Privacy Policy
Version 2026-09-29 — effective 29/09/2026
This policy explains how [to be completed: company legal name] ("Buildano", "we") processes personal data, in accordance with Regulation (EU) 2016/679 (the GDPR), Cyprus Law 125(I)/2018, Greek Law 4624/2019, and the laws on electronic communications (Cyprus Law 112(I)/2004, Greek Law 3471/2006).
1. Who is responsible
Controller: [to be completed: company legal name], [to be completed: registered office address], registration number [to be completed: company registration number].
Contact for data protection: info@buildano.eu. We have not appointed a Data Protection Officer because the GDPR does not require one for our activities; the contact above handles all privacy requests.
2. Two different roles
- We are the controller for the data of our customers' users (people who sign in to Buildano as office users), for billing, for security and support, and for visitors to our own website and sign-up pages. This policy covers that processing.
- We are a processor for the data our customers (builders) put into Buildano about their clients, subcontractors, suppliers, website-calculator visitors and projects. For that data the builder is the controller and decides why and how it is processed; we process it only on the builder's instructions under our Data Processing Agreement. If you are a builder's client or contributor, please read section 11 and contact the builder first.
3. What we collect and why
| Data | Purpose | Legal basis (GDPR art. 6(1)) |
|---|---|---|
| Account data: name (optional), email, password (stored only as a bcrypt hash), role, the company you belong to | Create and run your account, sign you in, let owners manage the team | (b) contract; for users added by an owner: (f) our and the customer's legitimate interest in providing the service the customer ordered |
| Company data: company name, country, VAT number, address and settings entered by owners | Provide the Service, show the right tax features | (b) contract |
| Subscription and billing data: plan, trial and subscription status, amounts, invoice references, Stripe customer ID. Card details are handled only by Stripe/Link, never by us | Manage subscriptions, bookkeeping, tax compliance | (b) contract; (c) legal obligation (tax and accounting law) |
| Security and technical data: IP address, browser/user-agent, sign-in times and failed attempts, one-time link tokens (stored hashed), request logs kept by our hosting provider | Keep accounts and the Service secure, prevent abuse and fraud, investigate incidents | (f) legitimate interest in security; (c) GDPR art. 32 |
| Acceptance records: which version of our Terms and Privacy Policy was accepted, when, from which IP address and browser | Prove the contract and our compliance | (b) contract; (c) accountability, GDPR art. 5(2); (f) establishing legal claims |
| Email-verification and password-reset data | Confirm your address, let you recover access | (b) contract; (f) security |
| Support communications: your emails and our replies | Answer questions, fix problems | (b) contract; (f) legitimate interest in good service |
| AI add-on usage metering: time, model and amount of text processed (not the content) | Bill and limit AI usage fairly | (b) contract |
| Service notices: emails about your account, security, billing and material changes | Inform you as required | (b) contract; (c) legal obligation |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects (GDPR art. 22).
We do not currently send marketing emails. If we start, we will send them to customers only about similar products of our own, with an easy opt-out in every message, or otherwise only with your consent, as required by section 106 of Cyprus Law 112(I)/2004 and article 11 of Greek Law 3471/2006.
Where legitimate interest is the basis, we have balanced our interest against your rights. You can object at any time (section 8).
Is providing data required? Email and password are necessary to create an account; without them we cannot provide the Service. Other fields are optional.
4. Where the data comes from
Mostly from you. If an owner of your company adds you as a user, the owner gives us your email and role. Stripe/Link tells us the status of payments and subscriptions. Our hosting provider records technical logs when you use the Service.
5. Who receives the data
- Our sub-processors, who help us run the Service under data-processing contracts and only on our instructions — hosting, database, email delivery, AI (only if the AI add-on is used), and weather data. The current list, with locations and transfer safeguards, is on our Sub-processors page.
- Stripe (Link) as merchant of record processes payment and billing data as an independent controller under its own privacy policy.
