Privacy Notice

Buildy Privacy Notice

Last Updated: May 5, 2026

Welcome to Buildy, a hosted Model Context Protocol (MCP) server that generates, stores, and renders interactive web apps that you can call from MCP clients such as Claude.ai, ChatGPT, Claude Desktop, and other compatible agents. This Privacy Notice explains how Fractal Dynamics, Inc. d/b/a Buildy ("Buildy," "we," "our," or "us") collects, uses, discloses, and otherwise processes personal data in connection with the Buildy Platform (as defined in the Buildy Terms of Use).

This Privacy Notice does not address our privacy practices relating to Buildy job applicants, employees and other employment-related individuals. Data that is not subject to applicable data protection laws (such as deidentified or publicly available information) is also out of scope.

This Privacy Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law.

1. Our Role in Processing Personal Data

Data protection laws sometimes differentiate between "controllers" and "processors" of personal data. A "controller" determines the purposes and means (the why and how) of processing personal data. A "processor," which is sometimes referred to as a "service provider," processes personal data on behalf of a controller subject to the controller's instructions.

This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. It does not cover or address how our customers may process personal data when they use our services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. We recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. We are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.

2. Our Collection and Use of Personal Data

The categories of personal data we collect depend on how you interact with us and our services. For example, you may provide us your personal data directly when you create an account or connect Buildy from an MCP client.

2.1 Personal Data Provided by Individuals

• Contact Information, including first and last name, email address, and communication preferences. We use this information primarily to fulfill your request, to communicate with you directly, and to send you product communications in accordance with your preferences.
• Account Information, including account credentials, OAuth tokens, one-time passcodes, and the products or services you are interested in or have used. We use this information to administer your account, provide you with our Platform, communicate with you regarding your account, and for customer support.
• App Data you create, generate, or modify on the Platform, including the source of generated apps (modules, UI, styles), saved app state, and metadata about apps (titles, descriptions, timestamps, versions). We use this information to render apps for you, persist your apps across MCP clients, and improve the Platform. App Data is described in further detail in our Terms of Use as "User Data."
• Don't share secrets in prompts. Buildy does not collect your raw chat messages. When you ask an AI assistant to build something with Buildy, your assistant sends Buildy only the structured arguments each tool needs to run — for example the generated app code, a short app description, and identifiers — not a copy of your conversation. Even so, your assistant may incorporate text from your message into the app code or description it generates and sends to us. So do not include passwords, API keys, access tokens, or other credentials in messages you send to AI assistants when using Buildy. Treat prompt input as you would a public chat; anything that ends up in your generated app content may be retained and reviewed for product improvement and abuse prevention.
• Tool Response Snippets. To evaluate whether the Platform is producing the right answers, we retain a truncated preview (up to 2 KB) of the text Buildy returns in response to most tool calls. For example, success confirmations, app listings, and error messages surfaced to your AI assistant. Snippets are omitted for tools whose responses contain your full app source or arbitrary application output (today: get_app_source, query_app, and mutate_app). The full source of your apps and the data your apps store remain App Data and continue to be governed by the bullet above.
• Payment Information, including payment card information, billing address, usage credits, and other financial information. We use third-party payment processing providers, including Stripe, to process payments. We do not retain personally identifiable financial information such as payment card numbers; that information is provided directly by you to our third-party payment processors. The payment processor's use of your personal data is governed by its privacy notice (see Stripe's privacy policy).
• Feedback and Support Information, including the contents of messages sent through our forms, chat, or email, as well as recordings of calls with us where permitted by law. We use this information to investigate and respond to your inquiries and to improve our Platform.

2.2 Personal Data Automatically Collected

We, and our third-party partners, automatically collect information about how you access and use our Platform when you engage with us, including via cookies, web beacons, pixels, embedded scripts, and logging technologies.

• Information About Your Device and Network, including the device type, operating system, IP address, browser type, MCP client identifier (when applicable), and unique identifiers associated with you, your device, or your network.
• Information About How You Use Our Services, including which apps you create, render, and call; how often you connect from each MCP client; pages you visit on our Website; and how you interact with our content, including links you click. When a hosted app is opened, we record a view event (including for visitors without a Buildy account); for apps not yet claimed to an account we attribute these events to a non-identifying per-app identifier rather than to you, and we set a cookie to distinguish first-time from returning views.
• Information About Your Location, including general geographic location derived from your IP address. We use this to optimize routing and reduce latency.

For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the "Your Privacy Choices" section below.

2.3 Personal Data from Other Sources and Third Parties

• Single Sign-On and OAuth Providers. We may provide you the ability to log in to Buildy through third-party identity providers (for example, Google), or to connect your Buildy account to MCP clients (such as Claude.ai or ChatGPT) via OAuth 2.0 with Dynamic Client Registration. We do not receive your password from these providers; we receive identifiers, OAuth tokens, and basic profile information needed to identify you and provision access.
• MCP Client Metadata. When you connect from an MCP client, that client registers with us and may transmit a client name, redirect URI, and capability metadata. We use this information to authenticate the client and route tool calls.
• Service Providers who perform services on our behalf may share information with us, including analytics, error monitoring, and infrastructure providers.
• Our Affiliates. Buildy is provided by Fractal Dynamics, Inc. and its affiliates. Affiliates may share personal data with us for purposes consistent with this Privacy Notice.
• Other Sources, including publicly available sources, third-party data providers, and transactions such as mergers and acquisitions.

