Privacy Policy
Effective: October 3, 2026
Company: Buildtheyear, Inc. ("Buildtheyear," "we," "us," "our")
Contact: privacy@buildtheyear.com
This Privacy Policy covers Buildtheyear's business intelligence service and public tools, including Monday Metrics, Cost of Chaos, Capacity Lite, Health Check, and Yield Card. It explains how we collect, use, disclose, and protect information from people who use these services, wherever they are located.
Public-tool analytics is optional. You can decline and still calculate results, or withdraw through Analytics preferences in each tool. Completed-run storage and PostHog summaries for public tools are currently disabled pending publication and verification of the collection details below.
1) What We Collect & Why
We collect the categories below for the purposes listed.
Public tools: optional analytics and tool improvement
Our free tools calculate results in your browser. With analytics acceptance, Google Analytics receives usage events and selected tool values. Browser analytics may use online identifiers and technical device information. The planned completed-run dataset retains numeric inputs, selected options, relevant event months, and calculated results to understand event-planning patterns and improve our tools; it excludes event names, owner names, written proof points, and uploaded file contents. PostHog receives completion summaries when this collection is enabled. Completed-run storage and PostHog summaries are currently disabled.
You can decline and still use the tools, or change your choice through Analytics preferences. Withdrawal stops new collection and clears identifiers under our control; a request already in flight may finish. Previously collected information can be the subject of a deletion request to privacy@buildtheyear.com. When run storage is enabled, include the tool and run IDs shown in preferences if available. Declining does not erase records already collected. Essential preference storage remembers your choice separately from analytics.
Identifiers
What: name, email, organization, role, IP/device info
Why: account creation and authentication, security, user management, and service communications.
Account & Usage Data
What: app events, settings, feature interactions, access timestamps, crash and performance logs
Why: operating, securing, and improving the Service; debugging; preventing abuse.
Commercial & Billing Data
What: plan, invoices, tax info; card data stays with Stripe
Why: billing, payments, and fraud prevention.
Support Content
What: messages, attachments, error screenshots
Why: troubleshooting and customer success.
AI Conversation Data (ei)
What: messages and prompts you submit to ei (our in-app AI assistant), model responses, and related metadata (timestamps, tool invocations, confidence indicators)
Why: providing AI-assisted analysis of your event portfolio data; improving response quality; enforcing usage limits; and debugging.
Sources: directly from you and your organization; automatically from your use of the Service (e.g., logs, AI conversation history); and from our processors listed below (payments, email delivery, hosting, auth, AI model providers, analytics).
Note: We do not intentionally collect "sensitive personal information" (such as precise geolocation, government IDs, or health information). Do not submit sensitive data to the Service.
2) How We Use Personal Information
- Provide, operate, and secure the Service
- Authenticate users and manage organizations/roles
- Bill for services; detect and prevent fraud/abuse
- Provide support and communicate about updates or outages
- Power AI-assisted features (ei) by sending org-scoped data to our AI model provider for analysis and response generation
- Improve features and performance (aggregated/limited analytics and product usage metrics)
- Comply with law and enforce terms
We use public-tool information to understand tool usage and event-planning patterns and improve the tools. Analytics identifiers and technical information may be personal information; no account or email requirement does not make a run anonymous.
3) Disclosures to Processors (Service Providers)
The processors listed below support the service and public tools. Data may be processed outside your country. Public-tool run collection remains disabled. We will publish the applicable regions, transfer safeguards, retention, and data-sharing arrangements before enabling it. Contact us for the arrangements applicable to your information.
