Privacy Policy

bildflow is operated by RULER SMPC, Matzagriotaki 74, Kallithea 17676 GR. For anything about this policy or your personal data, write to bildflow@ruler.agency, or to our data protection contact at legal@ruler.agency.

This policy explains what we do with personal data when a developer runs their business on bildflow, and when their staff, the estate agents they work with, and the buyers of their units use the product.

We are the controller for account data: the staff accounts in a workspace, the owner's billing and company details, support correspondence with us, and the technical logs we keep to run and secure the platform. For that data, this policy describes what we decide to do and why.

We are a processor for workspace data: the leads, buyers, viewings, documents, contracts, payment schedules and messages that a developer puts into their own workspace. The developer is the controller of that data and decides what goes in, who sees it and how long it stays. We act on their instructions, under the Data Processing Agreement.

If you are a buyer or a lead and want your data corrected or erased, the fastest route is the developer whose portal you use — their name is at the top of every page of the portal. They have export and erasure tools built into the product. You can also write to us and we will pass the request on.

Account data: name, work email, role, the workspace and company name, the company's contact and billing details, tax identifiers, plan and subscription state, and the last time each account signed in.

Workspace data entered by the developer: lead and buyer names, emails, phone numbers, notes, viewing appointments, unit allocations, contracts and other uploaded documents, payment schedules and amounts, and in-app messages.

Usage and technical data: audit log entries recording who did what and when inside a workspace, request and error logs, IP address, browser type, and counters for storage and AI usage.

Analytics data, only if you accept analytics cookies: which pages you open and which of a short list of product events happen (for example a sign-up, a booking request or a document download), collected through Google Analytics with a pseudonymous cookie identifier. These events never carry names, email addresses, phone numbers or the ids of people, and page addresses are recorded without personal identifiers: ids in a page's address, and query values such as a buyer, unit or link token, are replaced with placeholders before anything is sent. Nothing about your visit is sent to Google Analytics before you accept.

Communications: emails we send you and your replies, and support requests.

We do not ask for special-category data (health, beliefs, biometrics) and the product has no field for it. Do not put it in free-text notes.

To provide the service you signed up for — creating your workspace, letting people in, storing and showing your data, sending in-app and email notifications, generating exports. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

To take payment and keep accounts — invoicing, tax records, dunning. Legal basis: contract, and our legal obligation to keep accounting records (Art. 6(1)(b) and (c)).

To keep the platform secure and working — abuse prevention, rate limiting, audit logging, debugging, capacity planning, and aggregated statistics that do not identify anyone. Legal basis: our legitimate interest in a secure, reliable service (Art. 6(1)(f)).

To tell you about the product — service announcements, security notices and billing messages go to every workspace because they are part of the service. Product news and marketing emails are sent only with your consent (Art. 6(1)(a)), you can withdraw that consent at any time by telling us, and doing so never affects the service.

To understand how the site and the product are used — which pages are visited, where people drop out of sign-up, which features are used — so we can improve them. Legal basis: your consent (Art. 6(1)(a)), given in the cookie banner and withdrawn at any time from Cookie settings at the foot of every page.

To meet legal obligations and to establish or defend legal claims. Legal basis: legal obligation and legitimate interest (Art. 6(1)(c) and (f)).

When someone in a workspace asks bildflow to draft a description, a listing or a summary, or to draw a concept image, the relevant text from that workspace is sent to our AI providers (Anthropic and OpenAI), which return generated text or an image. This happens on request only — nothing is sent in the background. Social posts made from your own renders are composed on our servers; the renders are not sent to either provider. The one exception: when a staff member chooses one of the project's renders as the reference for a concept image, that render is sent to OpenAI with the request, so the image can follow the building.

Each provider processes the request for us under a data processing agreement and does not use the content to train its models. Generated text and images are stored in your workspace like any other content you create.

Account data: for as long as the workspace exists, then for 12 months after the contract ends, so an account can be restored and disputes can be resolved. Invoices and accounting records are kept for as long as Cypriot tax law requires, which is longer.

Workspace data: for as long as the developer keeps it. When a workspace is deleted, it goes after a 30-day grace period and is then irrecoverable.

Audit log entries: 12 months, then deleted automatically.

Backups: kept on a rolling window of up to 30 days, after which deleted data is gone from them too.

Anything erased on request through the in-app tools is removed immediately from the live system and from search, and drops out of backups within the same window.

What erasure does exactly: the buyer or lead record is anonymised — name, contact details and notes are replaced with a marker showing the person was erased — their messages, attached files and notifications are deleted, and personal data is stripped out of the audit entries that mention them while the entries themselves remain, so the workspace's history is not falsified.

