Privacy Policy

BuiltAI Intelligence Ltd is a UK private company providing governed AI consultancy and software for the built environment. We are the data controller for personal information collected through our website and web platform.

Company number: 17269241 (registered in England and Wales). VAT number: 521 7623 08.

The person responsible for data protection is our Director. For any privacy enquiry, to exercise your rights, or to raise a concern, email hello@built-ai.io or contact our team via the contact form.

• Contact information: name, business email, phone, role and company when you submit a form, complete an assessment or join the client portal.
• Business information you choose to give us before we work together: when you complete our Operational Intelligence Audit discovery questionnaire, the answers you provide about how your business runs. These are business questions, but some are commercially sensitive - turnover, margin, customer mix, headcount and similar - and answering any of them is your choice. See The discovery questionnaire below.
• Documents you choose to send us before we work together: files you attach to that questionnaire, such as a quote, a job log or an org chart. See Information inside content you upload below.
• Operational content: documents, data and notes uploaded under a signed Statement of Work, classified under our R / A / G rules.
• Usage data: anonymous analytics about page visits and feature usage, used to improve the product.
• Booking information: when you book, reschedule or cancel a call in our online calendar (provided by Cal.com), the name and email address you give, the time you chose and any cancellation or rejection reason.
• Security information: the IP address and browser details sent with a contact form or discovery questionnaire submission, which we record in our security log, and the request counts we keep to stop our forms being misused.

• To respond to enquiries and qualify next steps.
• To deliver paid audits, pilots and retainers.
• To meet legal, accounting and contractual obligations.
• To send service-related communications (engagement updates, deliverable reviews). We do not sell or share contact details with third-party marketers.

Before an Operational Intelligence Audit, we ask you to complete a discovery questionnaire about how your business runs today - how work comes in, how you price it, how you deliver it, how you invoice, and how your team is organised.

You choose how much to answer. We need a company name, your name and an email address so we can reply. Everything else is optional, including every figure - the most sensitive questions offer an explicit "prefer not to say". An incomplete questionnaire is still useful to us and you will get the same conversation.

What we do with it. We read it before the call so that our first conversation starts from your business rather than from generic questions. Your answers also produce an indicative readiness score, shown to you on screen and included in the PDF you can save. That score is a conversation starter, not an assessment or a benchmark, and no decision with legal or similar effect about you is made from it.

Our lawful basis for handling your questionnaire is our legitimate interests in responding to your enquiry and preparing for a meeting you have asked for (UK GDPR Article 6(1)(f)). You can object at any time by emailing hello@built-ai.io, and we will stop. If you also tick the optional box for BuiltAI updates, that separate marketing contact runs on your consent, which you can withdraw at any time without affecting the enquiry itself.

Who sees it. Your questionnaire is read by BuiltAI staff working on your enquiry. It is stored in our database and a copy is sent to our own enquiries mailbox. We do not sell it, and we do not share it with anyone outside the service providers listed on our sub-processors page.

How long we keep it. We keep the questionnaire for 24 months from submission, or for as long as we are working together if that is longer. After that we remove your name, email and answers and keep only the anonymous score, so we can see how readiness varies across the sector without holding anything that identifies you. Documents you attach are deleted sooner - after 6 months (see Information inside content you upload). If you ask us to delete any of it earlier, we will.

What "private to your enquiry" means. The questionnaire's cover describes it as private to your enquiry, and by that we mean something specific: it is sent over an encrypted connection, handled under documented access controls, and read only by the BuiltAI team working on your audit. If you would rather not send it to us at all, the questionnaire's Save as PDF option works entirely in your browser - nothing leaves your computer.

• Enquiries, the discovery questionnaire and marketing - legitimate interests (running and growing a B2B business). You can object at any time. We review and delete or anonymise cold contact records after around 24 months of inactivity.
• Client and platform accounts - performance of our contract with you. We keep account and engagement records for the life of the engagement plus a limited contractual tail.
• Marketing follow-up - your consent, which you can withdraw at any time.
• Security, audit and legal records - legal obligation and legitimate interests, kept only as long as needed for those purposes.

