Privacy policy

Last updated: October 6, 2026

This policy explains how personal information is handled when you use builder77.com, the builder77 builder and the apps hosted by builder77 (including *.builder77.com and connected custom domains).

1. Who is responsible

The controller responsible for your personal information is:

Hüseyin Can Bayram, sole proprietorship (şahıs işletmesi) operating builder77
Mithatpaşa Cd. No: 7, 41001 İzmit / Kocaeli, Türkiye
Contact: contact form · [email protected]

Full provider details are in our Legal notice. We have not appointed a data protection officer, as we are not required to. For any privacy question, write to us through the contact form.

2. Two kinds of users

• Builders — people with a builder77 account who create websites and apps. For builder data, we are the controller.
• App users — people who use an app that a builder created and published on builder77. For data inside those apps (database records, app user accounts, uploads), the builder decides what is collected and why; we process it on the builder's behalf as a processor.

If you are an app user with a question about your data in a specific app, please contact the person or company that runs that app first.

3. Information we collect

Information you give us

• Account details: name, email address and password (stored only as a bcrypt hash).
• Your projects: prompts and chat messages, images you attach for reference, generated code, version history, app settings, custom domains and anything you type into the code editor.
• Billing details: plan, purchases, currency and payment records. Card details are collected by our payment provider; we never see or store full card numbers.
• Messages to us: support requests, form submissions (contact, partner, careers, affiliate and abuse reports) and feedback such as roadmap votes.

Information collected automatically

• Usage data: credit usage, features used, errors captured from your app previews (so "Fix with AI" can work), and server logs such as IP address, browser type and timestamps.
• App analytics: for published apps we count page views per day, number of app users and number of records. These are aggregate counts shown to the app's owner.
• Website statistics (no cookies): to understand how our website is used we count page views — the page, the referring website or campaign, the page language, country and device type. No cookies are used for this and no IP addresses are stored; unique visitors are counted with an anonymous code that changes every day, so nobody can be recognised from one day to the next. Legal basis: our legitimate interest in improving the website (Art. 6(1)(f) GDPR).
• Cookies and browser storage: see section 9.

Information in apps you build

Apps built on builder77 can store data in the built-in database, create app user accounts, upload files and send emails. That data is stored on our infrastructure and isolated per app. We access it only to provide the service, keep it secure, comply with law or investigate abuse.

4. Why we use it, and our legal bases

• To provide the service — building, hosting and running your apps, the database, sign-in, storage, AI and email features, your account, credits and subscriptions. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Payments, invoices and tax records. Legal basis: contract and our legal obligations (Art. 6(1)(b) and (c) GDPR).
• Security and abuse prevention — preventing fraud, spam and attacks, and enforcing our Terms and Responsible Use Policy. Legal basis: our legitimate interest in a safe service (Art. 6(1)(f) GDPR).
• Improving the product — understanding which features are used and where errors happen. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Service emails (password resets, receipts, important changes). Legal basis: contract. Product news only if you opted in — legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link.
• Support — answering your requests. Legal basis: contract or legitimate interest.
• Campaign attribution — remembering which link or campaign brought you to builder77, only if you accept the optional cookie in our cookie banner. Legal basis: consent (Art. 6(1)(a) GDPR and the national rules implementing the ePrivacy Directive), which you can withdraw at any time under "Cookie settings" at the bottom of every page.

For people in Türkiye, we process personal data in line with the Personal Data Protection Law No. 6698 (KVKK) on the corresponding grounds.

We do not sell your personal information, and we do not use the contents of your private projects or your app users' data to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. AI processing

When you send a message in the builder or your app calls m77.ai, the relevant prompt, conversation context and project files are sent to the AI model providers we work with so they can generate a response. They process this data on our behalf to provide the response. Please avoid including sensitive personal data in prompts unless it's necessary for what you're building.

6. Who we share information with

We share personal information only in these situations:

• Service providers (processors) who help us run builder77 under contracts that limit their use of the data: cloud hosting and storage, AI model providers, payment processing for web purchases (Whop), transactional email delivery (Brevo), domain registration for domains you buy through builder77, and customer support tools.
• Public content you publish: anything you publish to a public URL can be seen by anyone with the link. Private apps are visible only to you.
• Legal reasons: when required by law, or to protect the rights, safety and property of builder77, our users or the public.
• Business transfers: if builder77 is involved in a merger, acquisition or sale of assets, data may be transferred as part of that deal, subject to this policy.
• With your consent or at your direction.

7. International transfers

builder77 is operated from Türkiye, and our service providers may process data in other countries, including the United States. Where personal data from the EU/EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

8. How long we keep it

• Account and project data is kept while your account is active.
• When you delete a project, its files, versions and app data are deleted from our active systems.
• When you delete your account, we delete or anonymize your personal information within 30 days, except where we must keep it longer — for example invoices and payment records, which tax and commercial law requires us to keep for up to 10 years.
• Server logs are kept for a limited period for security, usually no longer than 90 days.
• Backups are rotated and overwritten on a rolling schedule.

9. Cookies and browser storage

We only use first-party cookies and browser storage. We do not use advertising cookies; Google Analytics is used only with your consent (see below). Optional cookies are set only after you accept them in our cookie banner; you can change your choice at any time under "Cookie settings" at the bottom of every page.

• __Host-m77_session — keeps you signed in (strictly necessary, httpOnly).
• m77_lang and m77_cur — remember your language and currency (functional, 1 year).
• m77_consent — remembers your cookie choice (strictly necessary, 6 months).
• m77_ref — set only when you open a referral link, so the referral bonus you were invited with can be applied (functional, 60 days).
• m77_attr — optional, only with your consent: remembers which link or campaign brought you to builder77, for our own campaign statistics (90 days; never shared with advertisers).
• _ga, _ga_4M21PVVEKK — optional, only with your consent: Google Analytics (Google Ireland Limited, acting as our processor) measures visits and how our website is used (up to 2 years). It does not store IP addresses; data may be transferred to the USA under the EU-US Data Privacy Framework.
• Local storage — small interface preferences, such as a dismissed hint.

You can delete cookies at any time in your browser settings; you will then be signed out and your preferences reset.

10. Security

We use HTTPS, bcrypt password hashing, httpOnly session cookies, per-app data isolation, project-scoped app tokens and rate limiting. No system is perfectly secure, but we work hard to protect your data. Read more on our Security page.

11. Your rights

Depending on where you live, you have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• have your information deleted;
• restrict processing;
• object to processing based on legitimate interests;
• data portability — you can also export your projects yourself at any time;
• withdraw consent at any time, without affecting processing that happened before;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or with the Turkish Personal Data Protection Authority (KVKK).

To exercise these rights, write to us through the contact form using the email address of your account. We'll respond within one month, as the GDPR requires.

12. Children

builder77 is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we'll delete it. Builders whose apps are aimed at children are responsible for complying with applicable children's privacy laws.

13. Responsibilities of builders

If your app collects personal information from app users, you are responsible for telling them how you use it (for example with your own privacy policy), having a lawful basis for processing, and responding to their requests. Our Terms of Service and Responsible Use Policy describe what is and isn't allowed.

14. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll notify you by email or in the product before they take effect. The date at the top always shows the latest version.

15. Contact

Privacy questions or requests: contact form. Security issues: contact form (topic "Security"). Postal address: Hüseyin Can Bayram, Mithatpaşa Cd. No: 7, 41001 İzmit / Kocaeli, Türkiye.