Privacy policy
Last updated: 14 May 2026
1. Data controller
Nicolas Guigay (French micro-entrepreneur, trading as GenBuild — Impasse Sarrance, 64140 Billère, France) is the controller of your personal data. For any question about how your data is protected, write to contact@gen-build.app.
2. Data we collect
GenBuild collects the following data:
Account data
- Email address (primary identifier)
- Full name (optional, provided during onboarding)
- Password (stored hashed — bcrypt)
Service usage data
- Websites you create (content, settings, status)
- Uploaded assets (images, videos)
- Conversations with the AI (for processing and improvement)
- Form submissions received through your websites
Payment data
- Stripe customer ID (external reference)
- Subscription and invoice history
- Card details are never stored by GenBuild — they are handled directly by Stripe (PCI DSS Level 1)
Analytics data (generated websites)
- Page views, traffic sources
- Anonymised browser fingerprint (UA hash — no personal data)
- No third-party cookies, no cross-site tracking
3. Purposes of processing
| Purpose | Legal basis |
|---|---|
| Providing the Service | Performance of the contract |
| Handling payments | Performance of the contract |
| Transactional emails | Performance of the contract |
| Security and abuse prevention | Legitimate interest |
| Improving the Service (analytics) | Legitimate interest (anonymised) |
| Legal compliance | Legal obligation |
4. Sub-processors
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, storage | EU (AWS Frankfurt) |
| Vercel | Hosting, CDN | EU + USA |
| Stripe | Payments | USA (Privacy Shield) |
| Resend | Transactional emails | USA |
| OpenAI / Anthropic | AI generation (website content) | USA |
| PostHog | Product analytics (Service usage measurement) | EU (Frankfurt) |
| Google Ads | Advertising conversion measurement (only with your consent) | USA |
Standard contractual clauses (SCCs) govern transfers outside the EU.
5. Retention periods
- Account data: for the duration of the contract + 3 years
- Payment data: 10 years (accounting obligation)
- In-app notifications: 90 days
- Technical logs: 30 days (security)
- Anonymised analytics: 1 year
6. Your GDPR rights
Under Regulation (EU) 2016/679, you have the following rights:
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure: ask for your data to be deleted
- Portability: receive your data in a structured format
- Objection: object to certain processing
- Restriction: restrict processing in certain cases
To exercise these rights: contact@gen-build.app. We reply within 30 days. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
7. Cookies
GenBuild sets cookies that are strictly necessary for the Service to work (authentication, session). These do not require your consent.
Three other purposes require your prior consent and are switched off by default. You accept or refuse them, separately, from the banner shown on your first visit:
- Product analytics — understanding how the Service is used in order to improve it (PostHog, EU).
- Session recording — replaying a session to diagnose an interface problem. Sensitive fields (passwords, payment details) are masked.
- Advertising and conversion measurement — measuring how well our ad campaigns perform (Google Ads). If you refuse, no advertising cookie is set and no Google script is loaded.
Your choice is kept in your browser and can be changed at any time by clearing site data. If your browser sends the “Do Not Track” signal, it counts as refusing all of these purposes.
8. Security
We apply appropriate technical and organisational measures: TLS encryption in transit, encryption at rest, Row Level Security (RLS) on every user table, strong authentication, rate limiting.
9. Contact and complaints
For any question about your personal data: contact@gen-build.app