Privacy Policy

goBuildy is provided by two parties, depending on the country and the payment method:

• goBuildy Technologies LLC, a Wyoming (United States) limited liability company, at 30 N Gould St Ste N, Sheridan, WY 82801, USA.
• Héctor Fabián Piñatares Méndez, an individual based in San Jacinto, Canelones, Uruguay.

Both are responsible for the personal data goBuildy processes and apply this same policy. In this policy, "goBuildy" and "we" mean both. We operate gobuildy.com, our customers' dashboard and the websites we build for them. This policy explains what personal data we process, why, who we share it with and how we protect it.

For any question about this policy, email hello@gobuildy.com or use our contact form.

• Providing the service — generating your website, provisioning your domain or subfolder, and delivering your live site.
• Transactional email — magic-link login, provisioning status updates, and urgency reminders about your 72-hour free preview expiry.
• WhatsApp messaging — replying to you when you open the conversation from the button on our site, and only about your site. We do not start conversations or send promotions on this channel.
• Billing — creating checkout sessions and managing your subscription.
• Abuse prevention — checking your email against a list of known disposable email services, rate-limiting by IP, and verifying Cloudflare Turnstile tokens to prevent AI-spend abuse.
• Telling you about goBuildy — if you generated a site and left us your email, we may write to you later about the product or an offer. Every one of those emails carries an unsubscribe link at the bottom: one click and we stop, with no login and no explanation required. Unsubscribing does not affect transactional email (your invoice, access to your account).
• Legal compliance — complying with applicable laws, responding to legal requests, and enforcing our Terms of Service.

We do not sell, rent, or trade your personal information with third parties for their marketing purposes.

We use the following third-party services to operate goBuildy. Each is bound by contractual data-processing terms:

• Free previews — The preview link stays open 72 hours, or longer if we extend it. When it closes, we keep a copy of the site and of what you wrote for 45 days, unpublished, so we can reopen it if you ask; then it is deleted. The one exception is the contact summary below, which keeps the descriptions you wrote.
• Images you upload — An image you uploaded to a preview you never bought is deleted along with that preview's copy, at most 45 days after the link closes. The exception is your logo: we keep it in your account so that, if you buy later, your site comes with it, and it is deleted when you ask to be removed. Before we store anything, we re-encode the file, which removes its embedded metadata: that includes the location a phone writes into a photo, which we neither need nor keep. If you buy, the image becomes part of your site and stays for as long as your site does.
• Samples we build for a business — If we reach out with a sample site for your business, we build it from the business's public information. The link stays open while we talk and closes 30 days after our last unanswered message, or earlier if you tell us you're not interested. If you ask us to delete it, we delete it, including any photo of a person.
• Contact summary — kept with no expiry date, because its whole purpose is to let us write to you once your preview no longer exists. It is deleted when you ask to be removed, either from the link at the bottom of any of our emails or by writing to us. Once removed, your address stays on a minimal suppression list — the email and the date, nothing else — whose only purpose is to make sure no future send reaches you again.
• Diagnostic capture (temporary) — while we investigate why some visitors cannot complete the site brief, the first 120 characters of your business description and the email address you type may be stored even if you do not finish and generate a site. This is used only to debug the form, is never used to contact you, and is deleted automatically 14 days after it is recorded. You can ask us to delete it sooner through our contact form.
• Paying subscriber accounts — your email, site slug, and subscription metadata are retained while your subscription is active and for 30 days after cancellation (to allow reactivation), then permanently deleted.
• IP rate-limit counters — deleted automatically after 2 hours via DynamoDB TTL.
• Domain registrant contact — retained for the duration of domain ownership and transferred to the new registrar if you request a domain transfer-out. Deleted from our systems 30 days after a completed transfer.
• Transactional email logs — AWS SES delivery receipts are retained for 30 days for bounce/complaint handling, then purged.
• WhatsApp conversations — they live in the WhatsApp app, on your side and ours, like any other chat. You can delete your side at any time. If you ask us to stop writing, we keep only the minimal record needed to not write again.
• Bookings taken by businesses that use goBuildy: a business can take bookings on its website with goBuildy's calendar. The data from those bookings belongs to the business: the business is the controller and goBuildy stores it on the business's behalf, as processor (Uruguayan Law 18.331). For each booking we keep the name, phone number, email if given, the note, an irreversible fingerprint of the IP address and, if a deposit was paid, the payment reference (never the card). The booking is deleted automatically one year after its date. The business also keeps a profile of each person, with their details and past bookings, for as long as it uses the calendar.Anyone who wants to see, correct or delete their data should ask the business they booked with. The business can delete it from its dashboard, and we help it respond on time.
• Permission for WhatsApp notifications: the business can ask on its booking page whether the person wants a WhatsApp confirmation and a reminder. It is optional and the booking stands either way. The answer is stored with its date. If the person tells the business some other way (in person, by phone), the business records it in the profile, along with how and who recorded it. It is deleted with the profile.
• People invited to help on one of our customers' sites — if the owner of a site built with goBuildy invites you to add content to it (for example, a real estate agency's listings), that business is the controller of your data and goBuildy is the processor holding it on its behalf (Uruguayan Law 18.331). We keep your email, which the owner sees next to each listing you add or edit, and a record of what you did (add, edit, publish, hide) with its date, deleted automatically after one year. An invitation you don't accept is deleted automatically after 7 days. When the owner removes your access, it stops immediately; your account remains until you ask us to delete it.

Depending on where you live, you may have the right to see, correct, delete or export your personal data. Ask the site where you left your data. If it was a business's website, that business is the controller: contact it, and it will ask us. If it was gobuildy.com, email hello@gobuildy.com and we will respond within 5 business days.

California residents (CCPA/CPRA): You have the right to know what personal information we collect, the right to delete it, the right to opt out of sale (we do not sell personal information), and the right not to be discriminated against for exercising these rights.

Ask the site where you left your data:

• On a business's website (for example, when booking an appointment): contact the business. It can delete your data from its dashboard or ask us to do it.
• On gobuildy.com: email hello@gobuildy.com with the subject "Delete my data", or use the unsubscribe link at the bottom of any of our emails. We will respond within 5 business days.

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256 via AWS). Our DynamoDB tables have Point-in-Time Recovery (PITR) and deletion protection enabled. Secrets (API keys, JWT signing keys, payment signing secrets) are stored in AWS Secrets Manager and never appear in environment variables or logs.

No security system is perfect. If you discover a vulnerability, please report it responsibly via our contact form.

goBuildy is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.

We may update this policy as our service evolves. We will notify active subscribers by email at least 14 days before any material change takes effect. The "Last updated" date at the top of this page always reflects the current version.