Privacy policy

Last updated: October 31, 2026

This policy explains how personal information is handled when you use builder77.com, the builder77 builder and the apps hosted by builder77 (including *.builder77.app and connected custom domains).

1. Who is responsible

The controller responsible for your personal information is:

Hüseyin Can Bayram, sole proprietorship (şahıs işletmesi) operating builder77
Mithatpaşa Cd. No: 7, 41001 İzmit / Kocaeli, Türkiye
Contact: contact form · [email protected]

Full provider details are in our Legal notice. We have not appointed a data protection officer, as we are not required to. For any privacy question, write to us through the contact form.

2. Two kinds of users

• Builders — people with a builder77 account who create websites and apps. For builder data, we are the controller.
• App users — people who use an app that a builder created and published on builder77. For data inside those apps (database records, app user accounts, uploads), the builder decides what is collected and why; we process it on the builder's behalf as a processor, under our Data Processing Agreement. That data is stored in the EU (Vienna, Austria).

If you are an app user with a question about your data in a specific app, please contact the person or company that runs that app first.

3. Information we collect

Information you give us

• Account details: name, email address and password (stored only as a bcrypt hash).
• Your projects: prompts and chat messages, images you attach for reference, generated code, version history, app settings, custom domains and anything you type into the code editor.
• Billing details: plan, purchases, currency and payment records. Card details are collected by our payment provider; we never see or store full card numbers.
• Messages to us: support requests, form submissions (contact, partner, careers, affiliate and abuse reports) and feedback such as roadmap votes.

Information collected automatically

• Usage data: credit usage, features used, errors captured from your app previews (so "Fix with AI" can work), and server logs such as IP address, browser type and timestamps.
• Trying builder77 without an account: for the free trial we keep a keyed hash of the network address (never the address itself), the phone platform (iOS or Android) and whether an app's built-in browser was used (such as Instagram's). Besides limiting free trials, this lets us ask you, if you sign up in your phone's own browser within a day, whether to move an app you had just started there to your account. Nothing is moved unless you confirm. Legal basis: our legitimate interest in preventing abuse and keeping your work (Art. 6(1)(f) GDPR).
• App analytics: for published apps we count page views per day, number of app users and number of records. These are aggregate counts shown to the app's owner.
• Website statistics (no cookies): to understand how our website is used, we count page views: the page, the referring website or campaign, the page language, country and device type. No cookies are used for this and no IP addresses are stored; unique visitors are counted with an anonymous code that changes every day, so nobody can be recognized from one day to the next. Legal basis: our legitimate interest in improving the website (Art. 6(1)(f) GDPR).
• Cookies and browser storage: see section 9.

The builder77 mobile app

• Sign in with Apple or Google: we receive your name, email address (with Apple, possibly a private relay address that forwards to you) and a stable account ID from that provider.
• Notifications: if you allow them, a push-notification token for your device, its platform and language, used only to tell you when a build is ready. You can turn them off in your device settings at any time.
• Purchases: for purchases in the app, Apple or Google send us the transaction details (product, transaction ID, dates, renewal and refund status). Payment details stay with Apple or Google.
• Photos: a photo you choose to attach to a message is uploaded when you send it. The app doesn't read your photo library otherwise. No advertising identifier is collected and the app doesn't track you across other companies' apps or websites.

Information in apps you build

Apps built on builder77 can store data in the built-in database, create app user accounts, upload files and send emails. That data is stored on our infrastructure and isolated per app. We access it only to provide the service, keep it secure, comply with law or investigate abuse.

