• (b) for the United Kingdom, the ICO's International Data Transfer Addendum, incorporated with the automatic-update mechanism in section 18 elected, so that it updates as the ICO revises it; and
• (c) where relevant, our certification under the EU–US Data Privacy Framework and its UK extension. We do not rely on that certification alone; the Standard Contractual Clauses stand as an independent transfer mechanism regardless of the Framework's status.

6.3 You may obtain a copy of the safeguards we rely on — including the executed Standard Contractual Clauses, with commercial terms redacted — by emailing privacy@buildig.ai.

6.4 If the European Commission adopts a further set of standard contractual clauses applicable to our transfers, we will adopt them within the period the Commission allows.

7. Your rights

7.1 Depending on where you are, you may have the rights below. We do not discriminate against anyone for exercising them.

7.2 How to exercise them. Email privacy@buildig.ai, or use the privacy controls in your account. For opt-out of sharing, use the "Your Privacy Choices" link in our footer or send a GPC signal.

7.3 Verification. We verify requests by matching the request against information we already hold — normally the email address on the account, plus at least two additional data points for a request to know or delete. We may ask for further information where the request is high risk. We do not use information provided for verification for any other purpose.

7.4 Authorised agents. An authorised agent may make a request on your behalf with written authorisation signed by you, or a power of attorney. We may contact you to confirm the authorisation and to verify your identity directly.

7.5 Timing. We respond within 45 days for requests under US state laws, extendable once by a further 45 days where reasonably necessary, and within one month for requests under GDPR or UK GDPR, extendable by two further months for complex requests. We will tell you if we need an extension and why.

7.6 Appeals. If we refuse your request, you may appeal. Reply to our decision, or email privacy@buildig.ai with the subject line "Privacy Request Appeal". Appeals are reviewed by someone who was not involved in the original decision. We will respond to an appeal within 45 days, or within 60 days where your state allows a longer period — which includes Virginia, Connecticut, Texas, Montana and Delaware — explaining our reasoning in writing. If we deny your appeal, we will provide you with a means of contacting your state Attorney General to submit a complaint. If you are in the EEA, the UK or Switzerland, you may lodge a complaint with the supervisory authority in your country of residence, place of work or the place of the alleged infringement.

8. Communications and SMS

8.1 Email. We send you service and transactional messages about your account, which you cannot opt out of while the account is open. We send marketing email only where you have opted in or where you are an existing business customer and we are telling you about the service you buy. Every marketing email has an unsubscribe link.

8.2 Transactional SMS. If you give us a mobile number, we may send transactional messages relating to your use of the Platform — authentication codes, security alerts and service notices. Message frequency varies. Message and data rates may apply.

8.3 Marketing SMS. We do not send marketing or promotional text messages unless you have given prior express written consent through a separate, unbundled opt-in that identifies us by name, states that consent is not a condition of purchase, and discloses message frequency. Providing your phone number for an account or a purchase is not consent to marketing messages.

8.4 Stopping messages. Reply STOP to any message to opt out — and we also treat quit, end, revoke, opt out, cancel and unsubscribe, or any other reasonable expression of the same intent, in any reasonable channel, as a valid opt-out. We honour opt-outs as soon as practicable and in any event within 10 business days. Reply HELP for help, or email support@buildig.ai.

8.5 We do not sell, rent or share mobile numbers or SMS consent with third parties or affiliates for their marketing purposes.

9. Model training

9.1 We do not use personal information to train machine learning models. That applies both to the personal information described in this policy and to any personal information contained in documents our customers upload. See clause 9.6(c) of the Master Services Agreement and clause 3.4 of the Data Processing Addendum.

9.2 We do train on our own platform outputs, on the corrections our users make to them, and on de-identified data derived from jobs — none of which identifies a person. Where a customer has told us that drawings are their own, we may train on those drawings; material identified as authored by a third party is excluded by default. This is governed by clauses 9.3 to 9.6 of the Master Services Agreement, not by this policy.

9.3 Your corrections and ratings. When you correct or rate an output, we use that correction to improve the Platform. Where a correction is linked to your user account it is personal information, and we process it on the basis of our legitimate interests, Art 6(1)(f) — improving a service you use — and retain it for the life of the account plus 24 months. We do not use it to evaluate you. Before a correction is used as model-training material, we remove the personal information associated with it and apply technical and organisational measures so that the training material does not identify you and is not reasonably capable of being associated with you. No personal information is retained in, or derivable from, any model.

9.4 We publish a summary of the data used to train our models, in the form required by California's AB 2013, at buildig.ai/training-data.

10. Security

10.1 We use encryption in transit and at rest, role-based access control, least-privilege administration, audit logging, secure cloud infrastructure, and periodic security testing and access reviews.

10.2 No system is completely secure. You are responsible for keeping your credentials confidential and for telling us promptly at security@buildig.ai if you suspect unauthorised access.

11. Children

11.1 The Platform is for business use by adults. It is not directed at anyone under 18 and we do not knowingly collect information from anyone under 18. If we learn we have, we delete it.

12. Third-party sites

12.1 Our website and Platform may link to third-party sites and tools. We are not responsible for their privacy practices. Read their notices before using them.

13. Changes

13.1 We may update this policy. Where a change is material — meaning it changes the categories we collect, the purposes, the recipients, the retention periods or your rights — we will notify you by email or in-product at least 30 days before it takes effect. For other changes we will update the date at the top. We keep dated previous versions at buildig.ai/privacy/archive.

14. Contact

14.1 Build Intelligence Group, LLC, 5900 Balcones Drive, Suite 100, Austin, TX 78731. privacy@buildig.ai. EU and UK Article 27 representatives, where required, are named in clause 1.3.