Privacy Policy

BuiltAI Intelligence Ltd is a UK private company providing governed AI consultancy and software for the built environment. We are the data controller for personal information collected through our website and web platform.

Company number: 17269241 (registered in England and Wales). VAT number: 521 7623 08.

The person responsible for data protection is our Director. For any privacy enquiry, to exercise your rights, or to raise a concern, email privacy@built-ai.io or contact our team via the contact form.

• Contact information: name, business email, phone, role and company when you submit a form, complete an assessment or join the client portal.
• Business information you choose to give us before we work together: when you complete our Operational Intelligence Audit discovery questionnaire, the answers you provide about how your business runs. These are business questions, but some are commercially sensitive - turnover, margin, customer mix, headcount and similar - and answering any of them is your choice. See The discovery questionnaire below.
• Documents you choose to send us before we work together: files you attach to that questionnaire, such as a quote, a job log or an org chart. See Information inside content you upload below.
• Operational content: documents, data and notes uploaded under a signed Statement of Work, classified under our R / A / G rules.
• Usage data: anonymous analytics about page visits and feature usage, used to improve the product.

• To respond to enquiries and qualify next steps.
• To deliver paid audits, pilots and retainers.
• To meet legal, accounting and contractual obligations.
• To send service-related communications (engagement updates, deliverable reviews). We do not sell or share contact details with third-party marketers.

Before an Operational Intelligence Audit, we ask you to complete a discovery questionnaire about how your business runs today - how work comes in, how you price it, how you deliver it, how you invoice, and how your team is organised.

You choose how much to answer.We need a company name, your name and an email address so we can reply. Everything else is optional, including every figure - the most sensitive questions offer an explicit "prefer not to say". An incomplete questionnaire is still useful to us and you will get the same conversation.

What we do with it. We read it before the call so that our first conversation starts from your business rather than from generic questions. Your answers also produce an indicative readiness score, shown to you on screen and included in the PDF you can save. That score is a conversation starter, not an assessment or a benchmark, and no decision with legal or similar effect about you is made from it.

Our lawful basis for handling your questionnaire is our legitimate interests in responding to your enquiry and preparing for a meeting you have asked for (UK GDPR Article 6(1)(f)). You can object at any time by emailing privacy@built-ai.io, and we will stop. If you also tick the optional box for BuiltAI updates, that separate marketing contact runs on your consent, which you can withdraw at any time without affecting the enquiry itself.

Who sees it. Your questionnaire is read by BuiltAI staff working on your enquiry. It is stored in our database and a copy is sent to our own enquiries mailbox. We do not sell it, and we do not share it with anyone outside the service providers listed on our sub-processors page.

How long we keep it. We keep the questionnaire for 24 months from submission, or for as long as we are working together if that is longer. After that we remove your name, email and answers and keep only the anonymous score, so we can see how readiness varies across the sector without holding anything that identifies you. Documents you attach are deleted sooner - after 6 months (see Information inside content you upload). If you ask us to delete any of it earlier, we will.

What "private to your enquiry" means. The questionnaire's cover describes it as private to your enquiry, and by that we mean something specific: it is sent over an encrypted connection, stored in the UK/EU, and read only by the BuiltAI team working on your audit. If you would rather not send it to us at all, the questionnaire's Save as PDF option works entirely in your browser - nothing leaves your computer.

• Enquiries, the discovery questionnaire and marketing - legitimate interests (running and growing a B2B business). You can object at any time. We review and delete or anonymise cold contact records after around 24 months of inactivity.
• Client and platform accounts - performance of our contract with you. We keep account and engagement records for the life of the engagement plus a limited contractual tail.
• Marketing follow-up - your consent, which you can withdraw at any time.
• Security, audit and legal records - legal obligation and legitimate interests, kept only as long as needed for those purposes.

Providing your business contact details is necessary for us to respond to you or to provide the service; if you do not provide them we may be unable to do so.

We do not sell your data. We share it only with the service providers who help us run the platform, each under a data processing agreement: hosting and infrastructure, our database, authentication and file storage provider, our AI model provider, transactional email, error monitoring and privacy-focused analytics.

Our primary database and file storage are hosted in the UK or EU. Some providers (for example our AI model provider and certain hosting and email services) process data outside the UK. Where they do, the transfer is protected by appropriate safeguards such as UK adequacy regulations, the UK extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement.

Documents you send us before we work together. If you attach documents to our discovery questionnaire - a quote, a job log, an invoice, a team list - those documents may contain personal data about your customers or your staff. For that copy we are the data controller, and we use it only to prepare for your audit. Please remove or obscure names and contact details before you send anything; a redacted example tells us just as much. We delete these documents 6 months after you send them, or sooner if you ask.

Documents uploaded under a Statement of Work. When a client uploads documents under a signed Statement of Work, those documents may contain personal data about other people. For that content the client is the data controller and is responsible for the privacy information given to those individuals; BuiltAI acts as a data processor and handles it only on the client's instructions.

We use AI to help produce drafts and answers, but we do not make decisions with legal or similarly significant effects about you by solely automated means. Our workflows keep a human in the loop - every AI-assisted output is reviewed and approved by a person before it is treated as final. See our AI disclosure for detail.

Personal data is stored in encrypted Supabase Postgres databases and Supabase Storage. Internal access is role-based and audit-logged. Red-classified data is not accepted for upload via the platform - it is handled through a separately agreed secure route. See our Data Security statement for full detail.

Under UK GDPR you have the right to access, rectify, port and erase your personal data, and to object to or restrict its processing. Email privacy@built-ai.io or use our contact form to make a request - it is free and we respond within one calendar month.

If you have a concern about how we handle your personal data, please contact us first at privacy@built-ai.io. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113.

See our Cookie Policy for the cookies we use and how to manage them.

We may update this policy from time to time. The effective date at the top of the page reflects the latest version.