Privacy Policy

In short

This policy covers the Biilda desktop app, biilda.com, our cloud services, and the affiliate program. This summary is a convenience, not a substitute for the sections below — the full text is what governs, and where the two ever disagree, the full text wins.

• Biilda is local-first: your workflows, AI employees, tasks, skills, connector credentials, chat history, and generated files live on your own device and are not uploaded to us, except in the specific ways described below.
• To generate a reply, we relay the request you send to a third-party AI provider — Anthropic, OpenAI, or DeepSeek, depending on the quality tier you choose — and we do not keep the content of that request or the reply on our servers.
• While Biilda is in beta, we also collect activity records of your chat turns, task runs, self-coding builds, and app events, plus error reports when something fails, so we can fix problems and understand how Biilda is really being used — see Beta activity records and error reports.
• We hold an account, a credit balance, and usage records in the cloud, and Stripe — through its Link service — handles payment as merchant of record.
• This website uses analytics cookies only with your consent, which you can withdraw at any time.
• We do not sell your personal information.
• You have the right to access, correct, delete, and object to how we use your information — see Your rights.

Who we are

This policy is issued by Biilda AI Inc. (“Biilda”, “we”, “us”), North York, Ontario, Canada, the controller of the personal information described here. Our Privacy Officer — the accountable person for privacy under Canada’s federal law (PIPEDA) and Quebec’s Law 25 — can be reached at support@biilda.com. This policy covers biilda.com, the Biilda desktop app, our cloud services (sign-in, the AI relay, and your credit wallet), the affiliate program, and any support conversation you have with us. If something you run into isn’t answered here, that same address is the right place to ask.

What stays on your device

Biilda is built around a local-first architecture: almost everything you create lives only on your own computer.

We cannot access, restore, or delete any of this — it never travels to us in the first place. If your computer is lost, wiped, or the app is uninstalled, this data is gone, and we cannot recover it for you, because we never had it. Settings → Delete personal data (“Delete all my data…”) wipes everything in this table from the device and signs you out; it does not close your cloud account or touch the balance held there — sign back in any time to pick that back up.

This is a deliberate design choice, not an accident: Biilda is built so that the things you create — the employees, automations, and workflows that make up your business logic — belong to you and stay under your control, on hardware you own. The trade-off is that we cannot act as a safety net for local data the way a cloud product could; local version snapshots and file backups protect you against a mistake inside the app, but not against losing the machine itself.

Information we collect

We try to collect as little as we can get away with. The categories below cover everything we hold about you server-side; everything else you create inside Biilda falls under What stays on your device above and never reaches this list.

What you give us

An account: your email address and a hashed password, managed by our sign-in provider (Amazon Cognito); if you sign in with Google instead, we also receive the name on that account. A profile: whatever you tell us during onboarding, which may include your name, company, industry, role, team size, notes about your goals, how you found us, your country, region, and city, a referral code, and whether you opted in to marketing — along with the time you made that choice. Anything you send us directly, such as a support request or feedback.

What we collect automatically

Your credit balance, transaction history, and usage-metering records — which tier and provider handled a request, token counts, cost, and an id for the turn, run, or build, but never the content of what you asked. Your app version and operating system, sent as a version header on every cloud call. Your IP address, held briefly to enforce rate limits. A session id generated each time you launch the app, used only to group activity records from that session together.

Beta activity and error data

A separate, more detailed record of your activity and any failures — described fully in Beta activity records and error reports below.

What we receive from others

Google, if you use Google sign-in (your name and email address). Stripe, via its Link service, tells us whether a payment succeeded or failed and which pack you bought — never your card number. An affiliate’s referral code, if you arrived through one of their links. None of these third parties send us more than what’s needed to complete the thing you asked for — a sign-in, a payment, or crediting a referral.

How AI requests work

When you send a chat message, run a task, or ask Biilda to build something, your request leaves your device for our cloud relay, hosted on Amazon Web Services in the United States (us-east-1), which forwards it to the AI provider assigned to that tier and streams the response back to you. The relay itself stores none of that content — no prompt, no reply, no attachment — only which tier and provider handled the call, token counts, cost, and an identifier for the turn. We never send the provider anything that identifies your Biilda account; the request carries no name, email, or account id.

Attachments travel with the request the same way: a short text file, capped at 256KB, is sent inline; a PDF or image up to 3.5MB is sent as a native document or image attachment; text from a Word or Excel file is extracted on your device first and only the extracted text is sent. None of these are retained by our relay either.

