Privacy Policy
Last updated: October 14, 2026
1. Data Controller
WhatsBuilt Oy
Business ID: 3623126-5
Finland
Email: privacy@whatsbuilt.fi
2. What Data We Collect
Contact Form Submissions
When you submit our "Book Demo" form, we collect:
- Name
- Work email address
- Company name
- Optional message
Automatically Collected Data
Our hosting provider (Amazon CloudFront) writes a server-side access log for every request. Each entry contains the IP address, the date and time, the page or file requested, the browser type (user agent), the referring page, and the response status. No cookie or client-side tracking is involved. We use these logs for security monitoring and abuse prevention, and for aggregate traffic statistics (for example page views and approximate visitor counts per day), which we compute from the logs with Amazon Athena. The logs and the query results are stored in the EU and deleted automatically after 180 days.
3. How We Use Your Data
| Data | Purpose | Legal Basis |
|---|---|---|
| Contact form data | Respond to your inquiry and schedule a demo | Legitimate interest (Art. 6(1)(f) GDPR) |
| Access logs (incl. IP address) | Security monitoring, abuse prevention, aggregate traffic statistics | Legitimate interest (Art. 6(1)(f) GDPR) |
| Support requests | Answer support requests about the service your organisation has contracted for | Legitimate interest (Art. 6(1)(f) GDPR) |
4. Sub-processors
We use the following third-party services to process your data:
| Service | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Website hosting, CDN, access logs and their analysis (Athena) | EU (Stockholm, eu-north-1) |
| Formspree | Contact form processing | United States |
| Google Workspace | Email for support requests: team notifications and correspondence with support@whatsbuilt.fi | Not restricted to the EU |
Data transfers to the United States (Formspree) are covered by the EU-US Data Privacy Framework. Processing by Google Workspace may take place outside the EU/EEA and is covered by Google's certification to the EU-US Data Privacy Framework and the Standard Contractual Clauses in its data processing terms.
5. Data Retention
- Contact form submissions: Retained for 24 months after your last interaction, then deleted.
- Access logs (incl. IP address): Deleted automatically after 180 days, together with any statistics query results derived from them.
- Support requests: Deleted 24 months after the last activity on the request (see section 6).
6. Support Requests
This section applies when you send a support request, bug report or feedback from inside the WhatsBuilt app, for example through the app's feedback form. It does not cover the website's contact form, which is described above.
What we store
When you send a request, we store:
- Your name, email address and language, copied from your user account at the moment you send the request
- The name of your organisation and, if you choose one, the project the request is about
- The kind of request (something is broken, a question, or feedback) and the text you write
- Technical details that the form lists before you send: the app version, the page you were on (without identifiers), your device and browser type, screen size, whether the device was online, the number of unsent changes, and your role
- If you send further material with a request, for example a photo, or reply to us by email, we store that too and treat it on the same terms
Why we use it
We use a request to read it, answer you and fix the problem you describe, and to keep a record of the problems and suggestions we receive. Only WhatsBuilt's support team reads requests. Other users in your organisation cannot see them.
Where it is stored and who handles it
Requests are stored in AWS in the EU (Stockholm, eu-north-1).
When a request arrives, our team gets an email notification. It contains only the request number, its kind, the time and a link to a view that only our support staff can open. It does not contain your text, your technical details or the name of your organisation.
Email between you and our support team, such as our reply from support@whatsbuilt.fi and any reply you send, can pass through Google Workspace. Google Workspace is therefore a sub-processor for support requests (see section 4). Its processing is not restricted to the EU.
Retention
A request, with its messages and attachments, is deleted 24 months after its last activity (sending it, a new message, or a change to its status), whether it is open or closed. You can ask for earlier deletion at privacy@whatsbuilt.fi. Where we need to keep a request as the history of a bug, we remove your name, email address and text from it instead.
7. Your Rights (GDPR)
Under the General Data Protection Regulation, you have the right to:
- Access – request a copy of the personal data we hold about you
- Rectification – request correction of inaccurate data
- Erasure – request deletion of your data ("right to be forgotten")
- Portability – receive your data in a machine-readable format
- Objection – object to processing based on legitimate interest
- Complaint – file a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)
To exercise any of these rights, contact us at privacy@whatsbuilt.fi. We will respond within 30 days.
8. Cookies
This website does not use cookies or any client-side tracking technology.
9. Security
All data is transmitted over HTTPS (TLS 1.2+). Our infrastructure is hosted on AWS with encryption at rest (AES-256) and in transit. Access to personal data is restricted to authorized personnel only.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Material changes will be announced on our website.
11. Contact
For any privacy-related questions or requests:
Email: privacy@whatsbuilt.fi
WhatsBuilt Oy (3623126-5), Finland