Data Processing

For personal account data, BuildFlo acts as a controller under UK GDPR.

Where you upload client or project documents into BuildFlo in the course of your professional work, you typically remain the controller of that content and we act as a processor on your instructions, to the extent UK GDPR applies.

We process data to provide AI-assisted building services tools, including chat answers, calculations, drawing QA, and related workspace features.

Processing is limited to what is necessary to deliver, secure, and improve those features, and to meet legal obligations.

When acting as a processor, we process uploaded content only to provide the service you request (for example generating a response, running a checklist, or storing a project).

We do not sell your uploaded documents. We do not use customer content to train foundation models for unrelated products, subject to the contractual terms of our AI infrastructure providers.

We use carefully selected sub-processors for hosting, authentication, storage, analytics (where enabled), and AI inference.

Sub-processors may process data outside the UK. Where required, we use appropriate transfer safeguards such as adequacy decisions or standard contractual clauses.

A current list of material sub-processors is available on request at privacy@mepgpt.com.

We will provide reasonable assistance with data subject requests, security incidents, and regulatory enquiries relating to processing we perform on your behalf, where you are the controller.

Security incidents affecting personal data will be handled in line with applicable law and notified where required.

Organisations needing a signed Data Processing Agreement (DPA) or additional contractual terms for BuildFlo Business should contact us before onboarding.

Email legal@mepgpt.com or m.szuchnicki@selectmep.co.uk to request a DPA.