Download The appLegal
Privacy Policy
How we collect, use, and protect your personal information
1. Who We Are
Builder Match AI Ltd (registered in England and Wales, Company No. 17240008, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom) operates the buildermatch.ai platform (the "Platform") — an AI-powered marketplace connecting homeowners with verified trade professionals.
For the purposes of UK data protection law, Builder Match AI Ltd is the Data Controller for all personal data collected through the Platform. This means we decide why and how your personal data is used.
If you have any questions about this Privacy Policy or how we handle your data, please contact us at privacy@buildermatch.ai. Our Data Protection Officer can be reached at dpo@buildermatch.ai.
YOUR RIGHTS AT A GLANCE
A 'Data Controller' is the organisation responsible for your personal data — that is us. We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. Our ICO registration number is [Insert]. You can verify this at ico.org.uk.
2. What Personal Data We Collect
We only collect information we actually need. Here is exactly what we collect and why, depending on whether you are a homeowner or a tradesperson.
Data Collected from All Users (Homeowners and Tradespersons)
| Data Type | What It Is and Why We Collect It |
|---|---|
| Name and contact details | Your full name, email address, phone number, and postcode. Needed to create your account, contact you about jobs, and send notifications. |
| Account credentials | Your login email and encrypted password (or Google/Apple sign-in token). Required for account security. |
| Location data | Your postcode and general area. Used to match you with nearby jobs or tradespersons. We do not track your precise GPS location continuously. |
| Device and usage data | IP address, browser type, pages visited, time spent on platform, clicks, search terms used. Used to improve the Platform and for security monitoring. |
| Communications | Messages you send through the Platform's in-app messaging system. Stored to support disputes and service continuity. |
| Cookie data | See Section 12 (Cookie Policy) for full details. |
| Reviews and ratings | Reviews you leave or receive after a job. Published on user profiles as part of the Platform's trust system. |
Additional Data Collected from Tradespersons
| Data Type | What It Is and Why We Collect It |
|---|---|
| Identity verification documents | Government-issued photo ID (passport, driving licence, or national ID card) and proof of address. Required to verify your identity before you can access leads. |
| Biometric liveness data | A facial scan or liveness check processed by our identity verification provider. Used to confirm your photo ID belongs to you. We do not store the raw biometric data ourselves — it is processed by Onfido and only a verification result is returned to us. |
| Trade licences and certifications | Gas Safe registration number, NICEIC/NAPIT membership, OFTEC registration, DBS certificate, or other trade credentials. Required to verify you are qualified to perform the work advertised. |
| Public Liability Insurance certificate | Your current insurance certificate and insurer details. Required as a condition of listing on the Platform. |
| Companies House data | Company registration number and director information, verified via the Companies House API. Required for business accounts. |
| VAT number | Your HMRC VAT registration number (if applicable), verified via the HMRC VAT API. Used for invoice generation. |
| Bank account details | Via Stripe Connect — your bank account or sort code and account number for receiving payouts. We do not store your bank details ourselves; they are held securely by Stripe. |
| DBS and background check data | Basic Disclosure and Barring Service check result. Processed in compliance with the Data Protection Act 2018 and the Rehabilitation of Offenders Act 1974. See Section 5 for the specific legal basis. |
| Professional profile information | Trade category, years of experience, coverage area, portfolio photos, and availability. Used to build your public profile and power AI matching. |
| Financial and transaction data | Token purchases, subscription billing history, job earnings, escrow transactions, and payout history. Required to operate the payment system and for HMRC compliance. |
| Earnings and accounting data | Gross earnings, expenses logged against jobs, VAT breakdown, and monthly statements. Generated by the Platform's accounting module to support your self-assessment filing. |
| Profile Health Score data | Your profile completion progress, credential verification status, response rate, and rating history. Used to calculate your Profile Health Score and inform AI matching. |
Additional Data Collected from Homeowners (Clients)
| Data Type | What It Is and Why We Collect It |
|---|---|
| Job descriptions | Text descriptions of your home repair or renovation job, including photos you upload of the problem. Used to match you with suitable tradespersons and generate AI-assisted job summaries. |
| Property information | Postcode, property type (e.g., terraced house, flat), and access details relevant to the job. Used for matching and scheduling. |
| Payment method | Card details processed via Stripe. We do not store your card number — Stripe handles all card data under PCI DSS compliance. |
| Escrow transaction history | Records of deposits, milestone payments, and releases through the Platform's escrow system. Retained for 7 years for legal and financial compliance. |
Data We Collect Automatically
When you use the Platform, we automatically collect:
- Log data: IP address, browser type and version, operating system, referring URLs, pages viewed, and timestamps.