Which provider handles your request depends only on the quality tier you pick — Economy, Balanced, or Best — never a specific model you choose; we keep the underlying models backend-only so we can change them without disrupting you. Here is what each provider currently handles, and what each has published about training on and retaining API data:

We read these statements conservatively and repeat only what each provider currently publishes; a provider’s own policy governs its own handling of your request once it reaches them, and any of them may change its policy. Where a provider’s language is qualified (for example, DeepSeek’s), we have not softened it.

Before each Chat turn, Biilda also runs a short classification step that decides how to route your request — as a question, a live configuration change, or a new feature build. That step sends the full text of your message, together with recent turns from that conversation for context, to the Economy-tier provider — currently DeepSeek — even though the reply itself is generated at the Balanced tier. It carries no account identifier, and the relay does not store it.

In Chat, every request currently runs at the Balanced tier. For a task you build, you choose the tier it runs at, and that choice determines which provider handles it, using the same table above. We keep the underlying provider assignment for each tier under our own control, so we can add a provider, retire one, or move a tier between them without asking you to change anything about how you use Biilda.

Connected Services

Biilda connects to the services you already use — email, a calendar, a shared drive, a project board, a chat app — and, wherever the provider supports it, connects through OAuth rather than asking you to hand over a password or an API key by hand. You choose what to connect and when, and you can disconnect a service at any time from the Connectors tab.

The credentials for a connection are stored only on your device, in your operating system’s secure storage, exactly like every other secret described above. When you direct Biilda to read or act on that service, the content involved is processed on your device and sent to the AI provider as part of your request, the same way anything you type is — see How AI requests work above.

Biilda’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

One connector works differently: Trello is relayed through Biilda’s own cloud (mcp.biilda.com) rather than talking to Trello directly from your device. We do not store what passes through that relay, and your Trello token is held there only in encrypted form (AWS KMS) for the moment it takes to forward your request. Every other connector, including every Google connector, talks directly from your device to the vendor.

If you connect Slack, the Slack app involved is your own — one you create and install into your own workspace, not an app we operate. We never see your Slack messages except the specific content a task or employee you built reads or sends through that connection, in the ordinary course of doing what you asked it to do. Content pulled in from any Connected Service can also appear in the beta activity records described next, if it forms part of a chat turn, task run, or build we capture.

Disconnecting a service removes its stored credential from your device and stops any automation from reaching it going forward; it does not retroactively remove content from activity records already uploaded under the next section, or from replies already generated using that content.

Beta activity records and error reports

Biilda is in beta, and this is the clause we want you to actually read rather than skim.

What is captured

For a completed chat turn: your prompt and Biilda’s reply, each capped at 16KB, and the last 30 tool steps from that turn, with each field of a step capped at roughly 1,500 characters. For a task run: the task’s instructions and the run’s summary, on the same caps. For a self-coding build: its status and cost. For a handful of app events: opening a tab, creating, updating, or removing a configuration entry, and opening or closing the app. When something fails, we separately assemble an error report covering the last 8 messages of the conversation, up to 15 tool steps, 15 surrounding lines of our own diagnostic logs, and timing information for what ran.

Redaction — what is removed, and what is not

Before any of this leaves your device, it passes through automatic redaction: authorization headers, API keys, tokens, passwords, and long hex- or base64-looking strings are stripped from every field, and the raw contents of anything a file tool read or wrote are replaced with a placeholder. This redaction pass always runs — it does not depend on any setting.

Redaction is not the same as removing your personal data. Ordinary text in your prompts and Biilda’s replies is not redacted, and neither is content that comes back from a Connected Service, such as the body of an email a connector read on your behalf. If you paste something sensitive into chat, or point Biilda at a document or an inbox that contains it, that content can appear in this record exactly as it appeared to Biilda.

Who sees it, and why

Biilda staff review these records through an internal tool, to diagnose failures and understand how the app is actually used. When an error report is uploaded, or when you request a connector from inside the app, we also get an automatic email alert — that alert includes your account id and email address so we know whose issue to look into, but it does not include the content of the report itself.

How long we keep it, and your legal basis

These records are kept for 90 days and then automatically deleted. For users in the EEA and UK, our legal basis is the performance of the beta agreement between us, and our legitimate interest in keeping a beta product working; for users in Canada, our basis is your consent to this disclosure, given during onboarding and repeated here.

Required during beta; a setting at general availability

This capture is currently required to use Biilda — you cannot use the beta with it switched off, because it is how we catch failures in a product that is still being hardened. It will become a setting you control, on by default or off, once Biilda reaches general availability. If you would rather limit what we see in the meantime, avoid pasting information you consider sensitive into chat, and you can ask us at any time to delete your activity and error records early — email support@biilda.com and we will purge them within 30 days.

