Data processing agreement
Parties
This Data Processing Agreement ("DPA") is made between BuildFind OÜ, registry code 16804249, Tallinn, Estonia, info@buildfind.eu ("Processor", "BuildFind") and the customer that has accepted the Terms and Conditions ("Terms") ("Customer", "Controller").
It forms part of the Terms (Terms clause 5.2) and applies to all processing of personal data that BuildFind carries out on the Customer's behalf. It implements Article 28(3) of Regulation (EU) 2016/679 ("GDPR").
1. Definitions
1.1. Terms defined in the GDPR have the same meaning here. In addition:
- Customer Data: personal data that BuildFind processes on the Customer's behalf through the Service, as described in Annex 1.
- End User: a person the Customer allows to use the Service, including its employees, invited team members and subcontractor contacts.
- Mailbox Data: personal data in or about an End User's mailbox that BuildFind reads or sends through the Microsoft Graph API with that End User's permission: sender, recipients, subject, dates, identifiers, message text and attachments.
- Mailbox Record: data stored in the Service because an End User acted on an email, as listed in Clause 4.3.
- Sub-processor: a third party BuildFind engages to process Customer Data.
- SCCs: the standard contractual clauses for transfers to third countries adopted by Commission Implementing Decision (EU) 2021/914.
- Term: the period during which the Customer uses the Service under the Terms.
1.2. The Annexes form part of this DPA. For the processing of personal data, the GDPR prevails over this DPA, and this DPA prevails over the Terms.
2. Scope and roles
2.1. The subject matter, duration, nature and purpose of the processing, the categories of data subjects and the categories of personal data are set out in Annex 1.
2.2. For Customer Data the Customer is the controller and BuildFind is the processor. For personal data BuildFind processes for its own purposes (its customer relationship, account security, its website and error monitoring), BuildFind is the controller as described in its Privacy Policy, and this DPA does not apply to that processing.
3. Instructions
3.1. BuildFind processes Customer Data only on the Customer's documented instructions. These are the Terms and this DPA, the Customer's and End Users' configuration and use of the Service (including connecting a mailbox and using its actions), and further written instructions consistent with the Terms (GDPR Art. 28(3)(a)).
3.2. BuildFind tells the Customer without undue delay if it considers that an instruction infringes data protection law, and may suspend that instruction until the Customer confirms or changes it.
3.3. BuildFind may process Customer Data where EU or Estonian law requires it, and tells the Customer of that requirement first unless the law prohibits it.
3.4. The Customer is responsible for having a lawful basis for the processing, including for personal data of third parties in documents and emails its End Users put into the Service.
4. Mailbox Data
4.1. Access. BuildFind accesses the mailbox only through the Microsoft Graph API, with permissions the End User grants in Microsoft's own consent screen: permission to read mail (Mail.Read) when the End User connects the mailbox, and permission to send mail (Mail.Send) the first time the End User sends an email from the Service. BuildFind sends an email only after the End User has reviewed its recipients, including any hidden copy (Bcc) recipients, subject and text and confirmed sending, never on its own initiative, and it never changes, moves or deletes mail. Only the End User can add hidden copy recipients; the AI cannot.
4.2. Reading on request. BuildFind reads Mailbox Data only when the End User opens mail in the Service, searches it or uses an action on an email. It does not copy or synchronise mailboxes in the background.
4.3. Storage. Mailbox Data is stored only as Mailbox Records:
- when the End User asks about an email, a copy of that email (sender, recipients, date, subject, text and attachment names) in the End User's personal chat;
- when the End User creates a defect report from an email, the email text (up to 8,000 characters), the sender and the photos the End User keeps, as part of the report;
- on tasks and defect reports created from an email, a reference holding the message and conversation identifiers, subject, sender and received date;
- when the End User asks the AI to prepare an email, the draft (recipients, subject and text) in the End User's personal chat;
- for each email sent, a record of the sending (End User, time, outcome and a fingerprint of the message that prevents sending it twice), without the message content. The sent email itself is kept by Microsoft in the End User's mailbox.
