Privacy Policy
Buildeon Systems (“Buildeon”, “we”, “us”, or “our”) is committed to protecting your personal data, maintaining strict transparency, and respecting your privacy rights across all our websites, self-hosted applications, client intake endpoints, and developer platform integrations.
1. Overview & Scope
This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you visit buildeon.solutions, use our intake and enquiry forms, access our developer tools and directory, or authorize social media and developer integrations powered by our platform.
2. Information We Collect
We collect information in the following categories:
A. Direct Inquiries & Intake Briefs
When you submit a project brief or intake request (for example, via our /work-with-us/ form), we collect your
professional email address, current technical stack, business goals, and any specific software or solutions you are evaluating.
We also collect the referring source and variant parameters associated with your session to route your inquiry to the appropriate engineering team.
B. Social Media & Developer Platform Integrations (OAuth)
When you authorize an integration with third-party social networks or developer platforms (including LinkedIn, X/Twitter, GitHub, or Google) via our internal tools or self-hosted applications (such as Postiz):
- We receive authorization tokens (OAuth access and refresh tokens) and unique platform identifiers necessary to execute approved actions on your behalf.
- We access public profile information (such as account name, username/handle, and profile picture) strictly to display active connection status in your dashboard.
- We do not store your external platform passwords. Authentication occurs directly on the respective provider’s secure OAuth servers.
C. Technical Telemetry & Submission Metadata
When you interact with our websites, our web server logs standard protocol telemetry (HTTP request method, IP address, user agent, and timestamp) for DDoS mitigation, security auditing, and server health. When you submit an inquiry form, our form engine also stores the submitter's IP address, browser user agent, and HTTP referrer header alongside the submission record to prevent automated bot spam, enforce rate limiting, and establish submission provenance.
3. How We Use Your Information & Legal Bases
We process personal and technical data for specific, lawful purposes under the GDPR, UK GDPR, and applicable privacy laws:
- Delivering Services: To deliver systems architecture, headless commerce integrations, and custom workflow development requested by you (Contractual Necessity).
- Executing Authorized Actions: To publish, schedule, or measure content on social accounts you have explicitly connected and authorized (Consent).
- Platform Reliability & Anti-Spam: To protect our network, maintain infrastructure uptime, prevent abuse, and block automated form spam (Legitimate Interests).
- Direct Communications: To respond to audit requests, technical briefs, and sales inquiries initiated by you (Legitimate Interests).
4. Sub-Processors & Service Providers
We minimize third-party data processing. However, we engage trusted infrastructure partners to operate our services:
- Hosting Infrastructure: Cloud server and container hosting located in secure data centers in Germany and the EU, operating under GDPR Data Processing Agreements.
- Transactional Email Relays: Authenticated email dispatch providers (such as Zoho Mail) to deliver notifications of incoming form submissions to our engineering team.
We never sell, rent, license, or trade your personal data, platform credentials, or social media tokens to third-party data brokers, advertising networks, or AI model trainers.
5. Third-Party Platform Compliance (LinkedIn & X)
We adhere strictly to the developer policies established by third-party platform providers:
- LinkedIn Developer Agreement: We comply with all LinkedIn API terms. We only request scopes required for authorized operations, and we never use LinkedIn data to build independent contact databases or reverse-engineer member profiles.
- X (Twitter) Developer Policy: We do not conduct automated scraping, unsolicited messaging, surveillance, or sentiment tracking of third-party users. Posting via the X API is done strictly with authenticated user permission.
6. Data Storage, Security & Retention
All data in transit is encrypted using modern TLS (Transport Layer Security 1.2 or higher / HTTPS). Connection tokens, credentials, and submission records are stored in access-controlled databases behind isolated network perimeters with strict least-privilege administrative access.
Retention Periods:
- Project Inquiries & Briefs: Stored for up to 12 months following the last communication to facilitate ongoing project discussions and follow-ups, after which they are securely deleted.
- Web Server Access Logs: Retained on a rolling 30-to-90 day rotation for security auditing and purged automatically.
- OAuth Tokens: Retained only until revoked by the user or invalidated by the platform provider.
7. Your Rights & Supervisory Authority Complaints
Under applicable data protection laws (including the EU GDPR, UK GDPR, and California CCPA/CPRA), you have the right to:
- Request access to the personal data we hold about you.
- Request correction of inaccurate or incomplete personal information.
- Request deletion of your personal data (“Right to be Forgotten”).
- Object to or restrict the processing of your personal data.
- Request transfer of your data in a structured, machine-readable format.
If you are located in the European Economic Area (EEA) or the United Kingdom and believe our processing of your personal data infringes your statutory privacy rights, you have the right to lodge a complaint with a competent supervisory authority (such as the UK Information Commissioner’s Office or your local Data Protection Authority in the EU).
Revoking Third-Party OAuth Permissions
You can instantly revoke our application’s access to your social media accounts at any time through your provider’s security settings:
- LinkedIn: Go to Settings & Privacy → Data Privacy → Other Applications → Permitted Services and remove the app.
- X (Twitter): Go to Settings and Privacy → Security and account access → Apps and sessions → Connected apps and revoke access.
8. Cookies & Tracking Technologies
We operate a privacy-first, minimal-cookie website. We do not use third-party advertising cookies, cross-site trackers, or invasive analytics pixels. Any cookies used are strictly functional and essential for secure session handling and site integrity.
9. Contact Information & Data Controller
The data controller responsible for personal data processed through this website is: