Data Processing Agreement

Last updated: 2 November 2026

1. Who this agreement is between

This Data Processing Agreement ("DPA") is part of the Terms of Service between you, the person or company with a builder77 account who builds and publishes apps ("you", the controller), and the operator of builder77 named in the Legal notice ("we", the processor). It applies automatically to every account; there is nothing to sign. If you build apps for clients, you may be their processor: then we are your sub-processor under the same terms.

It covers the personal data that apps you build store or handle on builder77 ("App Data"): your app users' accounts, the records your app saves in its database, the files people upload, the emails and notifications your app sends, and the related technical data. For your own builder77 account we are the controller, as our Privacy Policy explains.

2. What we do with App Data

• We process App Data only to run your apps for you, on your documented instructions: these Terms, the way you build and configure your app (its pages, code and access rules) and the settings you choose in builder77. We don't use App Data for our own purposes, don't sell it and don't use it to train AI models.
• If a law requires us to process App Data otherwise, we will tell you first, unless that law forbids it.
• Everyone at builder77 who can access App Data is bound to confidentiality, and accesses it only when it is needed to provide the service, keep it secure, fix a problem you or your users report, or comply with the law.

Details of the processing (subject matter, duration, nature and purpose, kinds of data and of people) are in Annex 1.

3. Security

We protect App Data with the technical and organisational measures in Annex 2, and keep them at a level appropriate to the risk. We may improve them over time, but never lower the overall protection.

4. Sub-processors

You authorise us to use the sub-processors listed in Annex 3. We bind each of them by contract to data protection obligations at least as protective as this DPA, and we remain responsible to you for their work.

We announce a new sub-processor at least 30 days before it starts processing App Data, by updating Annex 3 and emailing you if you have published an app. If you object on reasonable data protection grounds, tell us within that time: we will look for a solution, and if there is none you may stop using the affected part of the service or close your account, and we refund what you paid in advance for the time you can no longer use.

5. Helping you with your users' rights

Your app users can download their data and delete their account in your app (the account page of builder77's sign-in blocks, or b77.auth.exportData and b77.auth.deleteAccount). In builder77's Data tab you can view, correct, export and delete records, download one person's data and delete a person with what they saved. If a user writes to us about your app, we pass the request on to you without answering it ourselves. Where you need more help to answer a request, we give it.

6. Personal data breaches

If we become aware of a breach of security affecting App Data, we notify you without undue delay, and where possible within 48 hours. We tell you what we know (what happened, which data and how many people are likely affected, the likely consequences and what we are doing about it) and keep you updated, so that you can meet your own obligations to notify authorities and the people affected.

7. Other help

We help you, with the information we have, with data protection impact assessments and prior consultations with supervisory authorities where the law requires them for your use of builder77.

8. Where App Data is stored, and transfers

• App Data (the database and uploaded files) is stored on our servers in the European Union, in Vienna, Austria. Encrypted copies of our backups are kept with a sub-processor outside the EU (Annex 3); the key never leaves our control.
• builder77 is operated from Türkiye. Access to App Data from there, for operation and support, is a transfer to a country without an adequacy decision. For it, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply between you and us and are incorporated into this DPA by reference: Module Two (controller to processor), and Module Three where you are a processor for your client. For them: the docking clause (Clause 7) applies; under Clause 9 sub-processors are authorised generally, with the notice in section 4; the optional wording of Clause 11 does not apply; the competent supervisory authority under Clause 13 is the one competent for you; the clauses are governed by the law of Austria (Clause 17) and disputes go to the courts of Vienna, Austria (Clause 18). Annexes 1 to 3 of this DPA are the clauses' annexes. If the clauses and this DPA ever conflict, the clauses prevail.
• Transfers to sub-processors outside the EU/EEA rely on an adequacy decision, such as the EU–US Data Privacy Framework for providers certified under it, or on the Standard Contractual Clauses.