2.4 Additional Uses of Personal Data

In addition to the primary purposes described above, we may also use personal data to:

• Fulfill or meet the reason the information was provided;
• Manage our organization and its day-to-day operations;
• Communicate with you, including via email, chat, or social media;
• Address inquiries or complaints about our products or services;
• Create and maintain accounts for our users;
• Verify your identity and entitlement to the Platform;
• Develop, operate, improve, maintain, protect, and provide the features and functionality of our Platform;
• Identify and analyze how you use our Platform;
• Create aggregated or de-identified information that cannot reasonably be used to identify you;
• Conduct research and analytics on our user base and our Platform;
• Test, enhance, update, and monitor the Platform, or diagnose or fix technology problems;
• Maintain the safety, security, and integrity of our property, products, services, technology, and business;
• Defend, protect, or enforce our rights or applicable contracts and agreements;
• Detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity;
• Facilitate business transactions and reorganizations;
• Comply with contractual and legal obligations; and
• Fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.

3. Our Disclosure of Personal Data

We disclose or otherwise make available personal data in the following ways:

• To MCP Clients You Connect. When you connect Buildy from an MCP client (such as Claude.ai or ChatGPT), we make available to that client the apps, tool definitions, and app state required for the client to render and operate your apps on your behalf. The MCP client's handling of that data is governed by its own privacy practices.
• To Service Providers, including hosting and database providers, error monitoring, email delivery, analytics, and customer support tools.
• Subprocessors. A current list of the subprocessors we use to operate the Platform is available at buildy.so/subprocessors.
• To Our Affiliates, for purposes consistent with this Privacy Notice.
• To Other Businesses as Needed to Provide Services, including payment processing.
• In Connection with a Business Transaction or Reorganization, such as a merger, acquisition, joint venture, financing, or sale of company assets.
• To Facilitate Legal Obligations and Rights, including to legal advisors and law enforcement: in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal process; to protect our rights and property; to detect, suppress, or prevent fraud; to reduce credit risk and collect debts owed to us; to protect the health and safety of any person; or as otherwise required by applicable law.
• With Your Consent or Direction.

4. Your Privacy Choices

4.1 Communication Preferences

You can stop receiving promotional email communications from us by clicking on the "unsubscribe" link in any of our email communications. You cannot opt out of service-related email communications such as account verification, transaction confirmation, or service update emails.

4.2 Withdrawing Your Consent

Where we have your consent for the processing of your personal data, you may withdraw your consent by following the instructions provided when your consent was requested or by contacting us as set forth in the "Contact Us" section below.

4.3 Automatic Data Collection Preferences

Most browsers allow you to change browser settings to limit automatic data collection technologies. Most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies. Many devices allow you to change device settings to limit automatic data collection. Blocking these technologies may negatively impact your experience using our services.

4.4 Disconnecting MCP Clients

You can revoke access for any connected MCP client at any time by disconnecting Buildy from within the MCP client itself (where supported), or by emailing [email protected]. Revoking access invalidates the OAuth tokens issued to that client; the client will no longer be able to read or modify your apps or app state until you reconnect.

4.5 Modifying or Deleting Your Personal Data

You can permanently delete any individual app at any time through any connected MCP client (using the delete_app tool) or your Buildy account. For all other requests (including modifying account information, deleting your account, or reviewing the personal data we hold about you), contact us at [email protected]. We may not be able to modify or delete your personal data in all circumstances (for example, where retention is required by law).

5. Children's Personal Data

Our services are not directed to children. As described in our Terms of Use, you must be at least 18 years old to use the Platform. We do not intend to, or knowingly, collect or solicit personal data from children under the age of 13. If a child under 13 has provided personal data to us, we encourage the child's parent or guardian to contact us so that we can remove the personal data from our systems.

6. Third-Party Websites and Services

Our services may include links to third-party websites, plug-ins, applications, and other services, including the MCP clients you connect Buildy to. Except where we post, link to, or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the privacy practices of third parties, please visit their respective privacy notices.

7. Data Retention

We retain personal data for as long as necessary to provide the Platform, comply with our legal obligations, resolve disputes, and enforce our agreements. App Data is retained while your account is active and for ninety (90) days after deletion of the App or your Account to allow recovery from accidental deletions, after which it is permanently purged, except where we are required to retain it for legal, tax, or fraud-prevention purposes. You can permanently delete an app at any time through any connected MCP client or your Buildy account.

8. Your Privacy Rights and Legal Basis

Depending on where you reside, you may have specific rights regarding your personal data under applicable law.

8.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal data we collect, use, and disclose; to request deletion or correction of your personal data; to opt out of the sale or sharing of your personal data (we do not sell or share personal data as those terms are defined under California law); and to not be discriminated against for exercising any of these rights. To exercise any of these rights, contact [email protected].

8.2 EU, UK, and EEA Residents (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You also have the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, contact [email protected].

8.3 Legal Basis for Processing

Where GDPR applies, our legal basis for processing personal data depends on the purpose: we process personal data necessary to provide the Platform on the basis of contract performance; we process personal data for security, fraud prevention, product improvement, and analytics on the basis of our legitimate interests; and we process personal data for marketing communications on the basis of your consent (which you may withdraw at any time).

8.4 International Data Transfers

Buildy is based in the United States, and personal data we process may be transferred to, stored in, and processed in the United States and other countries. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on Standard Contractual Clauses or other appropriate safeguards as required by applicable law.

9. Updates to This Privacy Notice

We may update this Privacy Notice from time to time. When we make changes, we will change the date at the top of this Privacy Notice. If we make material changes, we will notify individuals by email to their registered email address, by prominent posting on this website, or through other appropriate communication channels. All changes are effective from the date of publication unless otherwise provided.

10. Contact Us

If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please contact [email protected].