Privacy Policy
Last updated: 18 April 2026
We have written this in plain English because nobody reads legalese. The legal bits are still there — they just read like a human wrote them. If anything is unclear, get in touch.
The short version
- - Your data is yours. Always.
- - We never sell your data to anyone.
- - We never contact your customers.
- - You can export everything anytime (Settings → Your data → Export everything).
- - We delete your data within 30 days of cancellation.
- - No tracking cookies. No ads.
1. Who we are
BuildRound is operated by BuildRound Ltd, a company registered in England and Wales. We provide business management tools for outdoor service operators in the United Kingdom. Full registration details, registered office, and ICO number are at the bottom of this page.
2. What we collect
Account information: Email address and password (managed by AWS Cognito, our authentication provider). We need this to create your account and let you sign in.
Business information: Business name, services offered, coverage area, and pricing you enter during setup. We need this to power your booking page and tools.
Operational data: Customers, jobs, invoices, expenses, and payments you create through normal use. This is the core of what BuildRound does for you.
Usage data: We use PostHog Cloud EU (hosted in Frankfurt) to understand which features people use and where they get stuck. PostHog stores an anonymous device id in your browser's local storage; we only attach your account to it once you sign up. No advertising cookies. No third-party trackers. We honour the DNT browser header — when it's on, PostHog isn't loaded at all. Full details on the Cookies page.
3. What we do not collect
- - We do not track you across other websites.
- - We do not use advertising cookies or pixels.
- - We do not collect data from your phone contacts, camera, or location unless you explicitly use a feature that requires it (like route planning).
- - We do not read your SMS messages or emails.
4. Legal basis for processing (GDPR Article 6)
| What we do | Legal basis |
|---|---|
| Provide the BuildRound service | Contract — performance of our agreement with you |
| Send transactional emails (receipts, password resets) | Contract |
| Keep records for tax and accounting (HMRC) | Legal obligation |
| Prevent fraud, secure the service, fix bugs | Legitimate interest |
| Improve the product using anonymous usage data | Legitimate interest |
| Send product updates or marketing (if you opt in) | Consent |
5. Your customers' data
Your customers are your customers, not ours. We store their name, address, phone number, and email only because you entered it to manage your round. We will never:
- - Contact your customers directly.
- - Market to your customers.
- - Share your customer list with anyone.
- - Use your customer data after you cancel.
You are the data controller for your customers' data under UK GDPR. We are the data processor — we store it on your behalf and only use it as you instruct. By using BuildRound you enter into a data processing agreement with us on the terms set out in this policy.
6. Where we store your data
Your data is stored on Amazon Web Services (AWS) servers in London (eu-west-2). All data is encrypted at rest and in transit. Backups are taken daily and retained for up to 35 days (production) or 7 days (staging).
7. International data transfers
Most processing happens in the UK. A few third-party services we use are based outside the UK:
- - Stripe (payments) — processes some data in the US and Ireland under Standard Contractual Clauses.
- - AWS End User Messaging (SMS) — processed in AWS eu-west-2 (London).
- - Sentry (error tracking) — EU region.
Where data leaves the UK, we rely on adequacy decisions or Standard Contractual Clauses as required by UK GDPR Articles 44-49.
8. Third-party services
| Service | Purpose | Data shared |
|---|---|---|
| AWS Cognito | Authentication | |
| GoCardless | UK Direct Debit payments | Customer name, email, sort code + account number (mandate setup); payment metadata (mandate id, payment id, status events) |
| Stripe | Card payments | Payment details (we never see full card numbers) |
| AWS End User Messaging | SMS reminders | Customer phone numbers, message content |
| AWS SES | Transactional email | Email addresses, message content |
| AWS Bedrock (Claude) | Pricing + tax suggestions | Aggregated pricing data, never personal customer data |
| AWS Location Service (HERE) | UK address autocomplete | The address text you type while adding a customer |
| PostHog Cloud EU | Product analytics (Frankfurt) | Anonymous device id + page/feature events; account id once you sign up |
| Sentry | Error tracking | Anonymous error reports |
9. Automated decision-making
We use AWS Bedrock (a Claude model) to suggest prices and estimate tax amounts based on aggregated data. These are suggestions only — you make every final decision. No decisions with legal or significant effects are taken automatically. You are not subject to any processing under GDPR Article 22.
11. How long we keep your data
| Category | Retention |
|---|---|
| Your account + operational data | Until cancellation + 30 days |
| Backups | Up to 35 days rolling |
| Invoices and financial records | 7 years (HMRC legal requirement) |
| Server and security logs | 90 days |
| Support correspondence | 2 years |
12. Data export and deletion
Export: Settings → Your data → Export everything. Generates a zip of CSVs covering customers, jobs, quotes (with line items), invoices (with line items), payments, expenses, leads, and communications. No charge, no waiting period. The export is scoped to your business and audited.
Deletion: If you cancel your account, we delete all your operational data within 30 days. Financial records retained only as required by HMRC (see above). You can also request immediate deletion by emailing privacy@buildround.com.
Portability: The export is standard CSV — imports cleanly into Excel, Numbers, Sheets, or any other tool. We never lock you in.
13. Your rights under UK GDPR
- - Access: See what data we hold about you.
- - Rectification: Correct any inaccurate data.
- - Erasure: Request deletion of your data.
- - Restriction: Limit how we use your data.
- - Portability: Export your data in a standard format.
- - Objection: Object to processing based on legitimate interests.
- - Withdraw consent: Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email privacy@buildround.com. We will respond within 30 days as required by law. No fee in most cases.
14. Right to lodge a complaint
If you are not happy with how we handle your data, you can complain to the UK's Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint. We'd prefer you came to us first so we can fix it, but it's your right and you don't have to.
15. Children's data
BuildRound is not for children. You must be at least 18 to use our service. We don't knowingly collect data from anyone under 18. If you believe a child has signed up, email privacy@buildround.comand we'll delete the account.
16. Changes to this policy
If we make significant changes, we will email you at least 14 days before they take effect. Minor wording changes will be updated here with the date at the top.
17. Contact us
Privacy questions: privacy@buildround.com. General enquiries: hello@buildround.com. Full company details below.
Company information
- Legal name
- BuildRound Ltd
- Company number
- TBA
- Registered office
- TBA — Companies House registered address
- Jurisdiction
- England and Wales
- Support
- hello@buildround.com
- Privacy
- privacy@buildround.com