Privacy Policy

The short version. Built Co stores your account details and the vehicle records, documents, plans, and photos you choose to save. Shop processes orders through payment and fulfillment providers. Location and reminders are optional. Record and document files use private storage; generated vehicle artwork uses public image URLs. Account deletion has an exception for retained Shop records, explained below.

This policy explains what BUILT CO (“BUILT CO”, “we”, “us”) collects when you use the BUILT CO iOS app and this website, how we use it, who receives it, and the choices you have. It applies to the private beta and will be updated as the product changes.

1. What we collect

Account and policy acknowledgement information

We collect the email address used to create, verify, and recover your account, an account identifier, and the profile details you provide, such as your name and phone number. The app uses email and password sign-in. Passwords are sent over an encrypted connection to our authentication provider, which stores a cryptographic hash, not a readable password in our account database.

The updated app asks you to agree to the Terms of Service and acknowledge this Privacy Policy. When you submit that choice, we record the account, document versions, and server acceptance time. This record cannot be edited from the app. Acknowledging this policy is not blanket consent to optional photo, camera, location, or notification permissions.

Vehicles, records, documents, and plans

Saved information can include vehicle year, make, model, trim, color, nickname, an optional VIN, mileage, service and fuel history, costs, purchase items, notes, receipts, photos, PDFs, Modlist selections, work tasks, wish lists, and maintenance reminders. Documents can contain identity, insurance, registration, or other information you choose to upload. A VIN identifies a particular physical vehicle and can be linked to its owner when combined with other records.

You choose the photos you provide through the photo picker or camera. Receipt text recognition runs on your device; saved extracted text can be stored with the record and included in its report. Upload only material you have the right to provide.

Artwork and AI features

Artwork requests send vehicle details, selected appearance options, modification descriptions, and any reference photo you choose to OpenAI. Generated vehicle artwork is stored and served through a public image URL, which anyone with that URL can access. Avoid private documents, faces, license plates, or other identifying details in reference photos and prompts you do not want processed for this purpose or reflected in public artwork.

Maintenance generation sends catalog year, make, model, and trim to OpenAI, without your account identity, VIN, or location. We store validated schedule results for reuse. Generated suggestions may be inaccurate; compare them with your manufacturer’s guidance. Provider processing is also described in OpenAI’s API privacy information. We do not promise that provider processing has no retention.

Shop and support

Shop stores checkout contact and shipping details, line items, totals, order status, and payment and fulfillment references. Stripe handles card and Apple Pay payment details. Built Co’s database does not store full card numbers. See Stripe’s Privacy Policy for its payment processing practices. If you email us or submit feedback, we receive your contact information and the contents you choose to send.

Technical information

Service providers process operational information such as IP addresses, timestamps, user agents, and request outcomes to operate services, prevent abuse, and diagnose faults. App diagnostics are recorded in device logs. Support messages or screenshots you send may include additional details you choose to share.

2. Optional location, reminders, and device permissions

With your permission, location supports nearby-place searches. Optional Fuel Up reminders use nearby gas stations and region monitoring on your device; reminders in the background require Always location access. Precise location is not uploaded to Built Co’s database. Nearby searches use Apple’s location and mapping services, which process information under Apple’s location privacy information.

Document-expiration and maintenance reminders use saved dates and mileage and are scheduled on your device. Notifications require system access. You can turn optional reminders off in Profile → Notifications and change location, camera, photo, and notification permissions in iOS Settings. Disabling a permission can limit the feature that needs it. Permissions are separate from agreeing to the Terms or acknowledging this policy.

The app can display Built Co promotions, sponsored content, and vendor links. The current app and website do not use third-party advertising or behavioral-tracking SDKs. No website analytics or advertising tracking scripts are implemented; infrastructure providers may use security cookies. Following a vendor link takes you to that provider’s service and privacy practices.

3. How we use your information

• Create and authenticate your account, verify your email, and help you recover access.
• Save, synchronize, display, revise, and export the records and plans you request.
• Look up vehicle information and generate artwork or maintenance suggestions when you use those features.
• Provide optional nearby-place searches and device reminders.
• Process, fulfill, and support Shop orders and payments.
• Record Terms agreement and Privacy Policy acknowledgement versions and time.
• Keep the Service secure, diagnose faults, and respond to support and privacy requests.

