Digitalis Connect ([Registered address to be completed]) is the data controller for personal data processed through SaaS Builder. For privacy questions, contact privacy@saas-builder.com.

Account and contact data

Your email address, your phone number in international format and the authentication records needed to sign you in. During onboarding we also collect your first and last name, your country, your preferred language and how you would like us to contact you. Your phone number is private: why we ask for it and who sees it is set out in your phone number.

Project data

What you tell us about your idea during onboarding, the Blueprints generated from it, your order and its build history, the feedback you send on previews, and your Academy progress.

Connection metadata

For each provider you connect: which provider it is, the connection's status, the display name of the connected account or team, its identifier, and non-sensitive summary information such as how many projects or repositories are reachable. This is what lets the app show you an accurate connection card.

Provider credentials

Where a provider issues a long-lived credential, we store it encrypted. See how credentials are protected.

Payment data

Your order, its amount, its payment status and the Stripe identifiers that link them. Payments are handled by Stripe; we never receive or store your full card details.

Operational logs and audit trail

Records of provider operations performed on your behalf, and structured error logs used to diagnose failures. Both are redacted before they are written.

We ask for a phone number when you create an account; accounts created before that, or through GitHub, give it before subscribing. We do not check it by text message: no SMS is sent.

Why we collect it

• Account security: to reach you when something about your account needs it.
• Preventing abuse of the trial: the 3-day trial is limited to one per phone number. When a trial starts we record a SHA-256 hash of the number with it. Such a hash can be matched back to the number by trying every possible number, so we treat it as personal data. That record is kept after the account is deleted, so the same number cannot start a second trial.
• Contacting you about your account: billing, support and your projects.

Who sees it

You and the SaaS Builder team. It is never shown publicly and never sold. When you open a subscription checkout it is also sent to Stripe, our payment processor, with your customer record, even if you do not complete the payment; Stripe may use it to detect fraudulent payments.

How long we keep it

While your account exists. Deleting your account deletes it from our database. The hash kept with a trial record stays, as described above, and Stripe keeps its copy with your customer record under its own retention rules for payment records.

• Your passwords for any third-party provider. We never ask for them and have no way to receive them.
• Credentials for your own AI assistant accounts, including Claude. You use your own account; we never ask for its details.
• Your full payment card details. These go directly to Stripe.
• The values of environment variables in your hosting projects. We write them; we never read them back.
• The contents of your databases or the traffic of your deployed applications.
• Any access token, refresh token, client secret or encryption key in a log line. Log output is filtered by key name and by token shape before it is written.

• Credentials are encrypted with AES-256-GCM before they reach the database, bound to the connection they belong to so a record cannot be reused elsewhere.
• They are stored in a table that has row-level security enabled with no policies and no grants to user sessions, so it is unreachable from a browser even with a valid session token.
• They are never sent to the browser. Every call to a provider is made from our servers.
• Encryption keys are versioned so they can be rotated without losing access to existing data, and are held only in server-side configuration.
• GitHub is stronger still: no GitHub credential is stored at all. Short-lived tokens are minted per request and discarded.
• Disconnecting a provider deletes the stored credential.

• To provide the service you asked for: building projects, and acting on the accounts you connected. Basis: performance of our contract with you.
• To bill you and manage subscriptions. Basis: performance of our contract, and our legal obligations.
• To keep the service secure, diagnose failures, and prevent abuse. Basis: our legitimate interests in operating a reliable service.
• To contact you about service changes, incidents or support. Basis: performance of our contract, and our legitimate interests.

We do not sell your data, and we do not use your project content or prompts to train our own models.

We use a small number of providers to run the service:

• Supabase — database and authentication for the platform itself.
• Vercel — hosting for the platform itself.
• Stripe — subscription payments.
• AI model providers — to generate code from your prompts. Your prompts and relevant project context are sent to them for that purpose.

Separately, the providers you choose to connect, such as GitHub, Supabase and Vercel, process data in your own accounts under their own privacy policies and your relationship with them.

• Account and project data: while your account exists.
• Provider credentials: until you disconnect the provider or delete your account, whichever comes first.
• Billing records: as long as required by tax and accounting law, which is typically several years.
• Error logs and audit records: retained for a limited operational period, then deleted.
• When you delete your account, we delete or irreversibly anonymise your personal data except where we must keep it by law, and except the trial record described under “Your phone number”.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable form, and withdraw consent where we relied on it.

Exercise any of these by emailing privacy@saas-builder.com. We respond within one month. If you are in the EEA or the UK and you are unhappy with our response, you may complain to your local data protection authority.

Our providers may process data outside your country, including in the United States. Where that happens we rely on appropriate safeguards, such as the European Commission's standard contractual clauses or an adequacy decision.

We use cookies that are strictly necessary to run the service: keeping you signed in, and protecting authorization flows against cross-site request forgery. These are short-lived and marked so that a browser script cannot read them. We do not use advertising cookies.

If you believe you have found a security issue, email privacy@saas-builder.com with the details. Please give us a reasonable opportunity to fix it before disclosing it publicly.

More detail on the technical measures behind this policy is in the documentation. We may update this policy; the date above shows the current version.