4.4. Disconnecting. When an End User disconnects the mailbox, BuildFind immediately deletes the stored Microsoft access tokens and its record of the read and send permissions, and stops all access. The consent itself stays in the End User's Microsoft account until they remove BuildFind there. Mailbox Records stay until they are deleted under Clause 12.
4.5. The Customer's mail service. The mailbox stays in the End User's or Customer's own Microsoft 365 environment. BuildFind does not engage Microsoft as a Sub-processor.
4.6. No other use. BuildFind uses Mailbox Data only to provide the features above. It does not use it for its own purposes and does not train AI models on it.
5. Confidentiality
5.1. BuildFind ensures that everyone it authorises to process Customer Data is bound by confidentiality and processes it only on instructions and as needed for their work (GDPR Art. 28(3)(b)). This continues after their access ends.
6. Security
6.1. BuildFind takes the technical and organisational measures in Annex 3 to ensure a level of security appropriate to the risk (GDPR Art. 28(3)(c) and Art. 32).
6.2. BuildFind may replace a measure with one that gives at least the same protection, and tells the Customer about material changes.
7. Sub-processors
7.1. The Customer authorises BuildFind to engage the Sub-processors in Annex 2. The same list is published in the Privacy Policy (GDPR Art. 28(2) and 28(3)(d)).
7.2. BuildFind informs the Customer of an intended addition or replacement of a Sub-processor at least 14 days in advance, by email to Customers who have asked for notice at info@buildfind.eu and by updating Annex 2. The Customer may object within that period on reasonable data protection grounds.
7.3. As an exception to Clause 7.2, OpenRouter chooses which of the model providers in Annex 2 serves a given request, within the limits BuildFind sets on its account (EU only, zero data retention, no training), and does not give advance notice of changes to those providers. BuildFind informs the Customer of such a change as soon as it learns of it, and the Customer may object within 14 days of that notice under Clause 7.4.
7.4. If the Customer objects and the parties cannot agree within 30 days, the Customer may terminate the affected part of the Service without penalty and receives a proportional refund of prepaid fees.
7.5. BuildFind imposes data protection obligations on each Sub-processor by written contract that give sufficient guarantees for appropriate technical and organisational measures, and remains liable to the Customer for its Sub-processors (GDPR Art. 28(4)). Serper, listed in Annex 2, does not offer a data processing agreement. BuildFind therefore sends it only web search queries, without account data or account identifiers, instructs the AI not to put names in them, and removes email addresses, phone numbers, Estonian personal identification codes and IBAN bank account numbers before sending.
8. Data subject rights
8.1. BuildFind tells the Customer within three business days of any request it receives from a data subject about Customer Data, and does not answer it itself unless the Customer instructs it to or the law requires it (GDPR Art. 28(3)(e)).
8.2. BuildFind helps the Customer answer such requests. On the Customer's request it provides a copy of, corrects or deletes the relevant Customer Data within 30 days.
9. Impact assessments
9.1. BuildFind helps the Customer with data protection impact assessments and prior consultations (GDPR Art. 35 and 36) by providing this DPA, its Annexes and further reasonable information about the processing (GDPR Art. 28(3)(f)).
10. International transfers
10.1. BuildFind keeps Customer Data in the European Economic Area where it is technically feasible. The application database and file storage are in the EU.
10.2. Where a Sub-processor processes Customer Data outside the European Economic Area, the transfer is covered by a safeguard under Chapter V GDPR: the SCCs, the EU-U.S. Data Privacy Framework where the Sub-processor is certified, or an adequacy decision. Annex 2 lists the safeguard for each Sub-processor. The only exception is Serper: it does not disclose where it processes data and offers no such safeguard, which is why BuildFind limits what it sends to the search queries described in Clause 7.5.
10.3. All AI model requests go through OpenRouter's EU service. BuildFind's OpenRouter account allows only providers that process requests in the EU, do not keep them after answering and do not use them for training. Requests pass through Cloudflare AI Gateway with request logging switched off.