- Device data: Device type (mobile/desktop), screen resolution, and browser language settings.
- Platform behaviour data: Search queries entered, profiles viewed, quotes received, messages sent, buttons clicked, and features used. This data is used to improve the Platform, personalise your experience, and train our AI matching algorithms — subject to the safeguards described in Section 6.
- Analytics data: Aggregated, anonymised usage statistics via Google Analytics 4 (GA4) — only active after you have given cookie consent. See Section 12.
Data We Do Not Collect
We do not collect or ask for:
Sensitive personal data (such as racial or ethnic origin, health data, or sexual orientation) unless it is voluntarily provided and relevant to an accommodation-related accessibility job request.
Children's data. The Platform is strictly 18+ and we do not knowingly collect data from anyone under 18.
Your precise, continuous GPS location.
Social media login data beyond what is needed for authentication (Google/Apple Sign-In).
3. How We Use Your Personal Data
We use your data to run the platform, match you with the right jobs or trades, process payments, keep the platform safe, and — with your permission — send you relevant updates. Nothing else.
| Purpose | Legal Basis (UK GDPR Article 6) |
|---|---|
| Creating and managing your account | Contract performance — Art.6(1)(b). We need this to provide the service you signed up for. |
| Matching homeowners with tradespersons via AI algorithm | Contract performance — Art.6(1)(b); and Legitimate interests — Art.6(1)(f) (improving match quality for all users). |
| Processing job deposits, milestone payments, and escrow releases via Stripe | Contract performance — Art.6(1)(b). |
| Verifying tradesperson identity, licences, and insurance | Contract performance — Art.6(1)(b); Legal obligation — Art.6(1)(c) (consumer protection obligations). |
| Conducting background (DBS) and sanctions checks on tradespersons | Legitimate interests — Art.6(1)(f) (protecting homeowners); Legal obligation — Art.6(1)(c). Special category data basis: Schedule 1, DPA 2018. |
| Sending transactional notifications (job alerts, payment updates, booking confirmations) | Contract performance — Art.6(1)(b). These are service messages, not marketing. |
| Sending marketing messages (re-engagement nudges, seasonal offers, campaigns) | Consent — Art.6(1)(a) + PECR. Only to users who have explicitly opted in. You can opt out at any time. |
| Resolving disputes between homeowners and tradespersons | Legitimate interests — Art.6(1)(f); Contract performance — Art.6(1)(b). |
| Generating AI-powered features (job wizard, smart replies, pricing guidance, review summaries) | Contract performance — Art.6(1)(b); Legitimate interests — Art.6(1)(f). |
| Improving our AI matching algorithm and platform features | Legitimate interests — Art.6(1)(f). Data used is anonymised or pseudonymised where possible. |
| Fraud prevention, security monitoring, and platform integrity | Legitimate interests — Art.6(1)(f); Legal obligation — Art.6(1)(c) (AML regulations). |
| Generating tradesperson invoices, statements, and accounting reports | Contract performance — Art.6(1)(b); Legal obligation — Art.6(1)(c) (HMRC, Companies Act 2006). |
| Complying with legal obligations (HMRC, ICO, court orders, regulatory requests) | Legal obligation — Art.6(1)(c). |
| Running analytics to understand Platform usage | Consent — Art.6(1)(a) (via cookie consent). See Section 12. |
4. Who We Share Your Data With
We share your data with the companies that help us run the platform — for example, Stripe to process payments, or Twilio to send SMS messages. We never sell your data. We never share it for advertising purposes.