Providing your business contact details is necessary for us to respond to you or to provide the service; if you do not provide them we may be unable to do so.

We do not sell your data. We share it only with the service providers who help us run the platform, each under a data processing agreement: hosting and infrastructure, our database, authentication and file storage provider, our AI model provider, transactional email, our online booking calendar, error monitoring and privacy-focused analytics. The current list is on our sub-processors page.

Hosting and processing locations are documented in the applicable service terms. Some providers (for example our AI model provider and certain hosting and email services) process data outside the UK. Where they do, the transfer is protected by appropriate safeguards such as UK adequacy regulations, the UK extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement.

When you run a Proof critique, we privately retain your uploaded document and the resulting critique to process the request and let you review the result. BuiltAI uses Anthropic Claude to prepare the critique. Remove personal or confidential information you do not have permission to share.

Your private browser access has an expiry time shown with the result. If you choose an email copy, we also retain your email address and an encrypted copy of the message and PDF to fulfil that request. This choice does not subscribe you to marketing.

You can cancel an email request before it reaches the sending stage, while your private result access remains valid. Closing the page, clearing the screen or starting another review does not cancel a saved email request. Expiring browser access does not recall a PDF you downloaded or an email already sent.

For questions about a submission or to request deletion, contact hello@built-ai.io.

If the optional Explore adviser is made available and you choose to use it, your text messages are sent to Anthropic, where a model generates a response based on approved BuiltAI service guidance. Do not include personal, confidential, legally or commercially sensitive information. This conversation stays in the current page’s memory; BuiltAI does not save its transcript to the transcript database, analytics or ordinary logs. Provider processing follows the terms applicable to BuiltAI’s account; see our sub-processor information. This notice does not state a separate adviser-message retention period or promise zero-data-retention.

After you review, edit and explicitly carry a proposed brief, only that structured brief, rather than the conversation, is held temporarily in this browser tab for the Contact handoff. Carrying it does not submit Contact; you decide separately whether to send the Contact form. The rights and contact routes set out in this policy continue to apply.

Documents you send us before we work together. If you attach documents to our discovery questionnaire - a quote, a job log, an invoice, a team list - those documents may contain personal data about your customers or your staff. For that copy we are the data controller, and we use it only to prepare for your audit. Please remove or obscure names and contact details before you send anything; a redacted example tells us just as much. We delete these documents 6 months after you send them, or sooner if you ask.

Documents uploaded under a Statement of Work. When a client uploads documents under a signed Statement of Work, those documents may contain personal data about other people. For that content the client is the data controller and is responsible for the privacy information given to those individuals; BuiltAI acts as a data processor and handles it only on the client's instructions.

We use AI to help produce drafts and answers, but we do not make decisions with legal or similarly significant effects about you by solely automated means. Our workflows keep a human in the loop - every AI-assisted output is reviewed and approved by a person before it is treated as final. See our AI disclosure for detail.

Personal data is stored in encrypted Supabase Postgres databases and Supabase Storage. Internal access is role-based and audit-logged. Red-classified data is not accepted for upload via the platform - it is handled through a separately agreed secure route. See our Data Security statement for full detail.

Under UK GDPR you have the right to access, rectify, port and erase your personal data, and to object to or restrict its processing. Email hello@built-ai.io or use our contact form to make a request - it is free and we respond within one calendar month. When we act on an erasure request, we remove your name and email address from your enquiry, booking and contact records, remove your questionnaire answers and redact your email address from our security log (the entries themselves stay as a record of what happened). Deleted data remains in our database backups until those backups expire, up to 7 days later.

If you have a concern about how we handle your personal data, please contact us first at hello@built-ai.io. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113.

See our Cookie Policy for the cookies we use and how to manage them.

We may update this policy from time to time. The effective date at the top of the page reflects the latest version.