11. Personal data breaches
11.1. BuildFind notifies the Customer of a personal data breach affecting Customer Data without undue delay and no later than 48 hours after becoming aware of it. The notification describes, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Further information follows as it becomes available (GDPR Art. 33(2)).
11.2. BuildFind takes reasonable measures to contain the breach and limit its effects, and keeps a record of all breaches.
12. Return and deletion
12.1. During the Term, End Users can delete items in the Service. On the Customer's request, BuildFind provides an export of Customer Data, or permanently deletes specified Customer Data, within 30 days.
12.2. At the end of the Term, BuildFind deletes all Customer Data within 30 days, unless EU or Estonian law requires it to keep some of it. On request made before the end of the Term, BuildFind first provides an export (GDPR Art. 28(3)(g)).
12.3. Deletion includes derived data such as extracted text, search vectors and summaries. Copies in database point-in-time recovery and in error monitoring expire within a further 30 days.
12.4. On request, BuildFind confirms the deletion in writing.
13. Audits
13.1. BuildFind makes available the information needed to demonstrate compliance with this DPA and allows for and contributes to audits by the Customer or an auditor it appoints (GDPR Art. 28(3)(h)).
13.2. BuildFind first answers written questions. On-site or live audits take place at most once in any 12 months, on at least 30 days' written notice, during business hours and without exposing other customers' data. The once-a-year limit does not apply after a personal data breach affecting the Customer, or when a supervisory authority requires the audit. The Customer bears its own costs, unless the audit reveals a material breach of this DPA by BuildFind.
14. Records and contact
14.1. BuildFind keeps a record of processing activities carried out on the Customer's behalf (GDPR Art. 30(2)).
14.2. Data protection contact: info@buildfind.eu.
15. Liability
15.1. Liability between the parties follows Article 82 GDPR and is otherwise subject to the liability provisions of the Terms. Nothing in this DPA limits the rights of data subjects.
16. AI processing and staff access
16.1. No training. BuildFind does not train, fine-tune or otherwise improve AI models on Customer Data, and its model providers are restricted as described in Clause 10.3.
16.2. Statistics. BuildFind's usage statistics are collected on its own servers, without cookies and without user identifiers.
16.3. Staff access. A small number of BuildFind staff have administrative access to the Service. They use it only to provide support an End User or the Customer asks for, to keep the Service secure and working, or where the law requires it.
17. Term
17.1. This DPA applies for as long as BuildFind processes Customer Data. Clauses 5, 12, 13 and 15 continue after the Term for as long as their subject matter requires.
18. Final provisions
18.1. Acceptance. This DPA is accepted together with the Terms. A signed copy is available on request at info@buildfind.eu.
18.2. Changes. BuildFind updates Annex 2 under Clause 7 and Annex 3 under Clause 6.2. Other changes are announced in advance and apply under Terms clause 9.
18.3. Law. This DPA is governed by the laws of the Republic of Estonia, and disputes are resolved as provided in the Terms.
18.4. Language. This DPA is made in English. If a translation differs, the English version prevails.
18.5. Severability. If a provision is invalid, the rest remains in force, and the parties replace it with a valid provision closest to its purpose.
Annex 1: details of the processing
Subject matter and duration
Provision of the BuildFind Service to the Customer and its End Users for the Term, plus the deletion periods in Clause 12 and Annex 4.
Nature and purpose
| Activity | Purpose |
|---|---|
| Accounts, companies, projects and teams | PurposeUser administration, invitations, roles and permissions; sign-in with email and password, Google or Microsoft. |
| Project content | PurposeUpload, storage, viewing, text and image extraction and AI analysis of documents, drawings, photos and schedules; one-off imports from SharePoint and OneDrive. |
| Defect reports | PurposeCreating, sharing and following up defect reports, including with subcontractor contacts; notifications and daily digests. |
| Task boards | PurposeTasks, replies and attachments, including tasks created from email. |
| AI features | PurposePersonal chats, questions about documents, research with web search, voice transcription, summaries and data extraction. |
| Search | PurposeSearch vectors, a search index and re-ranking over project content. |
| Outlook mail connector | PurposeReading an End User's mailbox and sending emails the End User has reviewed and confirmed, on that End User's request, as set out in Clause 4. |
| Operations and security | PurposeError and performance monitoring, request logs, support, and anonymous usage statistics. |
Data subjects
- End Users: the Customer's employees, invited team members and subcontractor contacts;
- people who appear in content: senders and recipients of emails, signatories, and anyone named in documents, photos, chats or project records.
