Privacy Policy

1. The principle: minimal data, no cookies

The Site sets no cookies and uses no third-party analytics or tracking. There is no registration, no user account and no personal profile. We do not sell personal data and do not share it for advertising.

2. What is collected, why, and for how long

• Contact form — name, email address and the message, which you provide voluntarily. Basis: consent and answering your enquiry. The message is forwarded to us as a Telegram message and is not stored in the Site's database. We delete it once the enquiry is handled, unless we must keep it for a legal reason. There is no legal obligation to provide these details; without them we cannot reply.
• Page views — the browser reports the page path once on load, and the server counts per day and page only. No IP address, no identifier, no cookie; a browser sending Do Not Track or Global Privacy Control is not counted. Basis: legitimate interest (knowing which pages are read).
• Clicks on affiliate links — counted per day, partner and referring page only. No personal identifier, IP address or browser identifier is kept. Basis: legitimate interest (knowing which pages are useful).
• Rate limiting and abuse prevention — a one-way hash of the IP address with a salt that changes daily, held in temporary memory for minutes to an hour. The address cannot be recovered from it. Basis: legitimate interest (security).
• Clicks in the shop section — the referring page, link position and time of the click, and a derived (hashed) visitor identifier for a limited period so one visitor is not counted twice. Basis: legitimate interest.
• Server logs — the hosting provider (Vercel) automatically records technical request data (IP address, browser type, page, time) for security and operations, for a few days, under its own policy.

3. Who receives the data (processors)

• Vercel Inc. (USA) — hosting and running the Site. Data may be processed in the USA and the EU under the EU Standard Contractual Clauses.
• Supabase Inc. — the Site's database (aggregate click counts and catalog data; no personal data).
• Telegram FZ-LLC — delivery of contact-form messages to us.
• The providers our links point to (for example Make, AliExpress, hosting providers and banks) — after clicking a link you are on their site, and their privacy policy applies. Some set an attribution cookie to know you came from us; that happens on their site, not ours.

4. Transfers outside Israel and the EU

The little data collected is processed by the providers above, some of which operate in the USA. Transfers rely on recognised safeguards (Standard Contractual Clauses and Israel's data-transfer regulations). We transfer no personal data to anyone not on this list.

5. Your rights

Depending on the law that applies to you, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Since we hold almost no data that can be linked to a person, in most cases there will be nothing to provide or delete — but we will check every request and answer within 30 days.

Contact: hello@builderstack.co. EU residents may complain to their national supervisory authority; Israeli residents to the Privacy Protection Authority. California residents: we do not "sell" or "share" personal information as defined by the CCPA/CPRA.

6. Children

The Site is for professionals and is not directed at children under 18. We do not knowingly collect data about minors.

7. Security

The Site is served over HTTPS only, with security headers, rate limiting and connection checks. Access to operational systems is protected by secret tokens that are never stored in code. No security is absolute, and we cannot guarantee immunity from every breach.

8. Changes

We will update this document when collection changes — for example if we add analytics or a mailing list. Such a change will appear here with a date, and where required we will ask for consent first.