Privacy Policy | Buldix AI

1. Who We Are

Buldix AI is operated by Webmatia Ltd, a company registered in England and Wales.

Registered address: 71-75 Shelton St, London WC2H 9JQ, United Kingdom
Contact: contact@buldix.com

Webmatia Ltd is the data controller for personal data collected through the Buldix AI platform (buldix.com). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and the Data Protection Act 2018.

2. What Data We Collect

2.1 Account Data

When you register, we collect:

Full name
Email address
Password (stored as a bcrypt hash — we never store your plaintext password)
Account creation date and last login

2.2 Payment Data

Payments are processed by our third-party payment provider(s), which may act as the merchant of record. We do not collect or store your card numbers, bank details, or full payment information. We receive from the payment provider only:

A customer or payer reference ID
Order or transaction ID
Transaction status, amount, and date
Plan purchased (Lifetime)
Billing country (for tax purposes)

2.3 Usage Data

We automatically collect the following when you use the platform:

Prompts viewed, copied, or saved to favourites
Search queries
Page views and session duration (via analytics)
Browser type, device type, and operating system
Approximate location derived from IP address (country level)
Referral source (how you found us)

2.4 AI Enhancer Data

When you use the AI Prompt Enhancer, the text you submit is sent to our AI processing provider (Anthropic, Claude API) for processing. We do not store your enhancer inputs beyond the duration of the session. Anthropic's data handling is governed by their Privacy Policy.

3. How We Use Your Data

We process your personal data for the following purposes and legal bases:

Providing the service (contract performance): Account management, delivering the prompts and features you have access to.
Payments and billing (contract performance / legal obligation): Processing and recording payments and issuing refunds via our payment provider.
Platform improvement (legitimate interests): Analysing usage patterns to improve search, recommendations, and new features.
Security (legitimate interests): Preventing fraud, abuse, and unauthorised access.
Legal compliance (legal obligation): Retaining transaction records as required by UK tax and financial law.
Analytics & marketing (consent): Where required, we set analytics and marketing cookies only after you consent via our cookie banner. You may withdraw consent at any time.

4. Third-Party Services

We share data with the following categories of third-party processors:

Payment provider / merchant of record: Secure payment processing, billing, and refunds. Their terms and privacy policy are presented at checkout.
Vercel Inc (USA): Hosting, serverless functions, and content delivery. Privacy Policy
Prisma Data Inc (USA): Managed PostgreSQL database. Privacy Policy
Resend (USA): Transactional and marketing email delivery. Privacy Policy
Google LLC (USA): Analytics and, subject to your consent, advertising measurement. Privacy Policy
Meta Platforms Inc (USA): Subject to your consent, advertising measurement and audience tools. Privacy Policy
Anthropic PBC (USA): AI API for the Prompt Enhancer feature. Privacy Policy

All processors are bound by data processing agreements and are required to protect your data in accordance with applicable law. Transfers to the USA are made under Standard Contractual Clauses (SCCs) or equivalent safeguards.

5. Your Rights Under GDPR / UK GDPR

You have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete data.
Right to erasure ("right to be forgotten"): Request deletion of your account and associated data, subject to legal retention requirements.
Right to restriction: Request that we limit processing of your data in certain circumstances.
Right to data portability: Receive your data in a structured, machine-readable format.
Right to object / withdraw consent: Object to processing based on legitimate interests, and withdraw cookie or marketing consent at any time.

To exercise any of these rights, email us at contact@buldix.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority, or in the UK with the Information Commissioner's Office (ICO) at ico.org.uk.

6. Cookies & Consent

We use cookies and similar technologies. Visitors in the EU/EEA, the UK, and Switzerland are shown a consent banner on their first visit and can choose "Accept all" or "Essential only". Non-essential cookies are not set until you consent.

Essential cookies: Authentication session tokens and your consent choice. Required for the site to function; cannot be disabled.
Analytics cookies (consent-based): Help us understand how the platform is used so we can improve it.
Marketing cookies (consent-based): Where enabled, tools such as the Google tag and Meta Pixel measure the performance of our advertising. These are only activated after you accept marketing cookies.

You can change your choice at any time by clearing the buldix_consent cookie in your browser, which will cause the banner to reappear.

7. Data Retention

Account data: Retained for the lifetime of your account, plus 90 days after a deletion request.
Payment records: Retained for 7 years as required by UK HMRC tax regulations.
Usage/analytics data: Aggregated and anonymised in line with our analytics provider's retention defaults.
AI Enhancer inputs: Not retained beyond the active session.

8. Children's Privacy

Buldix AI is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, contact us at contact@buldix.com and we will delete it promptly.

9. Security

We implement industry-standard technical and organisational measures to protect your data, including TLS encryption in transit, bcrypt password hashing, database-level access controls, and a serverless architecture that minimises attack surface. Despite our efforts, no internet transmission is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users of material changes via email. The date at the top of this page reflects the most recent revision. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related queries, requests, or complaints:
Webmatia Ltd
71-75 Shelton St, London WC2H 9JQ, United Kingdom
contact@buldix.com