BuilderBot Cloud
Try It Free

Legal document

GDPR

Last updated:

July 22, 2026

This document explains how BuilderBot Cloud processes the personal data of users located in the European Economic Area (EEA) under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), and what rights you have as a data subject. It complements, and does not replace, our Privacy Policy.

1. Scope

This notice applies to anyone located in the EEA who visits our website or uses the builderbot.cloud platform, regardless of where their business is established.

2. Data controller and roles

BuilderBot Cloud, LLC
1111b South Governors Avenue, STE 23416, Dover, DE 19904, United States
Email: support@builderbot.cloud

  • When you create an account and use builderbot.cloud, BuilderBot Cloud acts as the controller of your identification, contact, billing, and platform configuration data.
  • When you use the Service to process personal data of your own end users (for example, WhatsApp or Instagram conversations with your customers), you are the controller of that data and BuilderBot Cloud acts as the processor, under our Data Processing Agreement (DPA).
  • In that second case, you alone are responsible for having a valid legal basis, informing your end users, and configuring the Service (including the AI model and integrations) in a GDPR-compliant manner. BuilderBot Cloud does not supervise or warrant your compliance as Controller.

3. Legal bases for processing

We process your personal data based on one or more of the following legal bases under Article 6 of the GDPR:

  • Performance of a contract: to provide the service you have subscribed to (creating and managing chatbots).
  • Consent: when you explicitly grant it, for example when connecting your Google, WhatsApp, or Instagram account.
  • Legitimate interest: to improve the platform's security, performance, and functionality; to prevent abuse or fraud; and to measure marketing-site usage, campaigns, and attribution via analytics/advertising cookies and pixels (for example, Meta Pixel and Google Tag Manager / Analytics), as described in Section 13. You may object to processing based on legitimate interest under Section 8; that does not constitute a technical opt-out of the marketing measurement described in Section 13, which remains active.
  • Legal obligation: when we must retain or disclose information to comply with applicable law.

4. What data we process

The full breakdown of the categories of data we collect (account data, WhatsApp/Instagram messaging, Google integrations, etc.) is described in our Privacy Policy. In summary, we process:

  • Identification and contact data (name, email address).
  • Chatbot configuration and conversation flow data.
  • Messaging data necessary to operate the integrations you enable (WhatsApp Business, Instagram, Google Drive/Sheets/Docs).
  • Technical platform usage data.

5. Data processors and recipients

We do not sell your personal data. We only share data with the providers strictly necessary to operate the service, acting as data processors, except the campaign and attribution measurement tools on the marketing site described in Section 13 (for example, Meta Pixel and Google Tag Manager / Analytics):

  • Marketing website: Vercel.
  • Application: our own server hosted on Hetzner (European Union).
  • AI microservice: a Microsoft Azure virtual machine (European Union).
  • Databases and storage: MongoDB (European Union), MongoDB Atlas (European Union, a separate instance used by the AI microservice), AWS S3 (document storage, European Union).
  • Artificial intelligence providers: Microsoft Azure OpenAI (European Union); Google Cloud Platform (Vertex AI — European Union or United States depending on the selected model); Parasail (European Union or United States depending on the selected model); Fireworks AI (United States); ElevenLabs and Inworld AI (voice / text-to-speech, United States). The geographic zone for AI processing is determined by the model you select in the platform selector (labeled EU or USA). Not all models are available in Europe; that choice is your responsibility.
  • Other providers: Cal.com (appointment scheduling), Cloudflare (anti-bot protection), Resend (transactional email), Stripe (payments), and PostHog (product analytics).
  • Messaging platforms: Meta (WhatsApp and Instagram), when you enable those integrations.

If you choose to connect your own PostgreSQL database through the database agent feature, that database is your own infrastructure and is not one of BuilderBot Cloud's sub-processors.

If you use BuilderBot Cloud to process personal data of your own end users, our Data Processing Agreement (DPA) applies, detailing the authorized sub-processors and BuilderBot Cloud's obligations as a data processor. The full list and the liability and indemnification terms are set out in the DPA.

6. International data transfers

Some of our infrastructure and AI providers are located outside the EEA, primarily in the United States (for example, Vercel, Fireworks AI, Stripe, PostHog, or Vertex AI / Parasail models labeled USA). We distinguish two layers of transfers:

  1. Customer (EEA) → BuilderBot Cloud, LLC: when you act as Controller and we act as Processor, the applicable safeguard is the Standard Contractual Clauses (SCCs, Module 2) published on this site, which form part of the DPA.
  2. BuilderBot Cloud → sub-processors in the United States or other third countries: we rely on the EU-U.S. Data Privacy Framework where the provider is certified, on SCCs or other contracts that BuilderBot Cloud enters into with that provider, or on equivalent adequacy mechanisms. The Module 2 text published at /scc does not replace those provider-to-provider safeguards.

If you select a model labeled USA or another configuration that involves processing outside the EEA, that choice may result in international transfers. In that case, you are responsible for assessing the lawfulness of such transfer with respect to your own end users, under our DPA. The EU/USA label in the selector governs generative AI processing; other platform, voice, or payment sub-processors may process data in the United States pursuant to DPA §7.

7. Retention period

We retain personal data for as long as necessary to provide the service and comply with our legal obligations. After account cancellation, your data is permanently deleted within a maximum of 30 days, unless a different retention period is required by law.

8. Your rights as a data subject

Under the GDPR, you have the right to:

  • Access: obtain confirmation of whether we process your data and a copy of it.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): request the deletion of your personal data.
  • Restriction of processing: request that we restrict the use of your data in certain circumstances.
  • Portability: receive your data in a structured, commonly used format, or request its transfer to another controller.
  • Objection: object to processing based on legitimate interest.
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
  • Not be subject to automated decisions that produce significant legal effects on you, without human intervention.

9. How to exercise your rights

Account holders (when BuilderBot Cloud acts as Controller of your identification, contact, billing, or configuration data): you can exercise any of these rights by emailing support@builderbot.cloud, indicating the right you wish to exercise and the information needed to verify your identity. We will respond to your request within a maximum of 30 days.

End users of a Customer's chatbot: direct your request to that Customer, who is the Controller. BuilderBot Cloud, as Processor, only assists the Customer under DPA §10 and does not replace the Customer's response.

10. Right to lodge a complaint

If you believe the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the data protection authority of your country of residence in the European Union. For example, if you reside in Spain, you may contact the Spanish Data Protection Agency (AEPD) (www.aepd.es).

11. Data security

We apply reasonable technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), restricted access limited to authorized personnel, and secure storage at rest.

12. Minors

Our services are not directed to individuals under 18 years of age, and we do not knowingly collect personal data from minors.

13. Cookies and tracking technologies

We use necessary cookies for the site to function and analytics/advertising cookies and pixels to measure site usage, campaigns, and attribution. In particular, we continuously load Google Tag Manager / Google Analytics (Consent Mode set to granted) and Meta Pixel. We may also use PostHog in-product.

We show an informational cookie notice; the marketing measurement described in this section remains active. You can read more on this page and in the Privacy Policy. The footer "Cookie preferences" link resets the informational notice.

Categories we use:

  • Necessary: essential for the site to function (for example, security).
  • Analytics: measure site and product usage (for example, Google Tag Manager / Google Analytics, PostHog).
  • Advertising: measure campaigns and attribution (for example, Meta Pixel).

The operational details of each tool may evolve.

14. Changes to this notice

We may update this document periodically. The "Last updated" date at the top of this page reflects the current version.

15. Contact

BuilderBot Cloud, LLC