Privacy policy

Filip Dilevski, trading as Dilevski Digital is the data controller for the personal data described in this policy, except where section 4 says otherwise. Write to support@youbuiltit.com about anything in it, including to exercise any of the rights in section 8.

We are small enough not to be required to appoint a data protection officer, and we have not appointed one. The address above reaches a person.

Only what the service needs. In full:

We do not receive your card details. Paddle.com Market Ltd takes the payment as merchant of record and we never see the number. What comes back to us is that an order was paid.

We count visits with Vercel Web Analytics, so we know how many people come, which pages they open, from which country and kind of device, and which campaign or site sent them. It sets no cookie and is not linked to your account: what reaches us are counts, which say how many people came, not who you are. How Vercel tells one visit from another is described in its own analytics privacy notice (vercel.com/docs/analytics/privacy-policy). Before a page view is sent we strip the address down to the page itself: no project names or ids, no links' secret codes and nothing typed into a form or search, only the campaign tags an advertisement adds. There is no tracking pixel, no session recorder and no advertising tag on this site.

Sites built with it carry none of those by default. Two things are the site owner's choice. A visitor count, which comes with the contact form: each page view adds one to a number for that page and that day, and nothing else is kept — no cookie is set, and no address, browser or referrer is stored. And a tracking code the owner pastes in themselves, which is theirs to run and theirs to answer for, not ours.

Showing your site on /built-here is the one thing above that rests on your consent, and you can withdraw it from the publish page at any time. Nothing else here relies on consent, which is why there is no banner asking for it. If we ever want to send you marketing, we will ask separately and you will be able to say no without losing anything.

If you buy the contact-form add-on, people who visit your site can send you a message or book an appointment. That message or booking — the name, email address and, where they give one, the telephone number and note attached to it — is personal data belonging to your visitor, not to you and not to us.

For that data you are the controller and we act only as your processor: we receive it, store it, and show it to you, and we do nothing else with it. The written terms governing that are section 15 of the terms of service.

We also record the sender's IP address with each message and booking, and their browser identification with each message. That is used to stop the form being abused to send spam or to fill your diary, and for nothing else. It is not shown to you and it is deleted with the message or booking.

If one of your visitors asks you to delete what they sent, tell us and we will delete it. If they write to us directly, we will point them at you, because it is your data to decide about.

The same applies to words your customers write about you through your collecting link (/w/…): their words, the name they give, an optional place or detail, and the consent they agreed to, with its wording and the time. You are the controller and we are your processor. They give their consent to you, on a page that names your business; it is kept with their words as your record of it. The page tells them they can ask you, or us, to take their words down at any time — when they do, delete them on your "What customers say" screen and remove them from your site, or tell us and we will.

With each of those we also keep a scrambled form of the sender's internet address, scrambled with a secret key, used only to stop the link being flooded. It is not shown to you and it is deleted with the words.

The companies below process data on our behalf so the service can exist. Each is bound by a contract restricting what they may do with it. This list is complete.

We have never sold personal data, we do not share it for cross-context behavioural advertising, and we do not intend to start. If that ever changed we would have to say so here first, and you would be able to leave.

We will also hand over data if a court or a law requires it. If that happens and we are permitted to tell you, we will.

Our providers operate internationally, so your data may be processed outside your country and outside the European Economic Area — in practice, in the United States.

Where that happens we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one covers the provider. You may ask us for a copy of the relevant terms.

The delivery archive is deliberate and we will not delete it on request while it is within the 3 years. It is how we can re-send a site you have lost, and how we could show what was actually delivered if you and we ever disagreed about it. It contains what you wrote and uploaded, and nothing else.

After 3 years we delete the file and keep only its fingerprint — a 64-character checksum that describes nobody and cannot be turned back into anything. We could have kept the files for the full ten years and the storage would have cost us very little; we do not, because holding your photographs and your words for a decade when we no longer need them is not something a low cost justifies.

