Privacy Policy

1.1 Account Information (Required)

When you create an account, we collect:

• Name
• Email address
• Authentication method (Google OAuth, GitHub OAuth, or email)
• Account creation date
• User ID (automatically generated)

1.2 Profile Information (Optional)

You may choose to provide:

• Profile photo
• Skills and interests
• Experience level
• Location (city/country)
• Social links (GitHub, LinkedIn, personal website)
• Bio or description
• Resume/CV uploads

1.3 Event Registration Data

When you register for events, we collect:

• Responses to organizer-defined registration questions
• Event preferences and track selections
• Application materials (if required by organizer)
• Screening status and approval decisions

1.4 Event Participation Data

During event participation, we collect:

• Team membership and formation history
• Project submissions (code, files, videos, documentation)
• Check-in records and attendance
• Help requests and mentor interactions
• Team chat messages (if using platform messaging)
• Judging scores and feedback received
• Awards and achievements

1.5 Platform Usage Data

We automatically collect:

• Session logs and timestamps
• Feature usage patterns
• Error reports and diagnostic data, linked to your account when you're signed in
• Device type and browser information
• IP address (for security and fraud detection)

1.6 Cookies and Tracking Technologies

We use:

• Essential cookies: Required for authentication and platform functionality
• Analytics cookies: To understand usage patterns and improve the platform. When you're signed in, these are linked to your account (Section 3.5)

You can control cookie preferences in your browser settings.

1.7 Photos and Video from Events

At in-person events, BuilderBase and event organizers routinely capture photos, video, and audio that may show or identify attendees — participants, organizers, mentors, judges, and sponsor representatives alike. See Terms and Conditions §7 for what this covers, how it's used, and how to opt out of appearing in future marketing or social media content.

1.8 Email Open Tracking

Emails we send on behalf of event organizers contain a small, invisible image. When your email client loads it, we record that the message was opened and when. This tells organizers whether their announcements are reaching participants.

We record only the fact of the open and its timestamp. We do not record your IP address, device, location or browser from these images, and we do not track which links you click inside an email.

Most email clients let you block remote images, which prevents this entirely and does not affect your ability to read the message.

1.9 Profile Autofill

When you give us a LinkedIn, GitHub or website link, or upload a resume — on your profile or in an event application — we use it to fill in the fields of your BuilderBase profile that you have left empty. We collect only what organizers use to review applicants:

• LinkedIn: your public profile — name, headline, location, about, experience, education, skills, certifications and photo — fetched for us by Reverse Contact
• GitHub: your public profile, repositories, languages and contribution activity, from GitHub's public API
• Resume: the text of the resume you upload, read by Anthropic's Claude
• Website: the public text of the site you link, fetched by Cloudflare and read by Anthropic's Claude

We only use the links and files you give us. We never look you up by your email address or name. Everything we collect goes onto your own profile, where you can see, edit or remove it.

Every source is on unless you object. You can object at any time: switch any source off in Profile → Settings → Privacy, or email [email protected] with the subject line "Data Rights Request" (see Section 6.6).

2.1 Platform Operations

• Create and manage your account
• Authenticate your identity and maintain security
• Provide platform features and functionality
• Process event registrations and applications
• Facilitate team formation and collaboration
• Enable project submissions and judging
• Deliver notifications and platform communications

2.2 Event Management

• Share your registration data with event organizers for events you register for
• Enable organizers to screen, approve, and manage participants
• Facilitate communication between participants, mentors, judges, and organizers
• Support team formation, help queues, and mentorship
• Process judging, scoring, and award distribution

2.3 Builder Profile and Reputation

• Build your cross-event participation history and achievements
• Create a merit-based builder profile that follows you across events
• Track your skills development and project portfolio
• Enable you to showcase your work to potential collaborators and opportunities

2.4 Platform Improvement

• Analyze usage patterns to improve user experience
• Identify and fix bugs and technical issues
• Develop new features and functionality
• Conduct research and analytics (using aggregated data wherever we can)
• Train BuilderBase's own private models (see Section 4.2)

2.5 Security and Fraud Prevention

• Detect and prevent cheating, plagiarism, and fraudulent activity
• Compare code submissions across events globally to detect pre-builds
• Verify submission timestamps and team formation integrity
• Protect the Platform and users from security threats

2.6 Legal Compliance

• Comply with legal obligations and regulatory requirements
• Respond to legal requests and prevent illegal activity
• Enforce our Terms and Conditions

2.7 Profile Autofill and Application Review

• Fill in the empty fields of your profile from the links and resume you give us (Section 1.9)
• Show organizers of the events you apply to the profile they review applicants on
• Run an AI review of your application that helps organizers decide. The AI review scores applications; it does not accept or reject anyone. Organizers make that decision.

Legal basis: our legitimate interest (GDPR Article 6(1)(f)) in letting organizers review applicants on the public profiles and resume they would otherwise look up themselves. We limit it to the information that review needs, and keep all of it visible and editable on your profile. You can object at any time (Section 6.6).

