Privacy Policy

Information you provide. This includes:

• Account and profile data: name, email address, password (stored as a salted hash), profile image, timezone, role, and organization affiliation.
• Organization and billing data: organization name, domain, address, billing contact, plan, and payment details. Payment card numbers are collected and processed by our payment processor, Stripe, and are not stored on DataBuilt’s servers.
• Customer Content: files, imagery (including drone and mobile imagery), videos, point clouds, 3D scans, Gaussian splat datasets, documents, annotations, measurements, reports, comments, and project metadata that you or your collaborators upload.
• Location data: geographic coordinates, altitude, orientation, and capture time embedded in imagery and sensor data you upload (for example, EXIF GPS), and addresses entered into project settings.
• Communications: the content of messages you send us (for example, support requests) and invitations you send through the Services.

Information collected automatically. When you use the Services we collect information about your device, browser, and use of the Services, including IP address, browser type, operating system, referring/exit URLs, page views, features used, timestamps, and diagnostic logs. We use cookies and similar technologies to operate and secure the Services, remember your preferences, and measure engagement.

Information from third parties. We may receive information from your organization’s administrator (for example, when they invite you), from identity providers if you sign in through one, from payment processors (transaction status, partial card numbers), and from service providers that help us detect fraud or protect the Services.

We use personal information to:

• provide, maintain, secure, and improve the Services, including authentication, authorization, storage, rendering, tiling, indexing, and collaboration;
• deliver AI Features such as natural-language search over Customer Content, automated reporting, image comparison, and classification (see AI and Machine Learning below);
• process payments, manage subscriptions, and calculate usage and credits;
• communicate with you about your account, send invitation and verification emails, and respond to support requests;
• detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service;
• generate aggregated, de-identified analytics about how the Services are used so we can understand demand, improve reliability, and plan capacity;
• comply with legal obligations and enforce our agreements.

If you are in the European Economic Area or the United Kingdom, we process personal information under the following legal bases: performance of a contract (to provide the Services); our legitimate interests (to secure, improve, and market the Services); compliance with legal obligations; and, where applicable, your consent, which you can withdraw at any time by contacting us.

We share personal information only as described below.

• Within your organization. Authorized Users of your organization can see your profile information and any Customer Content shared with them based on project and role settings. Administrators and owners can access all content within the organization.
• Invited collaborators. When you invite collaborators to a project, they can see the project content you share with them and your identifying information as part of that collaboration.
• Subprocessors. We share information with service providers that help us operate the Services; they are bound by written agreements that limit their use of the information to providing services to us. See Subprocessors below.
• Legal and safety. We may disclose information when required by law, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• Business transfers. If we are involved in a merger, acquisition, reorganization, financing, or sale of assets, personal information may be transferred as part of that transaction; we will notify you through the Services or by email if this occurs.
• With your consent or at your direction.

We do not sell personal information (as “sale” is defined in the California Consumer Privacy Act), and we do not share it for cross-context behavioral advertising.

We engage service providers (commonly called “subprocessors”) to help us operate the Services. Each is bound by a written agreement limiting their use of personal information to providing services to us. We share information with service providers in the following categories:

• Cloud infrastructure, hosting, and content delivery. Operates compute, managed databases, object storage, content delivery networks, and DDoS protection so the Services can be reliably delivered to your device.
• Authentication and identity. Manages account sign-in, session tokens, and password hashing.
• Payment and subscription billing. Processes payments, stores payment methods, calculates taxes, and manages recurring subscriptions.
• Transactional email delivery. Sends account verification, invitation, and notification emails on our behalf.
• Background workflow and job orchestration. Runs asynchronous processing such as large-file tiling, media transcoding, and AI-report generation.
• Media processing and streaming. Encodes, transcodes, and streams video content uploaded to the Services.
• AI model inference. Runs machine-learning models that power AI Features (see the AI and Machine Learning section below), sometimes via a gateway or routing layer we operate.
• Security, abuse prevention, and analytics. Detects fraud, abuse, and errors, and produces aggregated usage analytics to help us improve the Services.

A current list of the specific subprocessors we use is available on request. For enterprise customers, named subprocessors are disclosed in our Data Processing Agreement. To request the list or a DPA, email support@databuilt.ai.

The Services include AI Features that process Customer Content and user input to produce outputs such as natural-language answers, summaries, comparisons, and classifications. These features may use our own models and the models of third-party providers. We may change model providers or underlying models at any time; the specific providers in use are listed among the subprocessors disclosed on request (see Service-Provider Categories).

We do not use Customer Content to train general-purpose foundation models, and our agreements with third-party model providers prohibit them from using Customer Content submitted through the Services to train their general-purpose models. We may use aggregated, de-identified signals (for example, feature usage counts, latency metrics) to improve product performance.

Prompt and output retention. Prompts and outputs associated with AI Features may be retained for a limited period to operate, debug, secure, and audit the Services. AI Features may also be subject to a model provider’s own short-term logging for abuse prevention, governed by that provider’s terms and data-processing agreement.

Limitations. Output may be inaccurate, incomplete, biased, or offensive. You are responsible for reviewing and validating Output before relying on it, and for not using AI Features as the sole basis for consequential decisions such as those affecting safety, health, legal rights, credit, or employment.

DataBuilt is headquartered in the United States and most of our subprocessors are located in the United States. If you access the Services from outside the United States, your information may be transferred to and processed in the United States or other jurisdictions that may have different data-protection laws than your jurisdiction. Where required, we use appropriate safeguards such as Standard Contractual Clauses or other lawful transfer mechanisms.

We retain personal information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Customer Content is retained while your Subscription is active and for a reasonable grace period after termination to allow export. Routine system backups are retained for a limited period and then deleted on a rolling basis.

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, least-privilege access controls, audit logging, and continuous monitoring. No method of transmission or storage is perfectly secure; please use strong, unique passwords, enable account security features when offered, and notify us at support@databuilt.ai of any suspected unauthorized access.

Depending on your location, you may have rights under laws such as the General Data Protection Regulation (EU/UK) or the California Consumer Privacy Act, including:

• access to the personal information we hold about you;
• correction of inaccurate or incomplete information;
• deletion of your personal information;
• portability of personal information you provided to us;
• objection to or restriction of certain processing, including direct marketing;
• withdrawal of consent where processing is based on consent;
• the right to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising).

To exercise a right, email support@databuilt.ai. For requests that concern Customer Content submitted by a customer organization, we will refer your request to that organization and assist them in responding. You may also lodge a complaint with a supervisory authority in your jurisdiction.

We use cookies and similar technologies that are strictly necessary to operate the Services (for example, authentication session cookies), and a limited set of functional and analytics cookies that help us understand how the Services are used. Most browsers let you block or delete cookies; doing so may affect your ability to use parts of the Services. We do not use third-party advertising cookies.

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact support@databuilt.ai and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes we will provide notice by, for example, updating the effective date at the top of this page and emailing you or posting a prominent in-product notice. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, contact us at support@databuilt.ai.