Privacy Policy
Last Updated: June 2, 2025
Lyor Itzhaki ("BuiltIt," "we," "us," or "our") operates BuiltIt.dev. This Privacy Policy explains how we collect, use, and disclose personal information ("Personal Data") and the choices you have.
BuiltIt does not sell or share Personal Data for cross-context behavioral advertising.
1 | Notice at Collection (California CCPA/CPRA)
| Category (CPRA) | Purpose of Use | Typical Retention | Sold or Shared? |
|---|---|---|---|
| Identifiers (name, email, IP, cookie IDs) | Respond to inquiries, provide Services, analytics, security | Customer-life + up to 24 months; cookies per Cookie Policy | No sale. Limited sharing with analytics providers. |
| Customer Records (name, company, contact info) | Client onboarding, billing, support | Relationship + 7 years (legal) | No |
| Internet Activity (page views, clicks, Clarity session data) | Analytics, UX improvement, security | Up to 26 months (aggregated) | Shared with analytics providers |
| Geolocation (coarse) | Analytics, language/local UX | Same as Internet Activity | Shared with analytics providers |
| Professional Info (company, role) | Context for Services | Relationship duration | No |
| Inferences | Improve Services & marketing | Same as analytics | No |
We do not intentionally collect Sensitive Personal Information.
2 | What We Collect & Why
- Personal Data you provide – contact emails, project details, payment info (via Stripe).
- Usage Data – IP address, device/browser type, pages visited, interactions, collected via Microsoft Clarity and Google Analytics 4. Clarity may record anonymized session replays.
- Cookies – see Cookie Policy.
We use this data to operate the Website, fulfill contracts, improve Services, secure the site, and (with consent) send marketing communications.
3 | Legal Bases (EEA/UK)
- Contract performance
- Legitimate interests (site security, analytics, basic marketing)
- Consent (cookie analytics, marketing emails)
- Legal obligations
4 | Data Retention
We keep data only as long as needed for stated purposes, to comply with law, or to resolve disputes (see table above).
5 | International Transfers
BuiltIt.dev is US-based. Transfers from the EEA, UK, or Switzerland rely on Standard Contractual Clauses (plus UK and Swiss addenda). Request copies at privacy@builtit.dev.
6 | Who We Share Data With
| Purpose | Provider | Privacy Docs |
|---|---|---|
| Hosting/CDN | Vercel | Privacy • DPA |
| Analytics | Microsoft Clarity | Privacy • DPA |
| Email & Docs | Google Workspace | Privacy • DPA |
| Payments | Stripe | Privacy • DPA |
| Scheduling | Calendly | Privacy • DPA |
Processors act only under our instructions and under written DPAs.
7 | Security
We use industry-standard safeguards (HTTPS/TLS, access controls, encryption at rest for key services). No system is 100% secure; transmission is at your own risk.
8 | Your Rights
- EEA/UK – access, rectification, erasure, restriction, portability, objection, lodge complaint.
- California – right to know, delete, correct, opt-out of sharing, non-discrimination, limit SPI.
- Global Privacy Control signals are honored as an opt-out of sharing for targeted advertising (we currently do none).
Email privacy@builtit.dev to exercise rights; we may verify identity before acting.
9 | Children
The Services are not directed to anyone under 18. We do not knowingly collect data from minors.
10 | Third-Party Links
We are not responsible for external sites linked from the Website.
11 | Policy Changes
We may update this Privacy Policy. Changes are effective when posted with a new "Last Updated" date.
12 | Contact
Questions? Email privacy@builtit.dev.