3.1 Event Organizers

When you register for an event, the event organizer receives:

• Your registration information and responses
• Profile information (name, email, skills, experience, optional fields), including what profile autofill filled in (Section 1.9)
• Team membership and project submissions
• Participation data (check-ins, help requests, engagement)
• Judging results and awards

Organizers use this data to manage their events, select participants, coordinate activities, and evaluate projects.

3.2 Mentors and Judges

Mentors and judges for events you participate in can access:

• Your name and profile information
• Team information and project details
• Submissions and materials relevant to their role
• Communication within help queues or judging workflows

3.3 Other Participants

Within events you participate in, other participants can see:

• Your name and public profile information
• Your team membership
• Public project submissions (as configured by organizers)

3.4 Sponsors and Partners

By default, sponsors do NOT receive raw participant data.

Sponsors receive:

• Aggregated metrics that don't identify anyone (e.g., number of participants, engagement statistics)
• Access to projects that use their technology (if configured by organizer)
• Opt-in contact from participants who choose to share their information

Any raw data sharing with sponsors requires explicit organizer approval, and you control your profile visibility to sponsors.

3.5 Service Providers

We share data with trusted third-party service providers who help us operate the Platform:

• Cloudflare: Hosts the Platform. Cloudflare keeps short-lived request logs (such as IP address and the page requested). It also fetches the website you link, for profile autofill
• Supabase: Our database and sign-in. Supabase keeps short-lived platform logs of database and sign-in activity
• Resend: Sends our emails and keeps a contact list for our newsletters. Resend keeps logs of emails already sent for its log retention period
• Twilio: Sends SMS notifications, if you turn them on. Twilio keeps logs of sent messages for up to 30 days
• Stripe: Processes payments. Stripe also keeps payment data as an independent controller for its own legal duties
• PostHog and Mixpanel: Product analytics linked to your account (your account ID, name and email). Mixpanel may record how you use pages, to help us find usability problems
• Google BigQuery: Stores usage events linked to your account ID, for our own reporting
• Sentry: Error reports. When you're signed in they carry only your account ID, never your email or name. Kept for 90 days
• Intercom: Our in-app support chat
• Luma: When an organizer connects their Luma calendar, we sync their event guests with it
• Google Analytics (GA4): Page views and referral / traffic-source reporting, only if you accept analytics cookies. It uses a random browser ID, not your account, so it is pseudonymous rather than anonymous. Kept for up to 14 months
• Reverse Contact: Fetches your public LinkedIn profile from the link you give us (Section 1.9)
• Anthropic (Claude): Reads resume and website text to fill your profile, and runs the AI review of applications (Section 2.7)
• OpenAI: Checks the layout of participant lists that organizers upload (it sees a small sample of rows, which can include names and emails), and rewrites judges' feedback for the emails sent to winning teams. OpenAI deletes this data after up to 30 days
• Discord: If you connect your Discord account, we use it for event Discord features, such as messages from our bot

For GitHub, we request your public data from GitHub's API using the username you give us.

All service providers are bound by data protection agreements and process data only as instructed by us.

3.6 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or government request, or if necessary to protect rights, property, or safety; enforce our Terms; or prevent fraud or security threats.

3.7 Business Transfers

If BuilderBase is involved in a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such change and your rights regarding your data.

3.8 Public Marketing and Social Media Content

Photos, video, and audio captured at in-person events (see Section 1.7) may be published externally — on BuilderBase's or an organizer's website, social media, or promotional materials — under the consent and opt-out terms in Terms and Conditions §7. This is the one category of sharing in this section that is public rather than limited to a defined recipient.

4.1 No Data Sales

We will never sell your personal data to third parties for marketing, advertising, or any other purpose.

4.2 No Hidden AI Training

We never use your personal data, project submissions, or content to train large language models (LLMs) or other external AI models, or for hidden profiling purposes. We may use it to train BuilderBase's own private models.

4.3 Minimal Data Collection

We collect only the data necessary to provide platform functionality and improve user experience. Optional data is clearly marked and under your control. Profile autofill collects only what organizers use to review applicants (Section 1.9).

4.4 Organizer Accountability

Event organizers who receive your data are independent data controllers responsible for their own data practices. We encourage organizers to respect participant privacy, but we are not responsible for organizer data handling outside the Platform. When you delete your account, we tell them and ask them to delete the copies they made (Section 7.3).

5.1 Technical Safeguards

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest
• Access controls: Role-based access with least-privilege principles
• Database security: Row-level security policies in Supabase
• Authentication: Secure OAuth and token-based authentication
• Infrastructure: Hosting on secure, enterprise-grade platforms (Cloudflare, Supabase)

5.2 Organizational Safeguards

• Regular security audits and vulnerability assessments
• Employee access limited to necessary personnel
• Data protection training for team members
• Incident response procedures

5.3 Limitations

While we take security seriously, no system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials and notifying us immediately of any unauthorized access.

6.1 Right to Access

You can request a copy of all personal data we hold about you.

6.2 Right to Rectification

You can correct inaccurate or incomplete data through your profile settings or by contacting us.