We share personal data only with third-party service providers ('Data Processors') who process data on our behalf under written Data Processing Agreements (DPAs) compliant with UK GDPR Article 28. All processors are contractually required to keep your data secure, use it only for the specified purpose, and comply with applicable data protection law.
Our Data Processors
| Processor / Service | Purpose |
|---|---|
| Stripe Payments Europe Ltd | Payment processing, escrow management, Tradesperson payouts (Stripe Connect Express) |
| Anthropic (Claude AI) | AI job wizard, smart reply suggestions, AI review summaries, support chatbot |
| OpenAI (GPT-4o) | AI fallback system; photo analysis; RAG pipeline embeddings |
| Twilio Inc. | SMS OTP verification, appointment reminders, STOP handling |
| Meta (WhatsApp Business API) | Job alerts, booking confirmations, payment updates, opted-in marketing messages |
| Resend | Transactional email (account confirmations, receipts, password resets) |
| Amazon Web Services (AWS) | Backend server infrastructure (ECS Fargate), database hosting |
| Vercel Inc. | Frontend hosting and CDN delivery |
| Supabase | PostgreSQL database, real-time data, vector search (pgvector) |
| Google (Analytics, Maps API) | Platform analytics (GA4) — with your consent only; postcode radius matching; ETA tracking |
| ElevenLabs | AI voiceover generation for Tradesperson promotional videos (CR1 feature) |
| Buffer | Automated social media posting via Agent A5 (opted-in Tradespersons) |
| [Insert Identity Verification Provider — e.g., Onfido / Jumio] | Tradesperson identity and liveness verification |
| [Insert DBS Umbrella Body — e.g., uCheck / Capita] | Tradesperson DBS background checks |
| [Insert AML/Sanctions Screening Provider] | Sanctions list and PEP screening for Tradespersons |
| Sentry | Error monitoring and platform diagnostics |
Sharing Between Users
When a homeowner's job is matched with a tradesperson, we share the job description, location (postcode), and homeowner first name with the matched tradesperson. Full contact details are shared only after a quote is accepted and both parties have confirmed the booking. We do not share homeowner email addresses or phone numbers with tradespersons beyond what is necessary for the job.
Tradesperson profiles — including trade category, verified credentials, Profile Health Score, ratings, and reviews — are visible to all homeowners on the Platform as part of the matching and selection process.
Legal Disclosures
We may disclose personal data to law enforcement, regulatory authorities (including the ICO, HMRC, or FCA), or courts when we are legally required to do so — for example, by a court order, regulatory investigation, or statutory demand. We will notify you of any such disclosure where we are legally permitted to do so.
Business Transfer
If Builder Match AI Ltd is acquired, merges with another company, or transfers its assets, your personal data may be transferred to the new owner as part of that transaction. You will be notified in advance of any such transfer and given the opportunity to delete your account if you do not wish your data to be transferred.
5. Sensitive (Special Category) Data
DBS check results are sensitive data. We handle them carefully, use them only for verifying tradesperson suitability, and delete them promptly when no longer needed.
We process the following categories of sensitive personal data in limited circumstances:
DBS (Criminal Record) Data — Tradespersons Only
We process basic DBS disclosure results for Tradespersons as part of our verification process. This is sensitive personal data under UK GDPR Article 9 and the Data Protection Act 2018.
Legal basis: Schedule 1, Part 1, DPA 2018 (employment, social security, and social protection) and Substantial Public Interest Condition 6 (preventing or detecting unlawful acts).
We process only the outcome of the DBS check (clear / disclosed), not the full disclosure. We do not retain copies of DBS certificates beyond the verification period.
DBS data is deleted 1 year after the Tradesperson's account is closed or their active status ends (whichever is earlier).
We do not make decisions based solely on a DBS result — a human review is always part of the process where a disclosure is made.
