Privacy Policy

The data controller responsible for the processing of your personal data on Buildwiser is:

• Account information: Email address and hashed password upon registration. If signing in via Google, only basic identity data (name, email) provided by Google OAuth.
• User preferences: Selected language (e.g. English, Dutch, French, German), country/market (e.g. Belgium, Netherlands), currency (EUR/USD), interface theme, and default PC building preferences.
• PC builds & configurations: Selected hardware components, budget specifications, configuration titles, and generated public share links.
• Technical & diagnostic logs: IP address, browser user-agent, operating system, and timestamp used strictly for server stability, DDoS mitigation, and system security.

• AI build & upgrade requests: When you ask the AI to design a build or an upgrade, the answers you gave (budget, workloads, games, resolution, priority, market) and — for an upgrade — the components you told us you own, together with your interface language, are sent to our model provider so that it can propose components. Your account identifier and email address are not part of that request. The reply is only a list of product ids, which our own server checks for compatibility and prices before anything is shown to you.
• AI usage records: For each AI request we store, linked to your account: whether it succeeded, which model answered, how many tokens it used and when. This enforces the daily limit and detects abuse.
• Anonymised build statistics: Combinations that passed validation — market, budget band, use cases, component ids and total — are recorded without any account identifier, in order to understand which components work well together.
• Measurement data (only with your consent): If you accept measurement, Google Analytics 4 records the pages you visit, the referring site, device and browser information and a randomly generated identifier kept in a _ga cookie, and Vercel's performance reporting records page load timings. Nothing is measured, and no cookie is set, before you answer.

We process your personal data only on established legal grounds under Article 6 of the GDPR:

• Performance of Contract (Art. 6(1)(b) GDPR): Creating your account, computing PC component compatibility, saving your custom configurations, and — when you ask for it — producing the AI-assisted build or upgrade recommendation described in section 2.
• Legitimate Interests (Art. 6(1)(f) GDPR): Maintaining website security, preventing fraudulent activity, fixing errors, optimizing platform performance, keeping the AI usage records that enforce the daily limit, and — with your consent where consent is required — measuring aggregate usage.
• Legal Obligations (Art. 6(1)(c) GDPR): Compliance with applicable Belgian commercial, accounting, tax, or law enforcement mandates.
• Consent (Art. 6(1)(a) GDPR): Where you provide explicit consent for optional features. You may withdraw consent at any time without detriment.

In accordance with Article 129 of the Belgian Electronic Communications Act of 13 June 2005, Buildwiser uses strictly necessary storage to run the site, and measurement storage only once you have agreed to it:

We deploy no advertising and no profiling cookies, and we sell no data. Measurement is third-party — Google Analytics 4 and Vercel's performance reporting — and runs only after you accept it: nothing is loaded, and no analytics cookie exists, before your answer. You can change or withdraw that answer at any time through Measurement settings in the footer, which stops the measurement scripts and removes the cookies they set.

We use a small number of service providers, each acting on our instructions under a written data processing agreement: Supabase (database and authentication), our hosting infrastructure (Cloudflare, or Vercel where the site is deployed there), Google (sign-in via OAuth, analytics only after your consent, and the font service that serves our typefaces), OpenRouter (the AI model provider) and Vercel's performance reporting (only after your consent). We never sell personal data, and we do not send your email address or account identifier to the model provider.

OpenRouter routes each AI request to a third-party model, so the model that answers may be operated by a different company than OpenRouter itself. Only the content of your request (section 2) is sent — never your identity — and you can ask us at privacy@buildwiser.app which model answered a request made on your account.

Several of these providers are established outside the European Economic Area, mainly in the United States; depending on the model OpenRouter routes to, other third countries may be involved. Where personal data leaves the EEA, the transfer relies on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR), supplemented by the provider's transfer impact assessment, or on an adequacy decision such as the EU–US Data Privacy Framework where the recipient is certified under it. You may request a copy of the applicable safeguards at privacy@buildwiser.app.

In compliance with Book VI of the Belgian Code of Economic Law on market practices and consumer protection, purchase buttons directing to retailers (such as Amazon, tagged with buildwiser-20) may constitute affiliate links. Buildwiser may earn a commission on qualifying purchases at zero additional cost to you. We do not transmit your account credentials or personal information to retailers.

Your account data and saved configurations are retained as long as your account remains active. If you request account deletion, all personal data is irrevocably removed within 30 calendar days, save for records required by statutory legal or fiscal obligations. Transient server security logs are purged within 90 days. AI usage records are deleted 12 months after they are written. Anonymised combination statistics contain no personal data and are kept as aggregate history. Measurement data is kept by the analytics provider for the retention period configured on our property (Google Analytics 4 offers 2 or 14 months), and the cookies it sets are removed as soon as you withdraw your answer.

Under Articles 15 to 22 of the GDPR, you have the following enforceable rights:

• Right of Access: Obtain confirmation and copies of your personal data.
• Right to Rectification: Correct any inaccurate or incomplete data.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your data when no longer needed.
• Right to Restriction: Restrict processing under certain legal conditions.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.

If you have concerns regarding how Buildwiser processes your personal data, you have the statutory right to lodge a complaint with the lead supervisory authority in Belgium:

All data in transit is encrypted using modern TLS (HTTPS). Authentication passwords are stored exclusively as salted cryptographic hashes within Supabase infrastructure protected by Row Level Security (RLS). Saved configurations are confidential to your account unless you explicitly generate a public share link.

We may revise this privacy policy periodically to reflect platform enhancements or statutory updates. The timestamp at the top indicates the effective date of the latest version.