Last updated: September 2026 · Applies to: getbuildstack.co.uk
Caradon AI Ltd (trading as BuildStack), registered in England and Wales (company number 16701624), registered address 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, operates the BuildStack platform at getbuildstack.co.uk. We are the data controller for the personal data described in this policy.
Contact: support@getbuildstack.co.uk
Account data: When you register, we collect your name, email address, company name, and role or job title. This information is used to identify you and personalise your documents.
Project data: Data you enter into BuildStack including property addresses, client names, defect descriptions, site notes, and site photographs.
Payment data: Payments are processed by Stripe. BuildStack does not store or have access to your card details. Stripe may retain payment data in accordance with their own privacy policy.
Usage data: Information about how you use the platform, including pages visited, features used, and actions taken. This helps us improve the service.
We do not sell your data to third parties. We do not use your data for advertising or share it with third parties except as described in this policy.
Your data is stored on secure, encrypted servers. We use industry-standard security practices including encrypted data at rest, HTTPS for all data in transit, and access controls to limit who can access production systems.
You retain ownership of all data and content you enter into BuildStack.
Stripe - payment processing. When you make a payment, you interact with Stripe's infrastructure. See stripe.com/privacy.
Anthropic - AI analysis. When you run AI analysis on a defect, the defect description, site notes, and any photos you have attached are sent to Anthropic's API to generate a response. This data is processed in accordance with Anthropic's privacy policy. See anthropic.com/privacy. You should not include sensitive personal data about third parties in defect descriptions submitted for AI analysis.
Railway - application hosting and data storage. The BuildStack application and database run on Railway cloud infrastructure in the US East region. Project data and issue logs are stored there, encrypted in transit (TLS) and at rest. Railway is based in the United States. See railway.app/legal/privacy.
Cloudflare R2 - photograph storage. Site photographs you upload are stored on Cloudflare R2 object storage with private access controls. Photographs are not publicly accessible. See cloudflare.com/privacypolicy.
Sentry - error monitoring and performance tracking. Sentry receives JavaScript error reports and page performance data (load times, navigation, API response timings) to help us identify and fix bugs. See sentry.io/privacy.
Vercel Web Analytics - website analytics. Vercel Web Analytics collects aggregate, anonymised page-view data (page visited, referrer, browser, country) to help us understand site traffic. It is cookieless and does not track individual users or set cookies. See vercel.com/docs/analytics/privacy-policy.
PostHog - product analytics for signed-in users. PostHog records which features are used and when, to help us understand how the platform is being used and improve it. It runs only when you are signed in - it does not run on the public website. Alongside each event, PostHog automatically collects your IP address, browser and operating system, referring page, and the page within the application where the action occurred. It identifies you by your account number and subscription plan only. It does not receive your name, email address, or any project data including property addresses, client names, defect descriptions, or photographs. Data is held in the EU - PostHog Cloud EU stores data in Germany. See posthog.com/privacy and posthog.com/subprocessors.
Under the UK GDPR you have the right to:
To exercise any of these rights, contact us at support@getbuildstack.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Your data is retained for as long as your account is active. If you delete your account, your personal data and project data will be deleted within 30 days. Some data may be retained beyond this period where required for legal, financial, or fraud-prevention purposes (for example, transaction records for VAT or tax compliance).
We use an essential authentication cookie (bs_token) to keep you logged in while you use the platform. When you are signed in, PostHog also sets cookies for product analytics, as described in Section 5. The public website is cookieless - no cookies are set for visitors who are not signed in. We do not use advertising cookies.
We may update this policy from time to time. Changes will be posted at this URL with an updated date. Continued use of BuildStack after changes are posted constitutes acceptance of the updated policy. Where changes are material, we will notify you by email.
Questions about this policy or how we handle your data: support@getbuildstack.co.uk
Caradon AI Ltd (trading as BuildStack) · Company No. 16701624 · 71-75 Shelton Street, Covent Garden, London WC2H 9JQ · getbuildstack.co.uk · This policy is governed by the laws of England and Wales