Privacy Policy

BuildFlo ("we", "us", "our") operates BuildFlo, an AI-assisted workspace for building services and MEP design professionals in the United Kingdom.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website and application. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have questions about this policy, contact us at privacy@mepgpt.com.

We may collect the following categories of information:

• Account information such as your name, email address, and authentication details.
• Usage data including projects, chat history, saved notes, and tool preferences stored in your workspace.
• Content you submit, including messages, uploaded PDFs, drawings, and specifications used for compliance checks, calculations, and QA.
• Technical data such as browser type, device information, IP address, and cookies (see our Cookie Policy).
• Free preview usage on the marketing site, including a hashed IP address when cookies are disabled, to enforce fair demo limits.
• Support and correspondence if you contact us directly.

We use your data to:

• Provide, maintain, and improve the BuildFlo service.
• Process your prompts and uploaded documents to generate AI-assisted responses.
• Authenticate users and secure access to your account.
• Store your projects, chats, and notes so you can return to your work.
• Monitor performance, troubleshoot issues, and protect against misuse.
• Limit free preview questions on the marketing site and prevent API abuse.
• Comply with legal obligations and enforce our Terms of Service.

To generate responses, we send relevant prompts and uploaded documents to third-party AI infrastructure providers. These providers process data on our behalf solely to deliver the service.

We do not sell your personal data. We only share data with service providers who help us operate BuildFlo (for example hosting, analytics, and AI inference), and only under appropriate contractual safeguards.

You should not upload documents containing unnecessary personal data about third parties unless you have a lawful basis to do so.

Depending on the activity, we rely on one or more of the following legal bases:

• Contract - to provide the service you sign up for.
• Legitimate interests - to improve security, prevent abuse, and develop the product, balanced against your rights.
• Consent - where required, for example for non-essential cookies.
• Legal obligation - where we must retain or disclose information by law.

We retain account and workspace data for as long as your account is active or as needed to provide the service.

If you delete content or close your account, we will delete or anonymise your data within a reasonable period, except where we must retain it for legal, security, or backup purposes.

Under UK data protection law, you may have the right to access, rectify, erase, restrict, or object to certain processing of your personal data, and to data portability where applicable.

To exercise these rights, email privacy@mepgpt.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We implement appropriate technical and organisational measures to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for keeping your login credentials confidential.

Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.