Categories of personal data
- identity and contact data: name, email address, profile picture, company and role;
- sign-in data: password hashes, two-factor secrets, sessions with IP address and browser, encrypted Microsoft and Google access tokens;
- content: documents, drawings, photos, transcribed voice notes, chats, tasks, defect reports, quotations and the personal data inside them;
- Mailbox Data, stored only as Mailbox Records (Clause 4.3);
- derived data: extracted text, captions, search vectors and AI output;
- technical data: request logs, error reports and AI run metadata.
Content may incidentally contain special categories of personal data, for example health information in an accident report. The Service is not designed for such data; the Customer is responsible for whether it may be put into the Service.
Location
The application database and file storage are hosted by Cloudflare in the EU. The search index, image previews and usage statistics run on servers in Germany. Other locations are listed in Annex 2.
Annex 2: sub-processors
| Sub-processor | Service and data | Where | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Service and dataRuns the BuildFind service: application servers, database, file storage, background jobs, routing of AI requests (with request logging switched off), sending of email, and network security. All service data: account data, content you upload or create in BuildFind, and the emails we send. Email delivery records (sender, recipient and subject) are kept for 30 days. | WhereDatabase and file storage in the EU. Requests and outgoing email are handled on Cloudflare's global network, starting at the data centre nearest to the user. | SafeguardCloudflare Data Processing Addendum, including the EU Standard Contractual Clauses. Cloudflare is certified under the EU-U.S. Data Privacy Framework. |
| OpenRouter, Inc. | Service and dataPasses requests from BuildFind's AI features to the AI model providers listed below. We use its EU service and our account only allows providers that do not store requests and do not train on them. What the AI features work on: your questions, the text and images of your documents (to make them searchable and to answer from them), emails you act on, photos, and voice notes for transcription. | WhereEU for AI requests. Account and billing data in the United States. | SafeguardOpenRouter Data Processing Agreement, including its EU terms and the EU Standard Contractual Clauses. |
| Google (Vertex AI), Amazon Web Services (Amazon Bedrock) and Mistral AI, reached through OpenRouter | Service and dataRun the AI models behind BuildFind's features: Anthropic Claude models on Google Vertex AI or Amazon Bedrock, which also rank search results, Google's Gemini embedding model on Vertex AI, which turns document text and images into search vectors, and Mistral's Voxtral model for transcribing voice notes. The same AI requests as OpenRouter; Mistral receives only voice notes. They are not kept after the answer is returned and are not used for training. | WhereEU (European regions of Google Cloud and Amazon Web Services, and Mistral AI's EU service). | SafeguardEngaged by OpenRouter under its provider agreements. Zero data retention, no training and EU-only routing are enforced on our OpenRouter account. |
| Modal Labs, Inc. | Service and dataProcesses uploaded files: extracts text, tables and images from documents, renders floor plans and reads MS Project files. Uploaded files while they are processed, and their file names. | WhereEU for file processing. Account data and service logs in the United States. | SafeguardModal Data Processing Addendum, part of Modal's terms, including the EU Standard Contractual Clauses. |
| Hetzner Online GmbH | Service and dataServers that run BuildFind's search index, image previews and website statistics (self-hosted Typesense, imgproxy and Rybbit). Text from your documents and their search vectors, images while a preview is made, and anonymous page-view statistics. | WhereGermany. | SafeguardHetzner data processing agreement. Data stays in the EU. |
