What Builder keeps, and who sees it

Builder is made by Sidecut Studio, the trading name of [Legal business name], [Business address]. Questions about your data go to [Contact email].

This page covers Builder at builder.sidecut.dev and this site, sidecut.dev. This site sets no cookies and runs no analytics.

• Your name, your sign-in name (your email, if you signed up with one) and a scrambled copy of your password. Builder never stores the password itself.
• While you're signed in, a session record with your IP address and your browser's name and version, so a sign-in can be checked and ended.
• Counts of sign-in and email attempts by IP address and by email address, to stop people guessing passwords or flooding an inbox.
• Your settings, including the note you write in About you. That note goes with every message you send, so the assistant knows who it's working for.

• Each project's messages, replies, notes, saved versions, attachments and the files Builder makes for you.
• The project list, messages and settings live in a Postgres database run by Neon. File contents (project files, versions, attachments and skills you upload) live in private Vercel Blob storage, and a copy goes to a private Cloudflare R2 bucket twice a day as a backup.
• Each project has a preview link with a long random key in it. Anyone you give that link to can see the preview, so share it only with people you'd show the work to.
• Replies run on a private machine of your own in Vercel Sandbox. It holds your project's files, and its saved disk is kept for 30 days after you last use it.
• Usage records: which feature ran, when, which model, and what it cost. These records never hold your messages, files or passwords.
• Keys you make for outside coding agents to read your looks through Builder's MCP server.
• Vercel Speed Insights measures how fast Builder's pages load. It sets no cookies.

Sidecut, Builder's assistant, writes its replies with AI models. To do that, Builder sends your message, your About you note, the project's files and attachments, its notes and the look you picked to the model through Vercel AI Gateway. Home's idea cards are made the same way.

• The models come from Anthropic (Claude), OpenAI, Google and Moonshot AI (Kimi). Claude calls go only to Anthropic itself. Kimi calls go only to Amazon Bedrock and Baseten, which AI Gateway lists as keeping nothing and never training on what they're sent.
• Each provider handles what it receives under its own terms for business customers. [Owner: say whether any provider may keep or train on prompts]
• If the owner invited you to use your own Claude or Codex account inside Builder, you sign in to it on your own Sandbox machine. Builder's database only records that you're signed in, never the sign-in itself.

[Owner's own section on AI content goes here]

When you ask Builder to capture a website's look, it runs a capture on Apify, a hosted web-automation service. The capture visits the public site you named, takes screenshots and saves its colours, fonts, spacing and layout as a look in your account. It only visits public addresses.

• Import from Instagram or TikTok (in beta) reads your own public profile through Apify after you tick This is my own account. Builder keeps your profile picture, bio, links, follower and following counts, verified badge, and your posts' pictures, captions, alt text, dates, and like and comment counts. Other people's handles in captions become @…, and post locations are dropped before Builder saves the import.
• Inspiration from a creator's profile reads someone else's public profile once. Its post pictures go to an AI model through AI Gateway to write style notes, and only those notes are kept. No pictures, captions, handle, name, bio, follower counts or places are kept, and the run is deleted from Apify when it ends.

Apify keeps each capture's and import's run, with the profile as it was read, for its own retention period. Inspiration runs are the exception, deleted straight away.

[Owner's own section on site captures goes here]

Builder sends account emails (checking your address, resetting your password, or telling you that you already have an account) through Resend, from mail.sidecut.dev. Resend sees your email address and the message. Builder sends no marketing email.

• Connectors let the assistant use another service you've signed in to, such as Firecrawl. When Sidecut signs in to one, Builder's server keeps the sign-in encrypted, tied to you and that connector. It's never sent to a page, your Sandbox machine or a log, only to the connector itself.
• When the assistant uses a connector, the service gets what the assistant asks it for. That service's own privacy policy covers what it does with it.
• Removing a connector in Builder deletes Sidecut's sign-in to it straight away. A sign-in made through your own Claude or Codex account stays on your Sandbox machine until you sign out there. You can also take back access in that service's own settings.

Only the services named above, and only to run and build Builder: Neon, Vercel (hosting, Blob, Sandbox, AI Gateway and Speed Insights), Cloudflare R2, the AI model providers, Apify, Resend and the connectors you turn on. Builder doesn't sell your data or share it for advertising. To test changes before they go live, Builder makes temporary copies of its database. Only the owner and the coding agents working for them use those copies, so the agents' AI providers (Anthropic and OpenAI) may see that data too. These services may store and process data outside Canada, including in the United States.

• Your data stays while you have a profile, until you ask for it to be deleted.
• Database backups roll off after 35 days. A test copy of the database is deleted when its test ends, and a copy for a development checkout expires seven days after it was last refreshed. Stored files and their backup copies stay until you ask for deletion.
• [Owner: retention for records the law requires, once payments start]

You can ask to see, correct or get a copy of what Builder holds about you, or have it deleted. See how to delete your data. For anything else, email [Contact email]. If you're not happy with the answer, you can complain to the Office of the Privacy Commissioner of Canada.

When this page changes, the date below changes too.

Last updated: [Date]