Privacy Notice
Last updated: 15 June 2026
1. Who we are
Lisa Windley ("we", "us", "our") operates Cobuild Trade Hub (the "Service"). We are the data controller for personal data processed in connection with your use of the Service.
2. Data we collect and why
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, email, password hash, business name | Create and secure your account | Contract |
| Service content | Projects, quotes, uploads, prompts, AI outputs | Provide the Service to you | Contract |
| Usage & device data | IP address, device/browser info, log events | Security, fraud prevention, product improvement | Legitimate interests |
| Support data | Messages you send us | Provide customer support | Legitimate interests |
| Marketing | Email address, preferences | Send product updates (opt-out anytime) | Consent / legitimate interests |
| Billing | Handled by Stripe; we receive limited order metadata | Manage subscriptions and invoicing | Contract / legal obligation |
3. Who we share data with
- Stripe — our payment processor for subscriptions, invoicing, and tax calculation.
- Service providers / subprocessors — hosting, database, AI model providers, analytics, email delivery, customer support tooling, error monitoring.
- Professional advisers — legal, accounting, and similar advisers where necessary.
- Authorities — where required by law, regulation, or valid legal process.
4. International transfers
Some of our providers are located outside the UK/EEA. Where that is the case we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or adequacy decisions.
5. Retention
We keep personal data only as long as needed for the purposes set out above. Account and project data is kept while your account is active and for a reasonable period afterwards (typically up to 24 months) to handle disputes and meet legal obligations, then deleted or anonymised. Billing records are kept for as long as tax law requires.
6. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, or port your personal data; to object to processing; and to withdraw consent at any time. UK/EEA users also have the right to lodge a complaint with a supervisory authority (in the UK, the ICO). We aim to respond to rights requests within one month.
7. Security
We use appropriate technical and organisational measures — including encryption in transit, access controls, and authenticated infrastructure — to protect personal data. No system is perfectly secure; we encourage you to use a strong, unique password.
8. Cookies
We use essential cookies and similar technologies needed to run the Service (authentication, security). We may use limited analytics cookies to understand usage. You can manage cookies in your browser settings; disabling essential cookies will affect the Service.
9. Contact
For privacy questions or to exercise your rights, contact Lisa Windley via the support options in the app.