Privacy Policy
Effective date: 13 March 2026
This Privacy Policy explains how Relva LTD ("we", "us", "our") collects, uses, and protects your personal data when you use BuildCast. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data We Collect
Account Information
When you sign up, we collect your email address, display name, and profile picture as provided by your authentication provider (GitHub). This data is stored in our Supabase database.
GitHub Data
We receive webhook events from repositories you connect, including commit messages, pull request titles and descriptions, issue metadata, and release information. We store OAuth access tokens (encrypted) to interact with the GitHub API on your behalf.
Social Account Tokens
When you connect social platforms (Twitter/X, LinkedIn, Bluesky, Instagram, Facebook, Reddit, TikTok, Threads, YouTube, Pinterest, Mastodon, Tumblr, Discord), we store OAuth access tokens and refresh tokens (encrypted) to publish content on your behalf.
Generated Content
AI-generated captions, post drafts, publication history, and scheduling data are stored in our database.
Media Assets
Images and media files you upload or that are generated as part of the content pipeline are stored on Cloudflare R2.
Usage Data
We collect basic analytics such as pages visited, features used, and error logs to improve the service. We may use cookies or similar technologies for this purpose.
2. How We Use Your Data
We use your data to:
- Authenticate you and manage your account
- Receive GitHub webhook events and generate AI-powered social media content
- Publish content to your connected social accounts
- Store and serve your media assets
- Process payments and manage subscriptions
- Send transactional emails (e.g. account notifications)
- Improve the service and fix bugs
- Comply with legal obligations
Our legal basis for processing is contractual necessity (to provide the service you signed up for) and legitimate interest (to improve and secure the service).
3. Third-Party Services
We use the following third-party services to operate BuildCast. Each processes data only as necessary to provide their respective functions:
| Service | Purpose |
|---|---|
| Supabase | Authentication, database, and real-time subscriptions |
| Cloudflare R2 | Media asset storage and delivery |
| Groq | Primary AI provider for content generation |
| Google Gemini | Secondary AI provider for content generation |
| Anthropic | Fallback AI provider for content generation |
| Inngest | Background job processing (content generation, scheduled posts, analytics) |
| Stripe | Payment processing and subscription management |
| Sentry | Error monitoring and performance tracking |
We do not sell your personal data to any third party. Data shared with AI providers (Groq, Gemini, Anthropic) is limited to commit metadata needed for content generation and is not used to train their models.
4. Data Retention
We retain your data for as long as your account is active or as needed to provide the service. When you delete your account:
- Account data and OAuth tokens are deleted within 30 days
- Generated content and post history are deleted within 30 days
- Media assets on Cloudflare R2 are deleted within 30 days
- Anonymised analytics data may be retained indefinitely
- Data required by law (e.g. billing records) may be retained for up to 7 years
5. Your Rights (GDPR)
Under the UK GDPR and the Data Protection Act 2018, you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data ("right to be forgotten")
- Right to restrict processing — request that we limit how we use your data
- Right to data portability — request your data in a machine-readable format
- Right to object — object to processing based on legitimate interest
To exercise any of these rights, contact us at support@buildcast.app. We will respond within 30 days.
6. Cookies
BuildCast uses the following types of cookies:
- Essential cookies — required for authentication and session management (Supabase auth tokens)
- Preference cookies — store your theme preference (dark/light mode)
We do not use advertising or tracking cookies. We do not participate in cross-site tracking.
7. Data Security
We implement appropriate technical and organisational measures to protect your data, including encryption of OAuth tokens at rest, HTTPS for all data in transit, and access controls on our infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
8. International Data Transfers
Some of our third-party service providers process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, in compliance with the UK GDPR.
9. Children's Privacy
BuildCast is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the service. The "Effective date" at the top of this page indicates when this policy was last revised.
11. Contact
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:
Email: support@buildcast.app
Company: Relva LTD
Jurisdiction: England and Wales, United Kingdom