4. Why we use it, and our legal bases

• To provide the service — building, hosting and running your apps, the database, sign-in, storage, AI and email features, your account, credits and subscriptions. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Payments, invoices and tax records. Legal basis: contract and our legal obligations (Art. 6(1)(b) and (c) GDPR).
• Security and abuse prevention — preventing fraud, spam and attacks, and enforcing our Terms and Responsible Use Policy. Legal basis: our legitimate interest in a safe service (Art. 6(1)(f) GDPR).
• Improving the product — understanding which features are used and where errors happen. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Service emails (password resets, receipts, important changes). Legal basis: contract. Product news only if you opted in; legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link.
• Support — answering your requests. Legal basis: contract or legitimate interest.
• Campaign attribution — remembering which link or campaign brought you to builder77, only if you accept the optional cookie in our cookie banner. Legal basis: consent (Art. 6(1)(a) GDPR and the national rules implementing the ePrivacy Directive), which you can withdraw at any time under "Cookie settings" at the bottom of every page.
• Measuring our ads — counting whether our ads on Facebook and Instagram lead to visits, sign-ups and purchases, with the Meta Pixel and Meta's Conversions API, only if you accept the optional cookies in our cookie banner (see section 9). Legal basis: consent (Art. 6(1)(a) GDPR and the national rules implementing the ePrivacy Directive), which you can withdraw at any time under "Cookie settings" at the bottom of every page.
• Measuring our Google ads — counting whether our ads on Google Search and YouTube lead people to build their first app or website, sign up or buy, with the Google Ads conversion tag, only if you accept the optional cookies in our cookie banner (see section 9). Legal basis: consent (Art. 6(1)(a) GDPR and the national rules implementing the ePrivacy Directive), which you can withdraw at any time under "Cookie settings" at the bottom of every page.

In the United States, Australia and New Zealand, campaign attribution and the measurement of our ads are on by default, without asking first, because the law there doesn't require prior consent for them. You can turn them off at any time under "Cookie settings" at the bottom of every page (in the United States also under "Your privacy choices"), and we treat a Global Privacy Control signal from your browser as turning them off. Everywhere else, including the EU/EEA, the UK, Switzerland, Canada and Türkiye, we ask first.

For people in Türkiye, we process personal data in line with the Personal Data Protection Law No. 6698 (KVKK) on the corresponding grounds.

We do not sell your personal information, and we do not use the contents of your private projects or your app users' data to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Under California law, measuring our ads with Google and Meta can count as "sharing" personal information for advertising; you can opt out of it with the "Your privacy choices" link at the bottom of every page or with a Global Privacy Control signal.

5. AI processing

When you send a message in the builder or your app calls b77.ai, the relevant prompt, conversation context and project files are sent to the AI model providers we work with so they can generate a response. They process this data on our behalf to provide the response. Please avoid including sensitive personal data in prompts unless it's necessary for what you're building.

6. Who we share information with

We share personal information only in these situations:

• Service providers (processors) who help us run builder77 under contracts that limit their use of the data: cloud hosting and storage, AI model providers, payment processing for web purchases (Whop), transactional email delivery (Brevo), domain registration for domains you buy through builder77, and customer support tools.
• Meta Platforms Ireland Limited, only with your consent, to measure our ads (see section 9).
• Google Ireland Limited, only with your consent, to measure our ads on Google Search and YouTube (see section 9).
• Public content you publish: anything you publish to a public URL can be seen by anyone with the link. Private apps are visible only to you.
• Legal reasons: when required by law, or to protect the rights, safety and property of builder77, our users or the public.
• Business transfers: if builder77 is involved in a merger, acquisition or sale of assets, data may be transferred as part of that deal, subject to this policy.
• With your consent or at your direction.

7. International transfers

builder77 is operated from Türkiye, and our service providers may process data in other countries, including the United States. Where personal data from the EU/EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

8. How long we keep it

• Account and project data is kept while your account is active.
• When you delete a project, its versions and app data are deleted from our active systems. A copy of its latest pages, the images they show and its chat is kept for 30 days so that we can look into any problems you ran into, and is then permanently deleted; deleting your account deletes it at once.
• When you delete your account, we delete or anonymize your personal information within 30 days, except where we must keep it longer, for example invoices and payment records, which tax and commercial law requires us to keep for up to 10 years.
• Server logs are kept for a limited period for security, usually no longer than 90 days.
• Backups are rotated and overwritten on a rolling schedule.