Biometric Data — Tradespersons Only
Facial liveness checks are processed by our identity verification provider (Onfido) to confirm that a photo ID belongs to the person submitting it. The raw biometric data (facial scan) is processed by the provider and is not stored by Builder Match AI Ltd. We receive only a verification result (pass/fail) and a confidence score.
Legal basis: Explicit consent — UK GDPR Article 9(2)(a). Tradespersons are asked to provide explicit, separate consent for biometric liveness processing before this step is initiated. Consent can be withdrawn, but withdrawal means the identity verification cannot be completed and the account cannot be activated.
6. AI Features and Automated Decision-Making
Our platform uses AI to match jobs with tradespersons, suggest replies, and generate content. We are transparent about how this works and you always have the right to ask a human to review any significant AI-driven decision.
How We Use AI
| AI Feature | What It Does |
|---|---|
| AI Job Matching | Recommends tradespersons for a homeowner's job based on proximity, credentials, availability, ratings, and Profile Health Score. |
| AI Job Wizard | Helps homeowners describe their job by asking guided questions and generating a structured job post from plain English or a photo. |
| AI Pricing Guidance | Suggests a fair price range for a Tradesperson's quote based on job type, location, and historical platform data. |
| AI Smart Replies | Suggests 3 contextual reply options in Platform messaging to help Tradespersons respond quickly. |
| AI Review Summaries | Generates a plain-English summary of a Tradesperson's reviews for display on their profile. |
| AI Re-engagement Nudges | Generates personalised WhatsApp or email messages to inactive users (opted-in only). |
| AI Promotional Videos | Auto-generates a short social media video from completed job photos and a review (CR1 feature — opted-in Tradespersons). |
| Support Chatbot (AGT-06) | Answers common questions using a RAG knowledge base built from Platform FAQs. |
Automated Decisions That Affect You (UK GDPR Article 22)
Some Platform decisions are made automatically, without human review, and may have a significant effect on your account:
Profile suspension: If a Tradesperson's verified credentials (licence, insurance, or DBS) expire and are not renewed within 14 days, their profile is automatically suspended.
Lead allocation: The AI matching algorithm determines which Tradespersons are shown a job listing. Tradespersons not shown a job have not been 'rejected' — the system filters by relevance.
Profile Health Score: Calculated automatically from credential verification, completion rates, response rates, and ratings.
Your rights regarding these decisions:
You can request a human review of any automated decision that has significantly affected your account by emailing privacy@buildermatch.ai with the subject line 'Request for Human Review'.
You will receive a written explanation of the decision logic within 30 days.
You can contest the decision and provide additional information for consideration.
AI Fairness and Non-Discrimination
Our AI matching algorithm is designed and regularly audited to ensure it does not discriminate against any user based on protected characteristics under the Equality Act 2010 — including race, sex, religion, disability, age, or national origin. Annual algorithmic bias audits are conducted by an independent third party, with summaries published in our annual Transparency Report.
7. International Data Transfers
Some of our technology providers are based in the USA. When we send your data there, we make sure it is protected to the same standard as in the UK.
Several of our data processors — including Anthropic (Claude AI), OpenAI, Twilio, Vercel, ElevenLabs, and Buffer — are based in the United States. Transferring personal data to the USA from the UK requires one of the following safeguards:
UK Adequacy Decision: The UK Secretary of State has recognised certain countries as providing adequate data protection. The USA is covered by the UK Extension to the EU-US Data Privacy Framework for certified organisations.
Standard Contractual Clauses (SCCs): Where a US processor is not covered by an adequacy decision, we use the ICO-approved International Data Transfer Agreement (IDTA) or addendum to the EU SCCs.
Transfer Impact Assessment (TIA): We have assessed the data protection laws of the USA in the context of each processor and implemented supplementary technical measures (including data minimisation in AI prompts and encryption in transit and at rest) where required.
You can request a copy of the relevant transfer safeguards for any specific processor by emailing privacy@buildermatch.ai.
