Privacy Policy

uBuilt (“uBuilt”, “we”, “us”) is a small software consultancy. We take applications built with AI tools - Lovable, Replit, Base44, Claude Code, Bubble, Supabase - and make them production ready. This site, ubuilt.app, is our marketing site and the way new work reaches us.

For information collected through this site, uBuilt is the data controller: we decide what is collected and why. When we later work inside a client’s systems under a signed statement of work, we normally act as a processor on that client’s behalf, and the data-processing terms of that engagement govern that work rather than this policy.

You can reach a human about anything in this policy at hello@ubuilt.app.

This policy applies to:

• The pages of ubuilt.app.
• The contact form at /contact and the emails we send in reply to it.
• Server and analytics data generated when you visit the site.

It does not cover:

• Third-party sites we link to, including builder platforms and cloud providers, which have their own policies.
• Data inside your application while we work on it under an engagement. That is governed by the statement of work and any data-processing agreement signed with it.
• Your account with Lovable, Replit, Base44, Bubble, Supabase, or any other platform.

When you submit the form at /contact, we receive exactly the fields you filled in:

• Name - so we know who we are replying to.
• Email address - the only field we genuinely need, because it is where the reply goes.
• Company or project name - optional, and used only for context.
• Your message - including anything you paste into it, such as repository links, stack descriptions, error output, or screenshots of a failure.
• Plan selection - which plan you arrived from, if you followed a pricing link such as a one-time project, growth, or scale plan.
• Platform selection - the builder your app was made with, if you chose one.

We do not ask for payment card details, government identifiers, health information, or any other special-category data through this site. If a form field ever appears to ask for one, do not fill it in and tell us.

Please do not paste secrets into the message field. API keys, Supabase service-role keys, database URLs with passwords in them, and .env contents all end up in an email inbox, which is not a secrets manager. If you send one by accident, tell us: we will delete the message and ask you to rotate the credential. When an engagement starts we set up a proper channel for credentials.

The contact form does not write to a database on our side. When you submit it, our server hands the content to Resend, our transactional email provider, which sends two messages:

• A confirmation to the address you entered, so you have a record of what you sent.
• A notification to our team inbox, which is where we actually read and answer it.

From that point the submission lives in our email systems - the team mailbox, our sent items once we reply, and Resend’s delivery logs for the limited window that provider retains them. It is not copied into a CRM, a marketing automation tool, or an advertising audience. We do not add you to a mailing list because you used the contact form; if we ever run one, it will be opt-in and separate.

Visiting the site generates a small amount of data without you typing anything:

• Analytics. We use Vercel Analytics, a privacy-oriented, aggregate measurement tool. It records things like the page path, the referring site, an approximate country, and the device and browser class. It does not set advertising cookies, does not follow you to other sites, and does not build an advertising profile. We use it to see which pages are read and which are ignored.
• Request logs. Our host records standard web-server information for each request: IP address, user agent, URL, timestamp, and response status. These logs exist for security, abuse prevention, and debugging, and they age out on a short retention window.
• Abuse controls. The contact endpoint is rate limited. Enforcing that may involve holding a hashed or short-lived record of a requesting IP address so one visitor cannot flood the form.

This site does not run advertising cookies, cross-site trackers, remarketing pixels, or social media tracking widgets. There is no ad network on ubuilt.app and nothing here feeds one.

Any cookie or local-storage value the site sets is strictly necessary - for example, keeping a security token consistent for a form submission. Because we do not run non-essential tracking cookies, you will not see a consent banner demanding a choice you did not need to make.

You can still block or clear cookies in your browser settings. Doing so may stop the contact form from submitting, but the rest of the site will work normally.

We use what we collect only for these purposes:

• To read your enquiry, reply to it, and arrange a call.
• To scope and quote work - which means the message you send may be discussed internally and referenced in a proposal or statement of work written for you.
• To send the confirmation email that follows a form submission.
• To keep the site available, secure, and debuggable, and to investigate abuse.
• To understand in aggregate which pages are useful, so we write more of what helps.
• To meet legal, accounting, and tax obligations once an engagement is under way.

We do not sell your personal information. We do not share it with advertisers or data brokers, we do not use it for cross-context behavioural advertising, and we do not use the contents of your enquiry to train machine-learning models.

If you are in the UK or the European Economic Area, we rely on the following legal bases:

• Steps prior to entering a contract. Responding to an enquiry, scoping the work, and preparing a quote at your request.
• Legitimate interests. Running and securing the site, preventing abuse of the contact form, and measuring page views in aggregate. We have considered these against your rights and kept the data collection minimal as a result.
• Legal obligation. Keeping contract, invoice, and tax records for the period the law requires.
• Consent. Where consent is required - for example, if we ever add an opt-in newsletter. You can withdraw consent at any time without affecting processing that already happened.

We keep the list of third parties deliberately short. Each one processes data on our instructions under a written agreement, and none of them is permitted to use your information for their own marketing.