| Processor | What they do | Typical data they process | Notes |
|---|---|---|---|
| Clerk | Authentication & user/organization management (sign-in, sessions, roles) | Identifiers (name, email), org membership/role, auth/session data, IP/device | Used to gate access to Buildtheyear and manage multi-tenant orgs |
| Stripe | Payments, billing, invoicing, refunds, tax | Customer identifiers, plan/price, invoice/payment metadata, last4/brand (card data handled by Stripe) | We do not store full card numbers; Stripe is PCI DSS compliant |
| Postmark | Transactional email (password reset, invites, receipts) | Recipient email, message metadata, templates/variables | We keep minimal delivery logs for troubleshooting (see Retention) |
| Vercel | Hosting for front-end/API; CDN; build logs | IP, HTTP request/response metadata, error/performance logs | Used to route traffic and serve the app quickly and reliably |
| Neon | Managed Postgres database + backups | App data you enter (projects, users' org affiliation, configs), timestamps | Primary data store; backups retained per policy below |
| Anthropic | AI model provider powering ei (in-app AI assistant for event portfolio analysis) | Org-scoped event portfolio context (event names, costs, KPIs, capacity data), user prompts, and conversation messages | Data is sent per-request to generate AI responses; Anthropic processes data under its commercial API terms and does not use customer inputs to train models. If your organization provides its own API key (BYOK), your direct agreement with Anthropic governs that processing |
| Google Analytics | Optional public-tool usage analytics | Usage events, selected tool values, browser analytics identifiers and technical device information | Loaded after acceptance; see Retention and contact us about applicable data-sharing settings |
| PostHog | Product analytics, feature-flag evaluation, and usage metrics | Usage events, feature interactions, page views, analytics identifiers and session metadata; public-tool completion summaries when enabled | Used to measure feature adoption and improve the Service; we minimize personally identifiable data sent to PostHog |
We may disclose information if required by law, to protect rights and safety, or as part of a merger/acquisition. We do not disclose personal information to data brokers.
4) Your Privacy Rights
Depending on your state, you may have the right to access, correct, delete, or obtain a portable copy of your personal information; and to opt out of sale/sharing/targeted advertising. Depending on your location, you may also have rights to restrict processing, object, withdraw consent, or complain to your local data protection authority. Contact us to exercise applicable rights.
How to Exercise Your Rights:
- Submit a request: email privacy@buildtheyear.com
- Verification: we may ask for information to verify your identity/authority
- Timing: we aim to respond within 45 days (extensions as allowed by law)
- Appeals: email privacy@buildtheyear.com with subject "Privacy Appeal" if we deny your request
You may use an authorized agent (we may request proof of authorization and identity). Applicable opt-out and sale/sharing obligations depend on the services and settings in use; contact us for information about exercising these rights. We will not discriminate against you for exercising your privacy rights.
5) Retention
We keep personal information only as long as needed for the purposes above, to comply with law, or to resolve disputes. Then we delete or de-identify it. Current targets:
| Data Category | Examples | Typical Retention |
|---|---|---|
| Public-tool completed runs (first party) | Numeric inputs, selections, event months, calculated results and run identifiers | Collection disabled. Proposed retention: 24 months, covering two annual planning cycles; final deletion and backup details will be published before collection is enabled |
| Public-tool browser analytics (Google Analytics) | Usage events, selected tool values and browser identifiers | Google Analytics retains usage data according to the project's configured settings. Contact us for the current period; this is separate from first-party retention |
| Account profile & org membership (Clerk) | name, email, org/role, session info | While the account is active; contact us for closure and security-backup deletion periods |
| Billing & tax (Stripe) | invoices, payment status, refunds, tax records | 7 years (or longer if required by tax/accounting law) |
| Application data (Neon) | events, templates, settings, assignments, audit timestamps | While the account is active; contact us for closure and backup deletion periods |
| Operational & security logs (Vercel/API) | request logs, IPs, error traces, audit events | As needed for hosting, security and troubleshooting; contact us for specific log-retention periods |
| Email delivery logs (Postmark) | recipient, timestamp, delivery status, message ID | As needed for delivery and troubleshooting; contact us for specific delivery-log and message-retention periods |
| Support records | tickets, attachments, chat/email threads | As needed for support and applicable legal obligations; contact us for the period applicable to your records |
| AI conversation data (ei) | user prompts, AI-generated responses, tool invocations, metadata | Auto-deleted after 90 days; conversations are private within your organization and not visible to other organizations |
| Product analytics (PostHog) | pseudonymized usage events, feature interactions, session metadata | Contact us for the current analytics retention period. Public-tool completion summaries remain disabled until a specific policy is published |
6) Security
We use reasonable administrative, technical, and physical safeguards appropriate to the data and our business (principle of least privilege, encrypted transport, scoped API keys/secrets, and regular access reviews). No system is 100% secure.
7) Children's Privacy
Our Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us and we will delete it.
8) Changes to This Policy
If we make material changes, we'll update the "Effective" date above and provide additional notice where required.
9) State-Specific Information
We apply this policy to the service and public tools. Applicable rights vary by location. Where state law grants additional rights (e.g., California, Colorado, Virginia, Connecticut, Utah, Texas, Oregon), you may exercise them via the process above. We provide an appeals process where required.
Contact Information
For privacy-related questions, requests, or concerns, please contact us at:
Email: privacy@buildtheyear.com
For privacy appeals, use subject line: "Privacy Appeal"