9. Cookies and browser storage

Apart from the optional Meta Pixel and Google Ads tag, we only use first-party cookies and browser storage. Google Analytics, the Meta Pixel and the Google Ads tag, which measure our ads, are optional (see below); we don't show you personalized ads on our website. Optional cookies are set only after you accept them in our cookie banner, except in the United States, Australia and New Zealand, where they are on until you turn them off (see section 4). You can change your choice at any time under "Cookie settings" at the bottom of every page.

• __Host-b77_session — keeps you signed in (strictly necessary, httpOnly).
• b77_lang — remembers your language (functional, 1 year).
• b77_consent — remembers your cookie choice (strictly necessary, 6 months).
• __Host-b77_dev — remembers that this browser has already used its free trial (trying builder77 before signing up), so the trial isn't handed out again (strictly necessary, security, 1 year).
• __Host-b77_oauth — a security check while you sign in with Google (strictly necessary, up to 10 minutes).
• g_state — set by Google's one-tap sign-in on our public pages when you close it, so it isn't offered again too soon (functional). To offer it, your browser loads Google's sign-in service (Google Ireland Limited), so Google learns that you are visiting our site; we only receive your name and email address if you choose to continue.
• __Host-b77_apple, __Host-b77_apple_fin — security checks while you sign in with Apple (strictly necessary, up to 10 minutes).
• b77_ref — set only when you open a referral link, so the referral bonus you were invited with can be applied (functional, 60 days).
• b77_attr — optional, only with your consent: remembers which link or campaign brought you to builder77, for our own campaign statistics (90 days; not shared with advertisers, except the Meta and Google ad click IDs described below).
• _ga, _ga_4M21PVVEKK — optional, only with your consent: Google Analytics (Google Ireland Limited, acting as our processor) measures visits and how our website is used (up to 2 years). It does not store IP addresses; data may be transferred to the USA under the EU-US Data Privacy Framework.
• _fbp, _fbc — optional, only with your consent: the Meta Pixel recognizes this browser and the Facebook or Instagram ad you clicked, so that visits, sign-ups and purchases can be credited to our ads (90 days). While the pixel runs, your browser also connects to Meta (facebook.com), where Meta's own cookies may be read if you use Facebook or Instagram.
• b77_mev — optional, only with your consent: hands a sign-up or purchase you have just completed to the Meta Pixel, so it is counted once (up to 10 minutes).
• _gcl_au, _gcl_aw — optional, only with your consent: the Google Ads tag recognizes this browser and the Google or YouTube ad you clicked, so that first apps or websites, sign-ups and purchases can be credited to our ads (90 days). While the tag runs, your browser also connects to Google (googleadservices.com, google.com), where Google's own cookies may be read if you are signed in to Google.
• b77_gev — optional, only with your consent: hands a sign-up or purchase you have just completed to the Google Ads tag, so it is counted once (up to 10 minutes).
• b77_cv — remembers which version of our cookie notice your choice applies to (strictly necessary, 6 months).
• b77_cd — in the United States, Australia and New Zealand, marks that the optional cookies are on by default rather than by your choice, so that this ends when you visit from another country or your browser sends a Global Privacy Control signal (strictly necessary, 6 months).
• Local storage — small interface preferences, such as a dismissed hint.

In the United States, Australia and New Zealand, the cookies marked "only with your consent" are set until you turn them off (see section 4).

You can delete cookies at any time in your browser settings; you will then be signed out and your preferences reset.