| Functional Software, Inc. (Sentry) | Service and dataError and performance monitoring, including how AI features ran (which steps, how long, how many tokens). Session recordings only if you allow them, with all text, inputs and images masked, linked to your account when you are signed in. Error reports with your user ID, email address and IP address, technical details of the failed request (without its content), and AI run metadata such as models, timings, token counts and web search queries (with email addresses, phone numbers, Estonian personal identification codes and IBAN bank account numbers removed). When BuildFind staff use AI features, for example to reproduce a problem you reported, the full content of those runs is included. | WhereEU data region (Germany). Sentry's own account administration data may be processed in the United States. | SafeguardSentry Data Processing Addendum. EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses as fallback. |
| Google Cloud EMEA Limited (Google Workspace) | Service and dataOur company email at info@buildfind.eu, where support messages, contact form messages, bug reports and account deletion requests arrive. What you write to us and your email address. | WhereEU and other countries where Google operates data centres. | SafeguardGoogle Cloud Data Processing Addendum, including the EU Standard Contractual Clauses. Google LLC is certified under the EU-U.S. Data Privacy Framework. |
| Serper (serper.dev) | Service and dataWeb search for the research features. Only the search queries the AI writes from your request. The AI is instructed not to include names, and email addresses, phone numbers, Estonian personal identification codes and IBAN bank account numbers are removed before sending. No account data or account identifiers are sent. | WhereNot disclosed by the provider. | SafeguardSerper's terms of service. Serper does not offer a data processing agreement; see DPA clause 7.5. |
Microsoft and Google are not Sub-processors: when End Users sign in with them they act as independent controllers, and an End User's Microsoft 365 mailbox and SharePoint are the Customer's own services.
Annex 3: technical and organisational measures
Access control
- Every server function checks the session and the user's company, project and role before it reads or changes data; mailbox functions also check that the requester owns the mailbox.
- Chats are visible only to the End User who owns them.
- Two-factor authentication is available for every account.
- Administrative staff access is limited to the purposes in Clause 16.3.
Encryption
- All connections use TLS.
- The database and file storage are encrypted at rest by Cloudflare.
- Stored Microsoft and Google access tokens are additionally encrypted.
- Secrets and API keys are kept in the platform secret store, not in source code.
Minimisation
- Mailbox read access is requested only when an End User connects a mailbox, send access only when the End User first sends an email, and both are used only on the End User's request (Clause 4). Microsoft sign-in grants no access to mail or files; SharePoint access is requested only when the End User connects SharePoint.
- AI requests are restricted to EU providers with zero data retention and no training, and the AI gateway does not log them (Clause 10.3).
- Usage statistics are anonymous and use no cookies.
- Error monitoring keeps data for 30 days; session recordings run only with consent and mask all text, inputs and images.
Availability and integrity
- Managed infrastructure with database point-in-time recovery for 30 days.
- Database changes ship as reviewed migrations; code changes pass automated type checks, linting and tests before release.
Detection and response
- Error monitoring and structured application logs.
- A breach process implementing Clause 11, including a breach register.
Sub-processors and staff
- New Sub-processors are checked for data protection terms, location and transfer safeguards before use.
- Staff with production access are bound by confidentiality.
Annex 4: retention
| Data | Retention |
|---|---|
| Account and sign-in data | RetentionFor the Term. Deleted within 30 days of an End User's or Customer's deletion request, or of the end of the Term. |
| Project content, derived data and search vectors | RetentionUntil deleted. Items deleted in the Service are removed from use immediately; the underlying data is permanently deleted within 30 days of a request (Clause 12.1) or of the end of the Term (Clause 12.2). |
| Chats | RetentionUntil deleted by the End User who owns them. |
| Mailbox Data | RetentionOnly as Mailbox Records (Clause 4.3), retained like the record they belong to. Microsoft access tokens are deleted when the mailbox is disconnected. |
| Error and performance monitoring | Retention30 days. |
| Database point-in-time recovery | Retention30 days. |
| Usage statistics | RetentionAnonymous; no personal data retained. |