What erasure does not touch: documents attached to a buyer's unit — the sale contract, handover records, certificates — and payment records stay, in anonymised or contract-record form. Tax law obliges the developer to keep accounting records, and a contract has to survive long enough to be enforced or defended, so these rest on legal obligation and legitimate interest (Art. 6(1)(c) and (f)) rather than on consent, and Article 17(3) allows them to be kept. An erasure request does not delete them. Once the record they point at has been anonymised they no longer identify anybody by themselves; if a document still names the person in its own text, ask the developer holding it.

Supabase — hosting, database, file storage and authentication. Data is held in the EU.

Stripe — subscription billing and card payments. Stripe is the controller of the card data it collects; we never receive full card numbers.

Anthropic — AI text generation, used only when a person in a workspace requests a generation.

OpenAI — AI image generation and, when a workspace selects GPT-6 Astra, text generation, used only when a person in a workspace requests a generation.

Resend — delivery of transactional and notification email.

Cloudflare — content delivery, map tiles and protection against denial-of-service attacks.

Google (Google Tag Manager and Google Analytics) — only when we have enabled analytics for the service (announced in advance as a sub-processor change): measuring how our pages are used. Google Tag Manager then loads on every page with every consent signal set to denied (Google's Consent Mode), which reveals the visitor's IP address to Google as fetching any file does; every Google Analytics tag requires your consent, so nothing about your visit is sent to Google Analytics and no analytics cookie is set until you accept. We do not use Google's advertising features, and the advertising signals always stay denied. Google Tag Manager does not load in the enquiry and booking forms embedded on developers' own websites.

Google Maps Platform — only when we have enabled Google Maps for the service (a single setting for every workspace, announced in advance as a sub-processor change): map tiles and the viewer's IP address are then fetched from Google when a page with a map is opened. Without it, maps are drawn from tiles we host ourselves.

Each of these is bound by a written contract that allows them to process the data only for us. We keep the current list here and give 30 days' notice before adding or replacing one, as set out in the Data Processing Agreement.

Google Calendar — only when a staff member chooses to connect their own Google Calendar: their busy times are read to hide booking slots, and the details of each new viewing booking — the booker's name, phone number, email and notes — are then sent to Google and added to that calendar. This is an integration a workspace switches on for itself, not a service used for every workspace.

These integrations are optional and controlled by the workspace, not by us; the provider processes that data under its own terms, and disconnecting stops any further sharing.

We host in the European Union and we keep personal data there wherever we can.

A few of the providers above operate outside the EEA or have support staff who do. Where data reaches a country without an EU adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses together with the technical measures — encryption in transit and at rest, access controls, logging — described below. Ask us at legal@ruler.agency for the details of any particular transfer.

You can ask us for a copy of your personal data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting what we did before.

We answer within one month. If a request is unusually complex we may extend that by two further months and will tell you why. We do not charge for this unless a request is manifestly excessive or repetitive.

We may need to check who you are before acting, which is not an attempt to make this harder — it is to stop someone else getting your data.

Buyers: the portal has an Export button that produces a copy of everything held about you, and a Request deletion button that sends the request straight to your developer.

Developers and their staff: Settings, then Privacy, holds the export and erasure tools for leads and buyers, the register of requests received, and the button that schedules deletion of the whole workspace.

If a tool does not cover what you need, write to legal@ruler.agency and we will handle it by hand.

We set the cookies needed to keep you signed in and to remember your cookie choice, and we store your light or dark theme preference in your browser. Analytics cookies (Google Analytics, through Google Tag Manager) are set only if you choose Accept in the cookie banner; with Essential only, or before you choose, none are set. There is no advertising or remarketing cookie anywhere in the product. You can change your choice at any time from Cookie settings at the foot of every page. The Cookie Policy has the detail.

Every workspace is isolated in the database by row-level security, so a query made with one workspace's credentials cannot return another workspace's rows. Traffic runs over TLS, data at rest is encrypted, uploaded files are served through short-lived signed links rather than public URLs, and significant actions are written to an audit log by database triggers — edited only to strip personal data on erasure, and pruned after 12 months.

Access to production by our staff is limited to the people who need it, is authenticated with multi-factor login, and is logged.

If something about our handling of your data is wrong, tell us first at legal@ruler.agency — it is usually the quickest fix.

You also have the right to complain to a supervisory authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection. If you live or work in another EU country, you can complain to your local authority instead.

We update this policy when the product or the law changes. The date at the top always reflects the last substantive edit, and material changes are announced by email and in the app before they take effect.