8. How Long We Keep Your Data
We keep your data for as long as we need it and no longer. Here are the specific timescales for different types of data.
| Data Type | How Long We Keep It |
|---|---|
| Active account data | For the lifetime of your account |
| Account data after closure | 2 years after you close your account |
| Payment and transaction records | 7 years from the transaction date |
| DBS and background check data | 1 year after account closure or active status ends |
| Dispute records and Director's Determinations | 6 years from the date of resolution |
| Consent records (marketing opt-ins) | Duration of consent + 3 years |
| AI matching and profiling data | Anonymised after 24 months; raw personal data deleted after 24 months unless retained for another purpose above |
| Platform usage logs | 90 days rolling, then deleted or anonymised |
| In-app messages | Duration of related job + 12 months post-completion |
| Job completion photos (portfolio) | Retained on profile until you delete them or close your account |
| Data subject to 90-day soft delete (per platform architecture) | 90 days from deletion request, then permanently purged from all systems |
When your data reaches the end of its retention period, it is securely deleted or irreversibly anonymised. 'Anonymised' means it can no longer be linked back to you in any way.
9. Your Rights Under UK GDPR
You have real, enforceable rights over your personal data. We take them seriously. Here is how to use them.
| Your Right | What It Means |
|---|---|
| Right of Access | Receive a copy of all personal data we hold about you (a Subject Access Request or SAR). |
| Right to Rectification | Ask us to correct any inaccurate or incomplete personal data we hold about you. |
| Right to Erasure ('Right to be Forgotten') | Ask us to delete your personal data. Note: some data must be retained for legal reasons (e.g., transaction records for 7 years). |
| Right to Restriction | Ask us to pause processing your data while a dispute about accuracy or lawfulness is resolved. |
| Right to Data Portability | Receive your personal data in a structured, machine-readable format (JSON or CSV) so you can take it elsewhere. |
| Right to Object | Object to us processing your data based on legitimate interests — including AI profiling and direct marketing. We must stop unless we have compelling legitimate grounds. |
| Right Not to Be Subject to Solely Automated Decisions | Request human review of any automated decision that significantly affects you (see Section 6.2). |
| Right to Withdraw Consent | Withdraw any consent you have given (e.g., for marketing messages or biometric processing) at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. |
| We will always respond to rights requests within 1 calendar month. If a request is complex or we receive a large number of requests, we may extend this by a further 2 months — we will notify you within the first month if this is the case. | We will not charge you for exercising your rights in the vast majority of cases. If a request is manifestly unfounded or excessive (e.g., repetitive), we may charge a reasonable fee or refuse to comply — we will explain our reasons if so. |
HOW TO CONTACT US
Privacy enquiries and data rights requests: privacy@buildermatch.ai Data Protection Officer: dpo@buildermatch.ai Post: Data Protection, Builder Match AI Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
If you are not satisfied with how we handle your request or your complaint, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK's data protection regulator:
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
10. Marketing Communications
We will only send you marketing messages if you have asked us to. You can change your mind at any time.
We may send you promotional communications — including new feature announcements, campaign offers, founding member updates, and seasonal promotions — by email, SMS, and WhatsApp. We will only do this if you have given us your prior explicit consent (a separate, un-pre-ticked opt-in checkbox at registration for each channel).
Types of Messages
| Message Type | Consent Required? |
|---|---|
| Account confirmations, booking confirmations, payment receipts | No — these are transactional service messages, not marketing |
| Job alerts and new quote notifications | No — these are transactional messages related to your active use of the service |
| Platform updates and feature announcements | Yes — marketing opt-in required |
| Promotional offers (founding member campaigns, discounts, token promotions) | Yes — marketing opt-in required |
| Re-engagement messages ('Still looking for a plumber?') | Yes — marketing opt-in required |
| Seasonal campaigns and newsletters | Yes — marketing opt-in required |
| Milestone celebration messages (1st, 5th job, etc.) | Yes — treated as marketing |
Opting Out
You can opt out of marketing messages at any time by:
- Clicking the unsubscribe link in any marketing email;
- Replying STOP to any marketing SMS;
- Replying STOP to any marketing WhatsApp message (processed within 60 seconds);
- Updating your preferences in Account Settings > Notifications;
- Emailing privacy@buildermatch.ai and asking to be removed from all marketing communications.
