Privacy Policy

The short version. We collect the email address you sign up with and the vehicle information you choose to enter. We do not run advertising, we do not sell or share your personal information, we do not use third-party analytics or tracking SDKs, and we send exactly two kinds of email — both of which you trigger yourself.

This policy explains what BUILT CO (“BUILT CO”, “we”, “us”) collects when you use the BUILT CO iOS app and this website, why we collect it, who else touches it, and what control you have over it. It applies to the private beta and will be updated as the product changes.

1. What we collect

Account information

• Email address — required to create an account, verify it, and recover access to it.
• Password — stored only as a cryptographic hash by our identity provider. We never see, store, or transmit your plaintext password, and nobody at BUILT CO can recover it.
• Display name — optional. If you use Sign in with Apple, we store the name Apple provides only when Apple supplies it and you have not already set one.
• Apple account identifier — if you sign in with Apple, so we can recognise you on return. If you use Apple’s Hide My Email, we only ever see the relay address.

Legal consent records

When you accept these documents we record which versions you accepted and the server time at which you did. We keep this because it is the evidence that consent was given, and it cannot be edited from the app.

Vehicle information

• Required — year, make, and model of a vehicle you add.
• Optional — trim, VIN, and mileage, plus identifiers returned by the vehicle lookup and a note of whether the record came from a lookup or was entered by hand.

A VIN is optional. If you enter one, please note that a VIN identifies a specific physical vehicle and, combined with other records, can be linked to its owner. Only add it if you are comfortable with that.

Technical information

Our providers keep standard operational logs — IP address, timestamps, user agent, and request outcomes — for security, abuse prevention, and debugging. We do not build advertising or behavioural profiles from them.

2. What we do not collect

To be explicit, the app does not collect:

• location or GPS data;
• contacts, photos, calendars, or health data;
• advertising identifiers, and we embed no advertising SDK;
• third-party analytics or behavioural tracking — there is no Google Analytics, no Meta pixel, and no session-replay tool in the app or on this website;
• payment or card details — the beta is free and takes no payment.

This website sets no cookies and runs no tracking scripts.

3. How we use your information

We use what we collect only to:

• create your account and authenticate you;
• verify your email address and let you recover access to your account;
• store and display the vehicle records you enter;
• decode a VIN or look up a vehicle when you ask us to;
• record which version of these documents you accepted;
• keep the Service secure and diagnose faults; and
• respond to you when you contact us.

Where the GDPR applies, our lawful bases are performance of a contract (running the account you asked for), legal obligation (keeping consent records), and our legitimate interests in keeping the Service secure and working.

4. Email we send you

BUILT CO sends transactional email only. There are two messages:

• Confirm your email address — sent when you create an account, to verify the address belongs to you.
• Reset your password — sent only when you request a reset. The link expires after one hour.

We do not send marketing email, newsletters, or promotional messages. We have never purchased, rented, or imported a mailing list — every address we hold was typed into the app by the person who owns it. Because these two messages are required to operate your account, they have no unsubscribe link; to stop receiving them, delete your account.

5. Who else receives your information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with the service providers we need to run the product, each of which is contractually limited to processing it on our instructions:

We may also disclose information if we are legally required to, or where it is necessary to protect the rights, safety, or property of BUILT CO, our users, or the public. If BUILT CO is ever involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction; we would tell you before it became subject to a materially different policy.

6. Retention and deletion

We keep your information for as long as your account exists. You can delete your account from the account settings screen in the app. Deletion requires you to re-authenticate — with your password, or with a fresh Apple authorisation — so that nobody else can delete your account.

Deleting your account removes your authentication record, and your account row, consent records, and vehicle records are deleted along with it. Deletion is not reversible and we cannot restore the data afterwards. Residual copies may persist briefly in encrypted infrastructure backups and are overwritten on our providers’ ordinary backup cycle.

7. How we protect it

• All traffic between the app and our servers is encrypted in transit with TLS, and stored data is encrypted at rest by our infrastructure provider.
• Every application table enforces row-level security: a query can only ever return rows owned by the authenticated user making it. This is enforced by the database, not only by the app.
• Your session is held in the iOS Keychain. The app contains no password, no secret key, and no custom credential storage.
• Passwords must be at least 15 characters and are checked against known breached-password corpora at signup.
• You can require Face ID, Touch ID, or your device passcode to unlock the app, which then re-locks after five minutes in the background.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any required regulator as the law requires.

8. Your rights

Depending on where you live, you may have the right to access a copy of your personal information, correct it, delete it, restrict or object to how we use it, receive it in a portable format, or withdraw consent. You also have the right not to be discriminated against for exercising these rights.

You can exercise access and deletion directly in the app. For anything else, write to [email protected] and we will respond within the period the applicable law requires — 30 days under the GDPR, 45 days under the CCPA. We may need to verify your identity, which normally means responding from the address on the account.

If you are in the EU, EEA, or UK, you also have the right to complain to your local data protection authority.

9. International transfers

BUILT CO is operated from the United States, and our providers process and store data there. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from your own. Where required, our providers rely on Standard Contractual Clauses for these transfers.

10. Children

The Service is not directed to children and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, write to [email protected] and we will delete it.

11. Changes to this policy

We may update this policy as the product changes. Each version carries a version identifier — this one is 2026-08-21. When we publish a materially different version we update that identifier, and the app asks you to accept the new version before you continue. Your acceptance is recorded against the specific version you agreed to.

12. Contact

For privacy questions, data requests, or anything else in this policy, write to [email protected]. A person reads that address.