1. Status of This Draft
This is a draft for review. It binds neither party until both sign it. To sign one, write to the address at the end of this page.
2. Roles and Scope
This addendum applies when Builder Studio processes personal data on your behalf while providing the service: you are the controller, or a processor for your own client, and we are your processor or subprocessor. It does not cover account, billing, and security data, which we handle as a controller under the Privacy Policy.
3. Instructions
We process the data only to provide the service as you configure and use it, and as your Terms of Service and this addendum describe. We tell you if we believe an instruction breaks data protection law. We do not sell the data or use it to train AI models.
4. Subprocessors
You authorize the subprocessors on the Subprocessors page. We bind each to data protection terms no less protective than these, and we stay responsible for their work. We give at least 30 days’ notice before adding one, and you may object on reasonable data protection grounds.
5. Security and Confidentiality
The measures on the Security page apply. Anyone we authorize to process the data is bound to keep it confidential.
6. Personal Data Breaches
If we become aware of a breach affecting your personal data, we tell you without undue delay, with what we know about its nature, the data involved, and what we are doing about it.
7. Requests and Assistance
We pass on requests from people exercising their data rights rather than answering them ourselves, and we help you respond, assess impact, and consult regulators where the law requires and within reason. We give you the information needed to show compliance with this addendum.
8. International Transfers
Our primary processing is in the United States. Where European Economic Area data needs a transfer mechanism, the Standard Contractual Clauses (EU 2021/914) apply, Module Two where you are a controller and Module Three where you are a processor. For United Kingdom data, the UK International Data Transfer Addendum applies to them. The details they require are in the annex below.
9. Deletion
When you delete a workspace, or the service ends, we delete your personal data within the periods in the Privacy Policy, apart from what the law requires us to keep and copies in backups until they age out.
10. Annex: Processing Details
| Item | Detail |
|---|---|
| Subject matter | Hosting and operating workspaces, canvases, published sites, forms, and AI features. |
| Duration | As long as you use the service, then until deleted under this addendum. |
| People | Your members and invitees, your site visitors, and anyone named in content you add. |
| Data | Names, email addresses, and whatever you put in content, forms, and imports. You should not send special-category data. |
| Form submissions | Kept 180 days, then deleted. |
| Security log | Workspace audit entries are kept 365 days. |
11. Contact
To sign this addendum or ask about it, contact us at legal@builder.studio.