Payments

Purchases run through Stripe, via its Link service, which acts as merchant of record for every top-up — “Sold through Link” appears on your statement and receipt. We send Stripe your account id and the pack you’re buying; Stripe holds your card details, billing address, and any tax information required to process the sale — we never receive or store your card number. Receipts come from Link. Refunds are issued through Stripe and settle back to your wallet automatically, as described in our Refund Policy. Payment disputes and chargebacks are handled by Link as the seller of record. If you pay in a currency other than US dollars, Stripe may show you a converted price at checkout; we settle every purchase in US dollars on our side, and any currency conversion is handled by Stripe as part of Link’s checkout, not by us.

Affiliate program

If you arrive at biilda.com through an affiliate’s link, we store the referral code in your browser’s local storage for 90 days from that first visit — first-touch attribution, so the affiliate who actually referred you gets credit even if you come back to sign up later. If you sign up, we keep an affiliate record for the account that referred you: their referral code, commission rate, status, and the version of the Affiliate Terms they accepted.

Affiliate payouts run through Stripe Connect, which also performs identity verification for affiliates — Stripe holds those identity documents, not us; we send Stripe only an affiliate’s email address and country to start that process. Affiliates see the customers they referred only as anonymous tokens in their dashboard, never by name or email; we do not share a referred customer’s purchase history, contact details, or account activity with the affiliate who referred them. Internally, we compile a monthly summary to run these payouts through Stripe Connect.

Website analytics and cookies

Biilda.com uses Google Analytics 4 through Google’s Consent Mode v2. For every visitor, analytics and advertising signals default to denied until you make a choice on the banner shown on your first visit. If you accept, we collect page views and a small set of product events — clicking download, creating an account, starting checkout, and completing a top-up — and Google also receives an advertising-measurement signal, which we would use to measure the performance of any ads we run. If you decline, none of that is stored against you: Google receives only a cookieless, non-identifying ping, and no cookie is set. You can change your choice at any time using “Cookie preferences” in the footer of this site, which reopens the banner. We do not deploy separate advertising or cross-site tracking cookies beyond the signal Consent Mode itself sends once you accept.

The Biilda desktop app itself does not use Google Analytics, and nothing on this page changes what the desktop app sends — see Beta activity records and error reports for what the app does send. This section covers biilda.com only. Our Google Analytics property is configured to keep user- and event-level data for up to 14 months.

Why we use your information

The table below lists every purpose we use personal information for and, because Biilda serves users in the EEA and UK, the legal basis GDPR requires us to name for each one. Outside those regions the same purposes still apply — the “legal basis” column is there for readers who need it, not a separate set of rules for different visitors.

Who we share information with

We use a small number of processors to run Biilda — infrastructure, the AI providers behind each tier, our payment and payout provider, and a couple of services tied to specific features you choose to use. Each one processes personal information only to provide its part of the Service to us, under a contract with us or its own terms of service, and none of them may use your information for its own separate purposes beyond what is described here.

We may also share information to comply with a lawful request, as part of a merger, acquisition, or sale of assets, or with your consent. We do not sell your personal information. The only sharing that resembles advertising is the measurement signal sent to Google when you accept cookies, described above — declining the cookie banner is how you opt out of that.

International transfers

Biilda operates from Canada, and Canada’s privacy framework has been recognized as offering an adequate level of protection for personal information transferred from the European Union. Our servers run on AWS in the United States, and the AI providers we use are based in the United States, with one exception: the Economy tier is served by DeepSeek from the People’s Republic of China, as described above. Where transfer rules require it, we rely on standard contractual clauses or an equivalent recognized safeguard with our processors; for transfers affecting UK users, we rely on the UK’s International Data Transfer Addendum. For Quebec residents, we have considered these transfers under Law 25 and use processors we believe offer protection reasonably comparable to Quebec law.

These transfers are inherent in running a cloud-connected AI product — the request has to leave your device to reach a model at all. We chose each processor above for what it publishes about how it handles that data, and we revisit that choice if a processor’s published commitments change for the worse.

How long we keep information

We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires — whichever is longer. Here is how that works out in practice for each category we hold:

Security

Data in transit between your device and our servers, and between our servers and every provider we use, is encrypted (TLS). Data at rest in our cloud is encrypted using AWS-managed keys. Your connector credentials and other secrets never leave your device — they live in your operating system’s own secure storage, and we never have a copy. Our installers are code-signed (Windows Authenticode) and, on macOS, notarized, and verified before they run, so a compromised download host cannot push unsigned code into the app. Spending is enforced through a server-side reservation system, so a single request can never overdraw your balance. We never see or store your card number.