• Vercel - hosting, content delivery, request logs, and Vercel Analytics for this site. United States, with a global edge network.
• Resend - transactional email delivery for the confirmation and notification messages generated by the contact form. United States.
• Our business email provider - hosts the mailbox where enquiries land and where our replies are stored.
• Professional advisers and authorities - accountants, insurers, or lawyers where genuinely needed, and regulators or courts where we are legally required to disclose.

If uBuilt is ever involved in a merger, acquisition, or sale of assets, your information could transfer as part of that. We would tell you before it happened and the receiving party would be bound by terms no less protective than these.

Our providers operate in the United States and route traffic through edge locations worldwide, so information collected through this site may be processed outside your home country, including outside the UK and the EEA.

Where personal data leaves the UK or the EEA, we rely on the transfer mechanisms in our providers’ data-processing agreements - Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision where one applies. You can ask us which mechanism covers a specific provider and we will tell you.

We keep information for as long as it is useful for the purpose it was collected for, and then delete it.

• Enquiries that do not become engagements. Kept in the mailbox for up to 24 months, so we have context if you come back, then deleted.
• Enquiries that become engagements. Kept for the life of the engagement and then for the period we are required to retain contract and tax records, typically six years after the final invoice.
• Email delivery logs. Retained by our email provider for the limited window that provider defines, measured in days rather than years.
• Web server logs. Short retention, typically days to a few weeks, then rotated out.
• Analytics. Held in aggregate form only. It is not tied to a person and is not something we can retrieve “your” copy of.

You can ask us to delete an enquiry earlier than these periods - see your rights below.

We are a security-and-reliability consultancy, so it would be awkward to be careless with this. In practice:

• The site is served over HTTPS, so form submissions are encrypted in transit.
• API keys for the site live in a managed environment-variable store, never in the repository and never in the client bundle.
• Access to the enquiry mailbox is limited to the people who need it, with multi-factor authentication required.
• When an engagement begins we ask for the least access that will do the job - read-only and time-limited where possible - and we hand credentials back or have them rotated at the end.
• Dependencies for this site are patched on a regular cadence.

No system is perfectly secure. If a breach affects your personal information we will tell you promptly and plainly, and we will notify the relevant supervisory authority within the time limits that apply to us.

If the UK GDPR or EU GDPR applies to you, you have the right to:

• Access - get a copy of the personal data we hold about you.
• Rectification - have inaccurate or incomplete data corrected.
• Erasure - have your data deleted where we have no overriding reason to keep it.
• Restriction - ask us to pause processing while a dispute is resolved.
• Portability - receive the data you gave us in a structured, machine-readable format.
• Objection - object to processing we base on legitimate interests, including direct marketing, which we will stop on request without argument.
• Withdraw consent - where processing is based on consent.

To exercise any of these, email hello@ubuilt.app with “Privacy request” in the subject line. We respond within one month. There is no charge. We may ask a question or two to confirm you are the person the data belongs to, which is a protection for you rather than an obstacle.

You also have the right to complain to a supervisory authority - the Information Commissioner’s Office in the UK, or your national data protection authority in the EEA. We would rather you raised it with us first, but that choice is yours.

If you are a California resident, the CCPA as amended by the CPRA gives you specific rights. In the last twelve months we have collected the categories described in sections 3 and 5 above - identifiers (name, email, company) and internet or network activity (page views, request logs) - for the business purposes described in section 7. We collected them from you directly and from the ordinary operation of the site.

• Right to know what personal information we collect, use, and disclose, and to receive a copy of it.
• Right to delete personal information we hold, subject to legal exceptions such as tax records.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of - but you may ask us to confirm that in writing.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information through this site.
• Right to non-discrimination for exercising any of the above. Nothing about our service or pricing changes because you made a request.

Send requests to hello@ubuilt.app. An authorised agent may submit a request on your behalf with written proof of authorisation.

We do not make decisions about you by automated means that produce legal or similarly significant effects. A person reads every enquiry.

We also do not feed the contents of your enquiry, your codebase, or your data into machine-learning training. We use AI tooling in our engineering work, and when we do, it is under configurations that exclude client content from training. If a specific tool is not acceptable to you, say so at the start of an engagement and we will work around it.

ubuilt.app is a business-to-business site and is not directed at children. We do not knowingly collect personal information from anyone under 16, and we have no feature that would ask for it.

If you believe a child has submitted information through the contact form, email hello@ubuilt.app and we will delete it.

We update this policy when what we do changes - a new processor, a new form field, a new retention period. The “Last updated” date at the top of the page always reflects the current version.

If a change materially affects how we handle information you have already given us, we will say so at the top of this page and, where we have your email address and the change warrants it, tell you directly rather than relying on you to re-read the page.

Questions, requests, and complaints about privacy all go to the same place: hello@ubuilt.app. Put “Privacy request” in the subject line if you are exercising a right, so it is routed correctly.

If you would rather talk it through, book a call through our contact page and say what it is about.