Where the GDPR applies, we rely on performance of a contract to provide the services you request, legal obligations where applicable, and our legitimate interests in operating and protecting the Service. Where consent is required for an optional use, we request it separately and you can withdraw it for future use.

4. Email and communications

Account email includes address confirmation, password recovery, and messages related to account changes you request. We also respond to support, beta feedback, order, and privacy inquiries. Payment or fulfillment providers may send communications connected with your order. We do not use purchased mailing lists for promotional email. Deleting an account does not erase retained order contact details or prevent communications needed to resolve an existing order or request.

Send beta feedback to [email protected]. Privacy, legal, and account questions go to [email protected].

5. Who else receives your information

We do not sell your personal information or share it for cross-context behavioral advertising. We disclose information needed to provide the requested features to the providers below. Providers may also have their own security, legal, and regulatory obligations and privacy terms.

We may disclose information when legally required or when necessary to protect the rights, safety, or property of Built Co, users, or the public. If Built Co is involved in a merger, acquisition, or sale of assets, information may transfer with that transaction; we would tell you before it became subject to a materially different policy.

6. Retention, exports, and deletion

We retain application information to provide your account and the features you use. Signing out clears the active session, but pending account-scoped records and files can remain on the device so they can recover and sync when you return to the same account.

Record reports include Service, Mods, and Maintenance records, their receipts, and explicitly linked Alignment, Diagnostics, Dyno, or Inspection documents belonging to the same record and vehicle. They exclude fuel logs, identity, insurance, registration, Other, and unrelated documents. Reports are not a complete personal-data portability export. Confirmed records remain editable; their original confirmation and latest revision dates use the device clock and do not independently verify that work was performed.

Account deletion is available in the app and requires your current password. After cleanup succeeds, it removes your sign-in account, account application data, and owned files, subject to the exceptions below. Do not rely on account deletion being reversible. Copies you exported, shared with someone else, or sent to another service are outside Built Co’s control.

Shop retention exception. Shop order, payment-reference, and fulfillment records remain after the sign-in account link is removed. This includes customer contact and shipping snapshots, purchased items, amounts, and order status. There is currently no automatic fixed deletion date for these retained records. Send requests to [email protected]; we review them under applicable legal, accounting, fraud-prevention, payment, and fulfillment obligations.

Provider logs and backups may retain information separately from the active application database, subject to provider processes and applicable obligations. We do not promise immediate removal from backups or a fixed backup/log retention period in this policy. Contact us with a request concerning retained information.

7. How we protect information

• Connections to our services use TLS encryption in transit.
• Account data and private record/document storage use access controls intended to restrict access to the owner. Catalog data and vehicle artwork can be public.
• Account sessions use iOS Keychain, and sensitive persistent app files use iOS file protection.
• Authentication and payment providers handle password verification and payment credentials through their services.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting personal information, we will notify affected people and regulators as required by law.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, receive it in a portable format, or withdraw consent where processing relies on it. You also have the right not to be discriminated against for exercising applicable rights.

You can review and edit supported data and request account deletion in the app. Its record report is limited to the categories described above. For broader access, portability, retained Shop information, or other privacy requests, write to [email protected]. We may verify your identity and will respond within the period applicable law requires, including permitted extensions. If you are in the EU, EEA, or UK, you can complain to your local data protection authority.

9. International transfers

Built Co is operated from the United States. Our providers may process and store information in the United States and other countries where they operate, whose laws may differ from yours. Where required, transfers are subject to applicable safeguards, such as Standard Contractual Clauses.

10. Children

The Service is not directed to children and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, write to [email protected] so we can investigate and delete it as appropriate.

11. Changes to this policy

This policy is version 2026-09-05. A material update receives a new version. The updated app asks you to acknowledge the new Privacy Policy and agree to the applicable Terms before continuing, and records the versions and server acceptance time. Optional permissions remain separate choices.

This dated version remains at /legal/2026-09-05/privacy. The August 21, 2026 policy is preserved separately; the current policy may change with a new version.

12. Contact

For privacy questions, data requests, or questions about this policy, write to [email protected].