1. What we collect
When you use Need for Build we collect only what is necessary to deliver your scaffold and operate the service. We do not sell or share your data with advertisers.
| Data | Where stored | Retention |
|---|---|---|
| Email address | Supabase (encrypted at rest) | Until account deletion |
| Business idea description | Supabase analyses table | Until account deletion |
| Payment info | Stripe (PCI compliant — never touches our servers) | Managed by Stripe |
| Generated scaffold (AI output) | Supabase Storage | 1 year, then archived |
| Quality scoring telemetry (automated, no PII) | Supabase analyses.quality_score columns | Same as analysis |
| Build telemetry (OPT-IN only) | Supabase scaffold_build_events | Cascade-deleted with analysis |
2. Third-party processors
Need for Build relies on the following sub-processors. Each is listed with what they handle:
- Anthropic — the AI pipeline sends your business idea description, form answers and intermediate analysis output to Claude models. Anthropic does not train on API data by default.
- OpenAI & Google (Gemini) — crosscheck reviewers receive the same data as Anthropic.
- Stripe — payment card data. Never reaches our servers.
- Supabase (hosted on AWS) — primary database + file storage.
- Resend — transactional email delivery (analysis-ready notifications).
- Brevo — marketing automations. Your email and lifecycle attributes (tier, signup source, language, last activity) are mirrored to Brevo only when marketing email is enabled. Opting out in your account or unsubscribing in Brevo suppresses both directions.
- Recraft & Browserbase — brand asset generation and reference-website cloning (only invoked when you provide a style reference URL).
- Vercel — hosting and edge functions.
3. Optional build telemetry
The scaffold we deliver ships with lib/build-telemetry.ts — an OPTIONAL wrapper that can ping our beacon endpoint when you run the verification commands in PROMPT.md.
Default: OFF. The wrapper activates only when you set NEXT_PUBLIC_BUILD_TELEMETRY=1 in your .env.local.
When enabled, each ping carries: the analysis_id you already own, a step number (0–50), an event type (start / success / error) and — for errors — a 500-character excerpt with file paths stripped. No PII, no cookies, no fingerprinting. Source IP is truncated to /24 (IPv4) or /48 (IPv6) for rate-limit bucketing only and is never surfaced anywhere.
You can disable telemetry at any time by removing the env var or deleting lib/build-telemetry.ts from your scaffold.
4. Your GDPR rights
- Access — every piece of data we hold about you is visible in your dashboard (/dashboard).
- Portability — the ZIP you download is your data export.
- Deletion — account deletion cascades to every analysis, generated file and telemetry row associated with you. Contact us via the email below.
- Processing basis — contract performance (you pay for the service we deliver).
5. Security overview
HTTPS everywhere. Row-Level Security on every database table. Stripe webhook signature validation. AI prompts wrap user input in XML tags with explicit anti-prompt-injection instructions. API keys are server-side only and validated at build time.
For the full security architecture, threat model and OWASP checklist, see our internal docs/SECURITY.md.
6. Contact
For data requests, deletions or any privacy question, reach out via the contact page.