We do not currently offer multi-factor authentication on your Biilda account, so the strongest protection you have today is the security of the email account behind it — we recommend keeping that account well secured. If a breach creates a real risk of significant harm, we will notify affected users as required by PIPEDA, and, where GDPR applies, notify the relevant authority within 72 hours.

Security also shapes how the app itself behaves, not just how we store data. New AI employees and tasks you build start disabled, and default to asking your permission before taking an action outside the app for the first time. Content Biilda reads on your behalf — a file, a web page, an email, a message — is treated as data for the AI to consider, never as an instruction to follow, which reduces (without eliminating) the risk of that content trying to hijack what an automation does next. Both defaults are described further in our Terms of Service, and both are yours to adjust once you understand the trade-off.

Your rights

These rights apply regardless of where you live; the regional notes below add rights particular to certain places on top of this baseline — they never take anything away from it. Subject to the exceptions your local law allows, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your account and the information tied to it
• Request a portable copy of the account data we hold, in a common file format
• Object to, or ask us to restrict, certain uses of your information
• Withdraw consent, where our use relies on consent, without affecting what already happened
• Complain to a regulator — see the regional notes below

To exercise any of these, email support@biilda.com from the address on your account; we may ask you to verify your identity before acting, and we respond within 30 days. A deletion request closes your account: we remove your sign-in record and the rows tied to it across our account, wallet, transaction, usage, affiliate, and feedback records, keeping only what tax and accounting law requires us to retain; any activity records already uploaded under Beta activity records and error reports are purged; and any unused purchased balance is refunded first, under our Refund Policy, before the account is closed. This process is manual on our side today — there is no automatic self-service “delete my account” button yet, so expect it to take a few business days once you confirm your identity.

Canada

You can complain to the federal Office of the Privacy Commissioner of Canada under PIPEDA. Quebec residents also have rights under Law 25, including the right to complain to the Commission d’accès à l’information, to request de-indexing of outdated personal information that has been made public online, and to receive your information in a structured, commonly used format.

EEA and UK

If GDPR or the UK GDPR applies to you, you have the rights listed above under those regulations, and the right to lodge a complaint with your local supervisory authority, or with the UK’s Information Commissioner’s Office. We have not yet appointed a representative in the EU or UK under Article 27 of either regulation — we are a small beta company without an established presence there yet — so please contact support@biilda.com directly in the meantime.

United States

In the preceding 12 months we have collected the categories of personal information described under Information we collect for the purposes described under Why we use your information. We do not sell personal information, and we do not “share” it for cross-context behavioral advertising beyond the Google measurement signal described in Website analytics and cookies — declining that cookie banner is how you opt out of that sharing. We will not discriminate against you for exercising any privacy right.

Australia

We handle personal information in line with the Australian Privacy Principles. If you are not satisfied with how we have responded to a privacy request, you may complain to the Office of the Australian Information Commissioner.

Everywhere else

Email support@biilda.com and we will do our best to honor the rights your local law gives you, even where this policy does not name your jurisdiction specifically.

Children

Biilda is intended for people who are at least 18 years old, or the age of majority where they live, whichever is greater. Creating an account, or an automation that acts on someone else’s behalf, requires the legal capacity to agree to our Terms of Service. We do not knowingly collect personal information from anyone younger than that, and we do not knowingly allow anyone under that age to create an account. If you believe a minor has provided us with personal information, email support@biilda.com and we will remove it.

Automated decisions

We do not use your personal information to make automated decisions about you that have a legal or similarly significant effect. The AI automations you build — employees, tasks, and generated tabs — act at your direction, on your own accounts and Connected Services, and only within the permissions and Approvals you set; see the Automations clause of our Terms of Service. This is a deliberate line we draw: Biilda gives you the tools to build automations that decide things according to your own instructions, on your own accounts — we ourselves do not use your personal information to decide anything about you as a person.

Changes and contact

If we make a material change to this policy, we will notify you in the app or by email before it takes effect; the version and effective date at the top of this page always reflect the current text. Continuing to use Biilda after a change takes effect means you accept it. Ask us at any time for a copy of an earlier version, or a summary of what changed between versions.

Privacy questions, requests, and complaints reach our Privacy Officer at support@biilda.com, or by mail at Biilda AI Inc., North York, Ontario, Canada.