Privacy policy.

Effective as of November 1, 2026.

CODEX ENTERPRISE LIMITED (and our subsidiaries and affiliates) ("BuildrsHQ," "we", "us" or "our") provides an enterprise software development platform, including AI-assisted coding, preview sandboxes, deployment tooling, and team collaboration features (the "Service"). This Privacy Policy describes how we process personal information that we collect through the Service, our website, and related activities.

.

Personal information we collect

Information you provide to us. Personal information you may provide through the Service includes:

1. Contact and identity data, such as your name, email address, phone number, company name, team size, role, goals, bio, professional title, social links, skills, timezone, language, and status.
2. Account and authentication data, such as your password (stored only as a bcrypt hash), one-time passcodes (short-lived), and single sign-on identifiers.
3. Billing data, such as subscription tier, billing status, payment provider customer identifiers, transaction references, and amounts. We do not store card numbers or bank account numbers — payment details are collected and processed directly by our payment providers.
4. User content and media, such as the code you write or import, repository file contents (indexed to power code search), uploaded files and logos, chat and meeting messages, support tickets, terminal histories, and comments.
5. Communications data, such as your support conversations and feedback.
6. Waitlist data, if you join the waitlist: name and email.

Data from third-party sources. If you sign in through Google, GitHub, Slack, Discord, Notion, or Figma, we receive profile information (such as name, email, and avatar) from that provider. If you connect an integration, we store OAuth tokens so the Service can act on your behalf (for example, reading repositories or posting messages). When you provide an email address to us, we may send a hash of it to Gravatar to retrieve an avatar image.

Automatic data collection. As you use the Service, we automatically collect technical data such as IP addresses (recorded in security audit logs), timezone settings, device/browser information, and session metadata. We do not collect precise geolocation, biometric data, or government identification numbers, and we do not run product analytics or advertising trackers.

Tracking technologies

We use cookies and browser storage only as needed to operate the Service (sign-in sessions and preferences). We do not use advertising, analytics, or social-media cookies, we do not use pixel tags in our emails, and we do not use session-replay technology. See our Cookie Notice for the exact list and how to control them.

How we use your personal information

We use personal information to:

• provide, operate, and secure the Service, including creating and maintaining your account, running sandboxes and previews, and providing AI-assisted features;
• process payments, manage subscriptions, and send billing-related notices;
• send service communications (security alerts, product updates) and, where permitted, marketing messages you can opt out of;
• provide customer support;
• detect, investigate, and prevent fraud, abuse, and security incidents (including IP addresses in audit logs);
• comply with legal obligations and enforce our Terms of Service.

AI features. When you use AI-assisted features, the prompts you submit — which may include your source code — are transmitted to the AI providers that power the relevant feature (see "How we share" below). We do not use your content to train AI models, and our AI providers are not permitted to train on your prompts or output. If you connect a local model (e.g. Ollama or LM Studio on your own machine), that content is not sent to us for processing by third-party AI providers.

Legal bases (GDPR). Where the GDPR applies, we rely on: performance of our contract with you (operating the Service, billing); legitimate interests (security, abuse prevention, service improvement, communicating about the Service); consent (optional communications, any optional processing); and compliance with law (tax, accounting, legal requests).

Retention

We retain personal information only as long as described below. These periods are enforced automatically in our systems unless noted.

Data	Retention
One-time passcodes	About 10 minutes
Debug rooms	2 hours
Terminal histories	7 days
Preview sandboxes	24 hours
Team invitations	7 days
Real-time collaboration sessions	7 days
Bug-handoff / debugging data	30 days
Notifications and deployment records	30 days
Security audit logs (including IP addresses)	90 days
Account, billing, projects, files, messages	While your account is active, then deleted with your account (see below)
Backups (hosting database)	Hosting database backups follow the provider's snapshot schedule: hourly snapshots for 7 days, daily for 7 days, weekly for 4 weeks, monthly for 12 months, and yearly for up to 1 year.