6.3 Right to Erasure ("Right to Be Forgotten")

You can delete your account yourself at any time in Profile → Settings → Delete account, or ask us to do it (Section 6.9). Deletion happens straight away. Section 7.3 explains what is deleted and what is kept. Deleting your account also removes your access to your past achievements and event records. Organizers who made their own copies of your data (for example an export) are independent controllers; we tell them you deleted your account and ask them to delete those copies.

Messages and comments you wrote in shared spaces stay as written (Section 7.3). You can ask us to delete specific ones, before or after you delete your account: email [email protected] with the subject line "Data Rights Request".

6.4 Right to Restriction of Processing

You can request that we limit how we process your data in certain circumstances.

6.5 Right to Data Portability

You can request a machine-readable export of your data to transfer to another service.

6.6 Right to Object

You can object to processing of your data for certain purposes, such as direct marketing or legitimate interests.

Objecting to profile autofill. Profile autofill (Sections 1.9 and 2.7) is based on legitimate interest, so you can object to it at any time, for any or all of its sources:

• In your account: switch a source off in Profile → Settings → Privacy. We stop collecting from it straight away.
• By email: write to [email protected] with the subject line "Data Rights Request" and say which sources you object to. This also works if an organizer added you to an event and you have never signed in. We act on it within one month (Section 6.9).

Information already on your profile stays there until you edit or remove it, or ask us to delete it (Section 6.3).

6.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw consent at any time without affecting prior processing.

6.8 Right to Lodge a Complaint

You have the right to file a complaint with a data protection authority in your country. For Sweden: Integritetsskyddsmyndigheten (IMY) — www.imy.se

6.9 How to Exercise Your Rights

To exercise any of these rights, contact us at: Email: [email protected], Subject line: "Data Rights Request". We will respond within one month of receiving your request.

To protect your account, we act on a request only once we have confirmed it comes from the email address on your account. If you write from another address, we will ask you to confirm from that one.

7.1 Account Data

We retain your account and profile data for as long as your account is active or as needed to provide services.

7.2 Event Participation Data

Event participation history, submissions, and achievements are retained indefinitely to support your cross-event reputation, enable organizers to maintain historical records, and provide analytics. If you delete your account, the records other people rely on are kept under an internal ID and shown as "Deleted user" (Section 7.3).

7.3 Deletion Upon Request

When you delete your account (Section 6.3), it happens straight away:

• Deleted straight away: your profile and contact details, uploaded files (photo, CV, registration uploads, certificates), registration answers, AI evaluations of your applications, notifications, settings, linked accounts and direct messages. You are signed out everywhere.
• Withdrawn: your registrations, roles and team places for events that haven't ended yet.
• Kept under an internal ID: records other people rely on — past event registrations, team membership on past events, judging results, messages in group chats, comments on help requests and tasks, and judges' comments. They show as "Deleted user". This is pseudonymised, not anonymised: the records still carry an internal ID, but no longer your name or contact details. What you wrote in shared spaces stays as written, so it may still mention you; you can ask us to delete specific messages (Section 6.3). If you led a team or squad, its longest-standing member takes over.
• Kept for legal reasons: payment, payout and ambassador commission records, for 7 years as Swedish bookkeeping law (Bokföringslagen) requires, then deleted. Stripe also keeps payment data as an independent controller for its own legal duties.
• Organizers: we tell the organizers of events you registered for (upcoming, or ended in the last 12 months) that you deleted your account, and ask them to delete the copies they made, such as exports, spreadsheets or guests synced to their Luma calendar. Those copies are theirs to delete as independent controllers.
• A record that the deletion happened: your internal ID, the date, and a keyed, one-way code made from your email address — never the email itself. We keep it indefinitely, to prove the deletion, to apply it again if we ever restore a backup, and so that imports run by organizers or our staff can't re-create your account. You can always sign up again yourself; that creates a brand-new, empty account, and nothing from the deleted one is restored.
• Backups: copies in our encrypted database backups are kept for up to 30 days. If we ever restore a backup, we apply every deletion again from the deletion record before the Platform is used.

Our service providers (Section 3.5). We carry out the deletion at each of them within 30 days at the latest. What then happens at each:

• Stripe: your customer record and saved payment details are deleted. If you were an ambassador, your payout account is kept with the money records for 7 years.
• Resend: you are removed from our contacts. Logs of emails already sent stay with Resend for its log retention period.
• PostHog and Mixpanel: your person profile, events and recordings are deleted; they complete this within 30 days.
• Intercom: your contact and conversations are deleted.
• Google BigQuery: your analytics rows are deleted.
• Anthropic: your uploaded CV file is deleted.
• Discord: we disconnect your Discord account and delete our copy of the link. Messages our bot already sent you stay in Discord.
• OpenAI: no deletion step is needed; OpenAI deletes what it received after up to 30 days.
• Sentry: error reports carry only your account ID and are deleted after 90 days.
• Twilio: SMS logs are deleted after up to 30 days.
• Cloudflare and Supabase: short-lived request and platform logs expire on their own.
• Google Analytics: not linked to your account, so we can't single out your data; it expires after up to 14 months.
• Reverse Contact: receives only the LinkedIn link you gave us, never your name or email.

7.4 Inactive Accounts

Accounts inactive for more than 5 years may be deleted after we notify you.