Legal
Privacy policy
Effective 1 October 2026
1. Who we are
RightBuild is a product roadmap and feature request service for product managers. In this policy, "RightBuild", "we", "us" and "our" mean RIGHTBUILDIO LTD, a company registered in Scotland under company number SC904869, with its registered office at 7 Alder Street, Stewarton, KA3 3EU.
For personal information we collect for our own purposes, such as running our website, managing accounts and billing, we are the data controller.
2. What this policy covers
This policy explains how we handle personal information when you:
- visit rightbuild.io or contact us through our forms
- sign up for and use the RightBuild app
- use an Asks portal that a RightBuild customer runs, for example to raise, vote on or comment on a feature request
- connect an AI assistant to RightBuild through MCP
When our customers add information about their own users and customers to a Workspace, for example the people who raise Asks through their portal, the customer is the controller of that information and we process it on their behalf as a processor. Our handling of that information is governed by our agreement with the customer, including our data processing agreement. If you have a question about information a RightBuild customer holds about you, please contact that customer first.
3. Information we collect
Information you give us
- Account information. Your name, email address and, if you sign in with Google or GitHub, the basic profile information those services share with us.
- Workspace content. Asks, comments, votes, attachments, features, releases, roadmaps, personas, strategy notes, AI memory and anything else you or your team add to RightBuild.
- Billing information. Billing contact details and the plan you choose. Card payments are handled by our payment processor, Stripe. We do not store full card numbers.
- Form submissions. Your name, email address, company and message when you contact us.
- Communications. Emails and support requests you send us, and inbound emails you forward to a Workspace to create Asks.
Information we collect automatically
- Usage and device information. IP address, browser type, device type, pages viewed, actions taken in the app and the date and time of each request.
- Cookies and similar technologies. See our cookie policy. Analytics only runs if you accept it.
Information from others
- Your team. A colleague may invite you to a Workspace by giving us your email address.
- Sign-in providers. Google or GitHub, if you choose to sign in with them.
4. How we use information
We use personal information for the purposes below. Under UK and EU data protection law, we must have a legal basis for each one.
| Purpose | Legal basis |
|---|---|
| Providing the service: creating your account, hosting your Workspace, running the features you use and sending service emails | Performance of our contract with you |
| Billing and managing your subscription | Performance of a contract; legal obligation (tax and accounting records) |
| Answering contact requests | Legitimate interests in responding to inquiries |
| Keeping the service secure, preventing spam and abuse and fixing problems | Legitimate interests in protecting the service and its users |
| Understanding how the website is used through analytics | Consent, which you can withdraw at any time through Cookie settings |
| Improving RightBuild, using aggregated information about how features are used | Legitimate interests in developing our product |
| Sending product news and marketing emails | Consent or, for existing customers, legitimate interests. You can unsubscribe at any time |
| Complying with the law and enforcing our terms | Legal obligation; legitimate interests |
We will never sell your personal information, and we do not use it for third-party advertising.
5. AI features
RightBuild's AI features review Asks, suggest changes, draft roadmap narratives, recommend priorities, map Asks to features and write market research reports. To do this, we send the relevant Workspace content to AI model providers, who process it on our behalf and return the result.
- We do not use your Workspace content to train AI models, and our AI model providers are not permitted to use it to train theirs.
- Market research reports search the public web. The search queries are based on the Ask being researched.
- AI suggestions never change your data until a person accepts them.
- When you connect an AI assistant through MCP, the assistant can read, and on paid plans change, the Workspace data your account can access. Your use of that assistant is also governed by its provider's own terms and privacy policy.
6. Where your data is stored
The RightBuild app and your Workspace data are hosted on Oracle Cloud Infrastructure in Frankfurt, Germany, within the European Union.
Some of our service providers, such as those that deliver our website or provide sign-in, may process limited information in other countries, including the United States. When personal information is transferred outside the UK or the European Economic Area, we rely on an adequacy decision or put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
Enterprise customers can choose the region their data is stored in.
7. Who we share information with
We share personal information only with the service providers we use to run RightBuild, who may use it only to provide their services to us:
| Provider | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | App hosting and data storage | Frankfurt, Germany |
| Cloudflare | Website hosting, content delivery, security and spam protection (Turnstile) | Global network |
| Resend | Sending email, including form submissions and service emails | Europe |
| Anthropic (Claude) | Running AI features | Europe |
| Stripe | Card payments and subscription billing | Europe |
| Google, GitHub | Sign-in, if you choose to use them | United States |
We may also share information:
- with other members of your Workspace, as part of how the service works. For example, your comments are visible to your team, and external comments are visible in the portal
- if required by law, or to protect the rights, property or safety of RightBuild, our customers or others
- with a buyer or successor if RightBuild is involved in a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information
8. How long we keep information
- Account and Workspace data: for as long as your account is active. When an account is closed, we delete its Workspace data straight away. Backups are deleted within 30 days.
- Billing records: for as long as tax and accounting law requires, usually six years.
- Contact requests: for up to 24 months after our last contact with you.
- Server and security logs: for up to 90 days.
9. Security
We protect personal information with technical and organizational measures that include encryption in transit, encryption at rest, access controls that limit staff access to what their role needs, and a record of changes in each Workspace. No service can be completely secure, so if we become aware of a breach that affects your personal information, we will tell you and the relevant authorities as the law requires.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you
- correct information that is wrong or incomplete
- delete your information
- restrict or object to how we use it, including for direct marketing
- receive your information in a portable format
- withdraw consent at any time, where we rely on consent
To use any of these rights, email privacy@rightbuild.io. We will reply within one month. You also have the right to complain to a data protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). In the EU, it is the authority in the country where you live or work.
If you live in California or another US state with a privacy law, you have similar rights to know about, correct and delete your personal information. We do not sell or share personal information for cross-context behavioral advertising.
11. Children
RightBuild is a business service and is not intended for anyone under 16. We do not knowingly collect personal information from children.
12. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and change the effective date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.
13. Contact us
For questions about this policy or your personal information, email privacy@rightbuild.io, write to us at 7 Alder Street, Stewarton, KA3 3EU or use our contact form.