9. Deletion at the end

You can export your app's data at any time from the Data tab. When you delete an app, its database, app user accounts and uploaded files are deleted from our active systems straight away (only a copy of its pages, the pictures they show and its chat with the builder's AI is kept for 30 days, so that we can look into problems you ran into); when you delete your account, so are those of all your apps, and the copy too. Backups are kept for at most 14 days, so deleted data is gone from them within that time. When a person deletes their account in your app, their own records and photos are deleted the same way, while what they sent you (orders, bookings, messages) stays with you.

10. Information and audits

On request we give you the information you need to show that this DPA is met, including answers to reasonable security questionnaires. If that is not enough, or a supervisory authority asks for it, you may audit us, yourself or through an independent auditor bound to confidentiality, with at least 30 days' notice, during business hours and at most once a year (more often after a breach), at your own cost.

11. Liability, term and changes

Liability under this DPA follows the Terms of Service, except where the GDPR or the Standard Contractual Clauses say otherwise. This DPA lasts as long as we process App Data for you. We may update it, for example when we add a sub-processor or the law changes; changes that reduce your protection need your agreement. Questions: [email protected].

Annex 1: Details of the processing

• Subject matter and duration: hosting and running the apps you build on builder77, for as long as you use builder77 and until App Data is deleted (section 9).
• Nature and purpose: storing and serving your app's pages, database records and uploaded files; signing your app's users in and out; sending the emails and notifications your app sends; payments your app takes through your own payment account; your app's built-in AI features when your app uses them; backups, security, support and fixing problems.
• Kinds of personal data: whatever your app collects, which you decide. Typically: app user accounts (name, email address, a hashed password, a Google account ID if they sign in with Google), the records your app saves (for example profiles, notes, journal entries, bookings, orders, messages), files and photos people upload, notification subscriptions, and technical data such as IP addresses and browser details in server logs. If your app collects special categories of data (for example health), you must have a legal basis and tell your users.
• People concerned: your app's users and visitors, and the people your app keeps data about (for example your customers or staff).

Annex 2: Technical and organisational measures

• Encryption in transit: all traffic to builder77 and to published apps uses HTTPS (TLS).
• Passwords: stored only as bcrypt hashes; never shown, exported or emailed.
• Separation: every record and file belongs to one app; the server checks every request against the app's access rules (each person's own data, members only, staff only and more). An app's owner can also keep each person's own data hidden from themselves and their admins.
• Isolation of code: code an app runs on a server runs in sandboxed containers on a separate server, never on the server that holds App Data.
• Access control: server access only for the operator, with SSH keys (no passwords); firewalls in front of the servers; builder77 accounts protected against automated sign-ups and by rate limits.
• Availability and backups: database and file backups twice a day, kept on the server for at most 14 days, with daily off-site copies encrypted with AES-256 before they leave our servers; restoring from them is tested.
• Monitoring: alerts for failed backups, errors and unusual use; server logs kept for a limited time, usually no longer than 90 days.
• Deletion: tools for your users and for you to delete data (section 9), and deletion of whole apps and accounts.
• People: access to App Data only for the operator and only when needed (section 2), with confidentiality.

Annex 3: Sub-processors

| Sub-processor | What it does for App Data | Where |
|---|---|---|
| netcup GmbH, Germany | Servers: the database, uploaded files, apps' own servers, backups | Vienna, Austria (EU) |
| Cloudflare, Inc. | Network, encryption and protection in front of builder77; caches public files (not the photos people upload in apps) | Worldwide network (USA company) |
| Brevo SAS, France | Delivers the emails apps send (confirmations, password resets, notifications, scheduled emails) | EU |
| GitHub, Inc. | Keeps encrypted copies of our backups (it has no key) | USA |
| Anthropic, PBC | AI models: the builder's AI that builds and changes apps, apps' built-in AI when an app uses it, our support tools | USA |
| Google LLC / Google Ireland Limited | AI pictures and a backup AI model when an app uses its AI; "Continue with Google" when an app offers it; push notifications to Chrome and Android | USA / EU |
| Apple, Mozilla, Microsoft | Push notifications to their browsers when an app sends them (the content is encrypted end to end) | USA |

Payments your app takes go through your own account with your payment provider (for example Stripe, Whop or iyzico), under your own agreement with them.