How we share your personal information

We do not sell your personal information, and we do not share it for targeted advertising. We share it with service providers who process it on our behalf or as needed to operate the Service:

• Cloud hosting — Render (Virginia, US East): our application, storage, and backups run there.
• Payment processors — Flutterwave and Paystack collect and process your payment details directly; card details and bank account numbers never reach our systems. Legacy subscriptions and trial card-setup flows may still be processed by Stripe.
• AI providers — Google (Gemini), Groq, Mistral, Anthropic, and OpenAI. Prompts may include your source code. We do not use your content to train AI models, and these providers are not permitted to train on your data.
• Code search — our search service (Meilisearch) runs on our own infrastructure and indexes repository file contents so you can search them.
• Email delivery — Resend, for account, invitation, and notification emails.
• Identity providers — Google, GitHub, Slack, Discord, Notion, and Figma, when you connect them. We store the access tokens you authorize and use them only to provide the connected features.
• Avatars — Gravatar (email hash lookup).
• Calls — a TURN relay that we operate on our own infrastructure (Hetzner) processes call connection metadata for real-time meetings.

We may also disclose personal information where required by law, to protect rights and safety, and in connection with a corporate transaction (merger, acquisition, or sale of assets).

Your choices and rights

• Access and update — you can review and update your profile information in your account settings.
• Export — we do not offer a self-service export or data-download feature; your information stays within the platform. To request a copy of your personal information, contact us at privacy@buildrshq.dev.
• Delete your account — you can delete your account from your account settings. Deleting your account removes your profile and associated content (including uploaded files and collaboration data) and returns a per-category summary. Please note: (a) integration connection records and synced integration data (e.g. connected GitHub repositories) are retained as records of the connection; (b) copies held by third parties (for example, payment processor records) are not deleted by this action and are governed by their own policies; and (c) sign-in tokens expire within 24 hours.
• Marketing emails — you can opt out of non-essential emails using the unsubscribe link or your notification settings; you will still receive service and billing notices.
• Cookies — see our Cookie Notice.

California and other U.S. state residents. If you reside in a state with a comprehensive privacy law — for example California (CCPA/CPRA), Colorado, Connecticut, Virginia, Texas, or Oregon — you may have the right to: know whether we process your personal information and which categories we collect; access and receive a copy of it; correct inaccurate information; delete your personal information; obtain a portable copy; and appeal our decision on a rights request. We do not sell personal information, do not share it for targeted advertising, and do not use it for profiling that produces legal or similarly significant effects. To exercise these rights, use the in-product tools described above or contact us at privacy@buildrshq.dev. We will verify your request using your account details, respond within the time required by law, and will not discriminate against you for exercising these rights. Where the law allows, you may designate an authorized agent to submit a request on your behalf.

Security

Passwords are hashed with bcrypt. OAuth tokens and connection secrets are encrypted at rest. We use HTTPS in transit, role-based access for our systems, rate limiting and lockouts, and security audit logging. No internet service can guarantee absolute security, but we design our systems to minimize what we store and how long we keep it.

International data transfer

We may process your personal information in countries other than yours, including where our providers operate (for example, the United States). Where required, we rely on appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable).

Children

The Service is not intended for use by anyone under 18 years of age, and we do not knowingly collect personal information from children.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or a prominent notice in the Service. The "Effective as of" date above reflects the latest revision.

How to contact us

• Email: privacy@buildrshq.dev
• Mail: CODEX ENTERPRISE LIMITED, 6 Igbile Street, Off Abuloma Road, Nigeria

Notice to European users

Where the GDPR or UK GDPR applies, we are the controller of the processing described in this policy. You have the rights to access, correct, delete, transfer, restrict or object to processing, and to withdraw consent at any time — use the contact details above or the in-product tools. You also have the right to lodge a complaint with your local supervisory authority. We may transfer personal information outside Europe (including to the United States) using appropriate safeguards.

---

This document was adapted from a template prepared and made publicly available by General Legal, PC ("General Legal"). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.