Opting out of marketing does not affect transactional service messages, which are necessary to provide the service you signed up for.
11. Children's Data
The Platform is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not use the Platform or provide us with any personal information.
If we become aware that we have collected personal data from a user under 18, we will immediately delete that data and close the associated account. If you believe a user under 18 has registered on the Platform, please contact us at privacy@buildermatch.ai.
12. Cookie Policy
We use cookies to make the platform work and to understand how people use it. You control which non-essential cookies are active.
Cookies are small text files stored on your device when you visit the Platform. We use them for the following purposes:
| Cookie Category | What They Do |
|---|---|
| Strictly Necessary | Essential for the platform to function: session management, login authentication, security tokens, escrow state tracking. Cannot be disabled. |
| Functional | Remember your preferences: language settings, last search, UI preferences. Platform still works without them. |
| Analytics (GA4 + GTM) | Collect anonymised data about how users navigate the platform. Used to improve features and understand traffic. IP anonymisation is active. No data flows to Google until consent is given. |
| Marketing / Third Party | Track conversions from paid advertising (Facebook Pixel, Google Ads). Only active if you have opted in. |
| When you first visit the Platform, you will see a cookie consent banner with four separate toggles — one for each category above (except Strictly Necessary, which cannot be disabled). You can update your cookie preferences at any time via the Cookie Settings link in the website footer. | A full list of the specific cookies we use, their names, providers, and expiry periods is available at /privacy-policy#section-12. |
13. How We Protect Your Data
We take security seriously. Here are the main protections we have in place.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:
All data in transit is encrypted using TLS 1.2 or higher (HTTPS).
All data at rest is encrypted using AES-256 encryption on AWS infrastructure.
Payment card data is never stored on our servers — it is handled directly by Stripe under PCI DSS Level 1 compliance.
Bank account details for Tradesperson payouts are held by Stripe under Stripe Connect Express — we do not have access to raw bank credentials.
User authentication uses industry-standard NextAuth.js with support for Google and Apple Sign-In. Passwords are hashed and salted — we cannot read your password.
Two-factor authentication (2FA) is available and recommended for all accounts.
Role-based access controls ensure a homeowner cannot access tradesperson data or admin endpoints.
All API inputs are sanitised against SQL injection, XSS, and CSRF attacks.
Bot protection (honeypot fields and rate limiting) is built into all registration and submission forms.
Real-time error monitoring via Sentry with immediate alerting to our engineering team.
A full security review is conducted before every major platform release.
Despite these measures, no system is entirely secure. If you believe your account has been compromised, please contact us immediately at privacy@buildermatch.ai.
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the ICO within 72 hours of becoming aware of the breach (UK GDPR Article 33);
- Notify you without undue delay if the breach is likely to result in a high risk to your rights (UK GDPR Article 34);
- Tell you what happened, what data was involved, what steps we have taken, and what you can do to protect yourself.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes — changes that affect how we use your personal data or your rights — we will:
- Email you at your registered address with a summary of the changes at least 30 days before they take effect;
- Display a prominent notice on the Platform; and
- Update the 'Last Updated' date at the top of this Policy.
Your continued use of the Platform after the effective date of a material change constitutes your acceptance of the updated Policy. If you do not agree to the changes, you should close your account before the effective date.
For minor changes (such as correcting a typographical error or clarifying existing language without changing the substance), we will update the policy and the 'Last Updated' date without prior notice.
Previous versions of this Privacy Policy are available on request by emailing privacy@buildermatch.ai.
15. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please get in touch:
| Details | Contact Method |
|---|---|
| privacy@buildermatch.ai | Privacy enquiries and data rights requests |
| Post | dpo@buildermatch.ai |
| ICO (if your complaint is unresolved) | Data Protection Team, Builder Match AI Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom |
| ico.org.uk · 0303 123 1113 |