Ad measurement (Meta Pixel and Conversions API)

If you accept the optional cookies, we use the Meta Pixel and Meta's Conversions API to measure how well our ads on Facebook and Instagram work. The pixel tells Meta Platforms Ireland Limited which of our public pages you view, and when you create an account or buy a plan or credit pack (with the amount and currency). Our server then sends the same event directly to Meta, so it is counted reliably and only once: with your email address and account ID in hashed form (SHA-256), your IP address, browser type and the Meta identifiers above. We never send the contents of your projects, and the builder and the apps you build are never measured. Meta and we are joint controllers for collecting and transmitting this data (Art. 26 GDPR); Meta's further use of it is governed by Meta's privacy policy, and data may be transferred to the USA under the EU-US Data Privacy Framework. Without your consent none of this happens, except in the United States, Australia and New Zealand, where it happens until you turn it off (see section 4). You can withdraw your consent at any time under "Cookie settings" at the bottom of every page: the pixel stops, its cookies are deleted and our server sends no further events.

Ad measurement (Google Ads)

If you accept the optional cookies, we use Google Ads conversion tracking to measure how well our ads on Google Search and YouTube work. The Google tag tells Google Ireland Limited which of our public pages you open; when you arrive from one of our Google ads, it stores the ad click identifier in the cookies above, and when you then build your first app or website, create an account or buy a plan or credit pack, it tells Google that this happened (for a purchase, with the amount and currency), together with your IP address and browser details. Our server also sends the same event directly to Google through Google's Data Manager API, with the ad click identifier and the time, so that it is counted reliably and only once. If your email address is on the page (for example in the sign-up form), the tag also sends it to Google in hashed form (SHA-256), so that the conversion can be matched more reliably; we never send your name or the contents of your projects, and the apps you build are never measured. The tag never runs on the builder's own pages: what happens there is reported from an empty page of ours, so Google learns nothing about the builder except its address, which identifies an app only by a random ID. Google uses this data to measure and deliver ads as a separate controller; see Google's privacy policy and how Google uses information from sites that use its services. Data may be transferred to the USA under the EU-US Data Privacy Framework. Without your consent none of this happens, except in the United States, Australia and New Zealand, where it happens until you turn it off (see section 4). You can withdraw your consent at any time under "Cookie settings" at the bottom of every page: the tag stops, its cookies are deleted and no further events are sent.

10. Security

We use HTTPS, bcrypt password hashing, httpOnly session cookies, per-app data isolation, project-scoped app tokens and rate limiting. No system is perfectly secure, but we work hard to protect your data. Read more on our Security page.

11. Your rights

Depending on where you live, you have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• have your information deleted;
• restrict processing;
• object to processing based on legitimate interests;
• data portability (you can also export your projects yourself at any time);
• withdraw consent at any time, without affecting processing that happened before;
• opt out of the "sharing" of your personal information for advertising (California), with the "Your privacy choices" link at the bottom of every page or a Global Privacy Control signal;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or with the Turkish Personal Data Protection Authority (KVKK).

To exercise these rights, write to us through the contact form using the email address of your account. We'll respond within one month, as the GDPR requires.

12. Children

builder77 is intended for people aged 13 and over. If you are under the age of digital consent in your country (between 13 and 16 in the EU, depending on the country) or under the age of majority where you live, you may use builder77 only with the permission of a parent or legal guardian. Children under 13 may not use builder77, and we do not knowingly collect personal information from them; if we learn that an account belongs to a child under 13, we delete the account and its data. If you believe a child under 13 has given us personal information, contact us and we'll delete it. Builders whose apps are aimed at children are responsible for complying with applicable children's privacy laws.

13. Responsibilities of builders

If your app collects personal information from app users, you are responsible for telling them how you use it (for example with your own privacy policy), having a lawful basis for processing, and responding to their requests. Our Terms of Service and Responsible Use Policy describe what is and isn't allowed.

14. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll notify you by email or in the product before they take effect. The date at the top always shows the latest version.

15. Contact

Privacy questions or requests: contact form. Security issues: contact form (topic "Security"). Postal address: Hüseyin Can Bayram, Mithatpaşa Cd. No: 7, 41001 İzmit / Kocaeli, Türkiye.