BildrX Privacy Policy

This policy describes how BildrX collects, uses and shares information in connection with the BildrX platform — the marketing site at bildrx.com and the product at app.bildrx.com (the Service).

Privacy questions and requests go to legal@bildrx.com.

The application and the database run in Singapore: Amazon Web Services region ap-southeast-1, with Supabase providing the Postgres database, authentication and file storage in the same region. Your uploaded documents — decks, financials, contracts, data-room files — are stored there.

This is a correction. An earlier version of this policy said BildrX’s infrastructure was hosted in the United States. That is no longer true, and we would rather say so than quietly edit it.

The public marketing site is a set of static files distributed by CloudFront, which caches them on edge servers worldwide so pages load quickly wherever you are. Those files are identical for every visitor and contain nobody’s data.

Some of the third parties in Section 10 process data outside Singapore. Where that happens, your information crosses a border.

3.1 Information you provide directly

• Account information: name, email address and password — or, if you sign in with Google, Microsoft (a work or school account) or LinkedIn, the name, email address and profile information that service shares with us, and the identifier it gives your account (for Microsoft, also the identifier of your organisation’s directory). Signing in asks those services for these basics only: we get no access to your mailbox, files, contacts or connections, and we use what they send to sign you in, to recognise your account the next time, and to fill in your name. Also your two-factor settings and session records.
• Company profile: company name, stage, industry, location and the other details you enter so the product can tailor investor matching and dashboard content.
• Cap table data: stakeholder names and email addresses, security type, share quantities, price per share, issue dates, vesting terms and the full transaction history. Most of these people are not BildrX users — see Section 6.
• Investor CRM data: your notes, pipeline stages, tasks and activity history about the investors you are tracking.
• Data Room and Legal Room documents: the files you upload — pitch decks, financial models, cap-table backups, contracts and other diligence material.
• E-signature information: signer name, email address, signature and consent data, and the audit trail of who opened, viewed and signed a document, and when. Routed through SignWell.
• Payment information: payment is handled by Stripe. We never receive or store your full card number; we hold the Stripe customer, subscription and payment identifiers, your plan and billing status, and the last four digits of the card.
• Marketplace content: the briefs and requirements you submit, and the deliverables BildrX returns.
• AI prompts and context: see Section 4.
• Communications: whatever you send us when you contact support.

3.2 Information collected automatically

• Usage data: pages visited, features used, and similar interaction data within the Service.
• Device and log data: IP address, browser type, operating system and timestamps — the ordinary logs needed to run and secure a web service.
• Shared-link analytics: see Section 5. This one is about the people you send links to, not about you.
• Cookies: see Section 13.

3.3 Onboarding questions

When you set up a workspace we ask your role (founder, finance or legal and, for finance and legal, whether you work on your own company or for clients) and which parts of BildrX you want to use. We use those two answers to arrange your sidebar and dashboard.

We also ask a few questions that are entirely optional. Each one is marked as optional and can be skipped:

• Where you are based: country and, if you like, city.
• Team size: a range such as 2–5 or 6–20 people.
• Advisers: which kinds of adviser you or your company already work with, such as a lawyer, an accountant or a corporate service provider.
• How you heard about BildrX: one of a list of sources, or a few words of your own.
• Gender: male, female, or prefer not to say.

Why we ask: to understand who uses BildrX and where, so we can decide what to build next. These answers do not change what the product shows you, what you can do, or what you pay.

Who can see them: you, and BildrX staff with administrator access, who can view them in an internal dashboard and download them as a CSV file. That table and the CSV list each person's answers next to their role, chosen suites, country of incorporation and signup date, but not their name or email address. Other members of your company cannot see your answers to the optional questions; your role and chosen suites are saved on your profile, which the people in your company can see. Our hosting providers, Amazon Web Services and Supabase, store them as they store the rest of your account; apart from them, the answers are not shared with any of the third parties in Section 10.

Feature waitlists: when you press “Notify me” on a feature that is launching soon, or tick a suite that includes one, we record that you are waiting for it, together with your role, so we can count demand for each feature.

AI in BildrX is not just the chat box. Several features send your content to Anthropic, our AI provider, to generate a response:

• Pitch deck analysis sends the text extracted from the deck you uploaded; the score and the written feedback come back from the model.
• Legal Room sends contract text to produce clause suggestions and to extract expiry dates.
• Deal Room sends document and workspace context to build diligence checklists.
• Investor briefs and marketplace search send your query together with the relevant workspace context.
• Copilot chat sends your prompt together with a summary of your workspace — which can include CRM notes, cap-table figures and document titles — so the answer is about your company rather than a generic one.

In practice that means uploaded decks, contract text, CRM notes and workspace summaries all reach Anthropic when you use these features. Nothing is sent when you do not use them.

Anthropic processes this material to return a response and does not train models on it. We keep the prompt and the response so you can see your own history. Output from these features is machine-generated and can be wrong — the Terms of Service says more about that.

When you share a deck or data room by link, BildrX tracks the visit and shows you the result. That is the point of the feature, and the people you send links to should know it happens.

For each visit we record:

• the viewer’s IP address;
• a coarse device class — desktop, mobile or tablet;
• a two-letter country code derived from the request;
• when the visit started and ended, and how long it lasted;
• per-page dwell time — how long they spent on each individual slide or document — and how far through they got.

If you used a per-recipient link, all of this is tied to the name and email address you gave that recipient.