- Other users of your company's Account see your name/email and your activity within the Account.
- Public authorities, courts and auditors, only where the law requires it or to establish, exercise or defend legal claims.
- Professional advisers (lawyers, accountants) bound by confidentiality.
- A buyer or successor of our business, under confidentiality, if the business or its assets are transferred.
6. International transfers
Our main hosting and database run in the United Kingdom (London region) and some providers are established in the United States. Transfers outside the European Economic Area take place only:
- to countries with an adequacy decision of the European Commission — such as the United Kingdom, Switzerland, and U.S. companies certified under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); or
- under the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, together with supplementary measures where needed.
The safeguard used for each provider is shown on the Sub-processors page. You can ask us for a copy of the relevant safeguards at info@buildano.eu.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and company data | While the Account exists, then for the 30-day retrieval period after closure, then deleted from live systems; from backups within 90 more days |
| Users removed by an owner | Deleted when removed (unless they belong to another company account) |
| Billing and subscription records | At least 6 years from the end of the tax year concerned (Cyprus tax legislation) and for any longer period required in Greece or elsewhere (for Greece, generally 5 years under Law 4308/2014, longer in the cases the law provides) |
| Acceptance records | For the duration of the agreement and afterwards until related claims are time-barred (generally 6 years) |
| Password-reset and verification tokens | Expire after 1 hour / 48 hours; deleted with the account |
| Security logs held by our hosting provider | Short-term, according to the provider's retention (typically days to a few weeks) |
| Support emails | Up to 3 years after the matter is closed |
8. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy (art. 15) — you can also download your account data yourself under Account settings;
- rectify inaccurate data (art. 16);
- erasure (art. 17), where the data is no longer needed or processing is unlawful, subject to legal retention duties;
- restriction of processing (art. 18);
- data portability (art. 20) — receive data you provided in a machine-readable format;
- object at any time to processing based on legitimate interests (art. 21);
- withdraw consent at any time where processing is based on consent, without affecting earlier processing.
Send requests to info@buildano.eu. We may ask you to confirm your identity. We answer within one month; for complex requests this can be extended by two more months, and we will tell you why. Requests are free unless manifestly unfounded or excessive.
Right to complain. You can complain to a data-protection supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place. Our lead authority is the Commissioner for Personal Data Protection (Cyprus).
- Cyprus: Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia — www.dataprotection.gov.cy, commissioner@dataprotection.gov.cy
- Greece: Hellenic Data Protection Authority, 1–3 Kifisias Avenue, 115 23 Athens — www.dpa.gr, complaints@dpa.gr
We would appreciate the chance to address your concern first.
9. Security
We protect data with measures appropriate to the risk (GDPR art. 32), including: encrypted connections (TLS); passwords stored only as salted bcrypt hashes; one-time links stored only as hashes; encryption of stored tax-authority credentials (AES-256-GCM); strict separation between customer accounts, checked on every request; role-based permissions; rate-limiting of sign-in and public forms; hosting and database in the United Kingdom with providers that hold recognised security certifications; backups; and access to production limited to authorised personnel. If a personal-data breach is likely to result in a high risk to you, we will inform you without undue delay.
10. Cookies
We use only cookies that are strictly necessary and, if you allow them, preference cookies. We use no advertising or analytics trackers. See our Cookie Policy.
11. If you are a builder's client, contributor or lead
If you use a builder's client portal or contributor area, or send a request through a builder's website calculator, the builder is responsible (controller) for your personal data, and Buildano processes it on the builder's behalf. The builder's own privacy notice applies; where the builder has provided a link, it is shown on the portal and calculator pages. Please address requests to the builder. If you contact us, we will forward your request to the builder and assist them in answering it. The portal records quote and change acceptances (name, time, IP address and browser) on the builder's behalf as evidence of the agreement.
12. Children
Buildano is a service for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.
13. Changes
We will publish any change to this policy here, with a new version date. If the change is material, we will also inform account owners by email or in the Service before it takes effect.