You do not lose your site when that happens. We still hold the frozen record of what your site was, and the software that turns it into files produces the same result from the same input every time — so we can rebuild it and compare it against the fingerprint. If they match, what we send you is provably the same folder you were given. If they do not, our software has moved on in the meantime, and we will tell you that rather than let you assume otherwise.

Wherever you live, you may ask us to show you what we hold about you, correct it if it is wrong, delete it, give you a copy in a portable format, restrict what we do with it, or object to processing we are doing on the basis of legitimate interest. You may also withdraw consent where we relied on it, although as section 3 says, we generally do not.

Two of them you can use yourself, at any time, without asking: Account → Privacy & data downloads a copy of everything we hold about you, and deletes your account.

For anything else, write to support@youbuiltit.com. We will answer within 30 days and we will not charge you for it. We may ask you to confirm you are who you say you are, because handing somebody else's data to the wrong person is the failure this is all meant to prevent.

If you are in California: we do not sell or share personal information as those terms are defined by the CCPA, we have not done so in the preceding twelve months, and we do not knowingly collect the personal information of anyone under 16. You have the right to know, delete, correct and to non-discrimination for exercising any of them; the address above is how to exercise them.

The same applies if you are covered by one of the other US state privacy laws — Colorado, Connecticut, Virginia, Texas, Oregon and the rest. They differ in wording and the answer here does not: we do not sell your data, we do not use it for targeted advertising, we do not profile you, and you may ask us to show it to you, correct it or delete it.

We honour the Global Privacy Control and any equivalent browser signal. In practice there is nothing for it to turn off, because we do not sell or share personal information and run no advertising trackers — but a signal that is ignored where it would have mattered is worth nothing, so we act on it rather than explaining why we need not.

If you think we have got this wrong, please tell us first. You may also complain to a data protection authority: in North Macedonia that is the Agency for Personal Data Protection, and in the EU or UK it is the authority for the country you live in.

We do not make decisions about you by automated means that produce a legal effect or something similarly significant. Nothing here decides whether you may buy, what you are charged, or whether you keep your account — a person does that.

Before a site can be bought, an automated check reads its words and photographs and flags anything that looks against the rules. A flag is a question put to you, not a verdict: you settle each one yourself, and nothing is refused on the check's word alone.

The service does use an automated system to draft the words on your site. That is a suggestion made to you, not a decision made about you: you read it, change it, and choose whether to publish. Nobody's site is written and put live without a person in the middle.

If that ever changed we would say so here first, explain the logic in terms you could act on, and give you a way to ask for a human instead.

This site sets only cookies that are strictly necessary for what you asked it to do: the one that keeps you signed in, the one that remembers the language you chose, one that remembers which ready-made site you picked while you sign in, and — before we open to everyone — the one that remembers you gave an early-access code. None of them tracks you or is read by anybody else, which is why there is no banner: asking permission for them would be theatre, since refusing would mean the site could not do what you asked.

Websites built with this service set no cookies of their own, and by default ship no JavaScript, load nothing from a third party and have no analytics — which is why they do not need a cookie banner. Three things change that, and each is the site owner's choice: a Google map under the address loads from Google, which may set cookies of its own and may then need the visitor's consent; a tracking code the owner adds is theirs to disclose; and the basket and exact appointment times each add a small script that runs in the visitor's browser and sends nothing anywhere until the visitor sends the form. The basket remembers its items in the visitor's own browser storage, not in a cookie.

Everything is encrypted in transit. Every row of your data is protected by database-level access rules that scope it to your account, so a mistake in our own application code cannot show your project to somebody else. Uploaded files are stored privately and served through links that expire. Payment card details never reach us at all.

No system is perfect. If there is ever a breach affecting your personal data and it is likely to put you at risk, we will tell you and the relevant authority without undue delay.

You Built It is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, tell us and we will delete it.

If we change this policy materially — a new sub-processor, a new purpose, a longer retention period — we will email you before it takes effect. The date at the top of this page is always the version in force.