We set a cookie called deck_viewer_token in the viewer’s browser, which lasts one year. It exists so that the same person returning later is counted as a repeat viewer rather than a new one.

This information is visible to the founder who shared the link, in their deck analytics. It is not sold, not shared with other founders, and not used for advertising.

If you share links from BildrX, you are the one deciding to track those viewers. Telling them is your responsibility.

A large part of what BildrX stores is not about the account holder. It is about the people the account holder adds: co-founders, employees with equity, investors in a CRM pipeline, signers on a document. Many of them never created an account and may not know the record exists.

We hold that data on your instruction, to provide the product to you. We do not email those people on our own initiative and we do not use their details for anything besides the features you are using.

If one of them contacts us about their data we will normally refer them to you, because you decided to record it. We will help you respond.

BildrX ships with a database of investors — firms, focus areas and contact details — that founders can search and add to their CRM. It is ours; it is not assembled from what users enter.

Its provenance is currently under review. We are working through where each record came from, whether the source permitted redistribution, and what notice the individuals named in it are owed. Until that review finishes we are not going to claim the dataset is fully documented, because it is not.

If you are named in it and want your record corrected or removed, write to legal@bildrx.com and we will do it.

• To run the features you are using — cap table, CRM, data room, e-signature routing, AI features, marketplace;
• to authenticate you and keep accounts secure;
• to take payment and manage subscriptions;
• to answer support requests;
• to diagnose faults and improve the product;
• to meet legal obligations and enforce the Terms of Service.

We send product and marketing email only if you opted in. The box at signup is separate from the terms box and is never pre-ticked; you can turn it off at any time. Operational email about your account, billing and security is not marketing and is sent regardless.

We do not sell personal information, and we do not run advertising.

Creating an account requires ticking a box agreeing to the Terms of Service and this Privacy Policy. We store which version you agreed to — the string 2026-09-29 — and the timestamp.

A second, optional, unticked box records whether you want marketing email. Its answer is stored alongside.

If either document changes materially, the version string changes and you are asked again inside the product.

We share information with the following service providers (“subprocessors”) solely to operate the Service.

We may also disclose information to comply with law, a subpoena or legal process; to protect the rights, property or safety of BildrX, our users or others; or in connection with a merger, acquisition or sale of assets, with notice to affected users.

We do not have a published retention schedule yet.

What is true today:

• Data stays while the account is active.
• The cap-table ledger is append-only by design — corrections are recorded as new reversing entries, so historical rows are not deleted. This reflects how cap tables work in practice and is disclosed in-product.
• Backups are kept for operational recovery.
• Logs are kept for a period we have not fixed.
• When an account is closed we delete data on request, manually, and confirm what was removed.

You can ask for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to stop a particular use, and withdraw marketing consent. Withdrawing consent does not undo what was done before.

How this works in practice: export and deletion are handled by a person, not a button. You can edit your profile and most of your workspace content in the product, but a full export or a full deletion means writing to legal@bildrx.com. We will acknowledge the request, check you are who you say you are, carry it out, and confirm what was done.

A self-service export and a self-service delete are on the roadmap. Until they exist, the manual route is the route, and we would rather say so than imply a button that is not there.

Signing in sets a session cookie. It is required — without it you cannot stay logged in — and it is used for nothing else.

Opening a BildrX share link sets deck_viewer_token, which lasts one year and lets the founder who shared the link tell a returning visit from a new viewer. Section 5 describes the whole of what a shared-link visit records.

Google Analytics is optional and off until you say otherwise. The first time you open app.bildrx.com we ask, with two answers: essential only, or essential and analytics. Until you pick the second one, no Google script is loaded, no Google cookie is set, and your browser makes no request to Google at all. Choosing essential only changes nothing about how BildrX works.

If you accept, Google Analytics 4 (run by Google LLC) sets its own cookies in this browser — _ga, which holds a random identifier for the browser and lasts about two years, and a _ga_ cookie holding session state for about the same period. What we send Google is the address of the screen you are on and what your browser tells any website it visits, including your IP address.

What Google is never sent: your name, your email address, your company’s name, the title of any document, deck or data room, any share link, any cap-table or CRM content, and any identifier we hold for you. Before an address is sent it is stripped of record identifiers and share links, so a data room is reported as /deal-room/:id rather than as a link anyone could follow. We do not use Google Analytics for advertising: ad storage, ad personalisation and Google Signals are switched off in the code that loads it.

Accepting means this information is processed by Google on infrastructure that includes servers in the United States. You can change your mind at any time in Settings → Security → Analytics cookies, which also lets you clear the answer so you are asked again. If your browser sends Do Not Track or Global Privacy Control we treat that as a decline and do not ask.

BildrX also measures itself without any third party: a small number of events — a screen opened, a module used, a deck uploaded — are written to BildrX’s own database in Singapore, with no script and no cookie, and carrying no names, email addresses, document titles or share links. That is not optional, because it is how the product is kept working.

The marketing site’s own cookie choices are described in its cookie policy.

Data is encrypted in transit and at rest. Access inside the product is scoped by role and enforced in the database itself, so a query cannot return another company’s rows. Signature events carry an audit trail. Two-factor authentication is available and we recommend turning it on.

No method of transmission or storage is completely secure, and we will not claim otherwise. If a breach affects your data we will tell you.

The Service is for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children.

We may update this policy. We will post changes on this page and update the version and date at the top. Material changes come with a new version string and a fresh consent prompt inside the product.

Questions about this policy? Contact us at legal@bildrx.com.