cbcivil.buildersA5DOpen A5D

LEGAL · VERSION 2026.07.23-r2

Privacy Notice

1. Scope and roles

Civil Builders controls account, website, security, support, subscription-status and business records. For organisation-controlled personal data in Customer Content, the organisation generally acts as controller and A5D as processor under the DPA. Lemon Squeezy independently controls payment transactions.

2. Information and sources

A5D processes account identity, workspace roles, country and regional-eligibility declarations, Customer Content, optional AI interactions, service/security records, limited billing metadata, support communications and consented optional analytics. Data comes from users, Workspace Owners, providers, devices and operational systems. Billing country and, when already supplied by protected infrastructure, a country-level risk signal may be used to check service availability. A5D does not purchase dedicated visitor geolocation for this purpose and does not store full card numbers.

3. Purposes and choices

Data is used to deliver and secure A5D, manage subscriptions, provide requested paid AI, support users, comply with law and improve de-identified reliability. Account and essential security data are required. Optional analytics and marketing are separate choices and are not required for essential access.

4. Customer Content and AI

Workspace Owners control memberships and organisational retention. Users should minimise personal and sensitive data. Supported local command patterns do not send project context to a model. When paid external AI interpretation is configured, A5D sends the prompt and necessary scoped context only to paid Gemini API or Vertex AI. Without that configuration, model-dependent requests fail closed while deterministic features remain available. A5D does not silently use unpaid Gemini. Clearly stored conversation history can be deleted subject to permissions and documented retention exceptions.

5. Payments, analytics and communications

Lemon Squeezy processes checkout, payment method, billing address, tax, invoices, refunds and fraud controls. A5D receives limited entitlement metadata. Optional analytics excludes project names, files, prompts, responses, names and emails and remains off until a valid choice where required. Necessary service messages are distinct from marketing.

6. Sharing and international processing

Information is disclosed to authorised users, listed providers, Lemon Squeezy, confidential advisers, genuine successors and lawful authorities only as necessary. A5D does not sell personal data or use cross-context behavioural advertising. A5D operates from Pakistan and providers may process internationally; regulated transfers require an actually executed lawful mechanism.

7. Retention

Active data is kept for the relationship and required operational purposes. A closed workspace becomes read-only for export and its deletion request is processed through the application and support workflow after identity and authority checks. Provider recovery backups currently expire after seven days. Security, audit, consent, billing and support records may be retained longer where needed for security, accounting, disputes or law. Optional user-level analytics is limited to 14 months where configurable. Legal holds and mandatory retention may delay deletion.

8. Rights, children and incidents

Applicable rights may include access, correction, deletion, restriction, objection, portability, consent withdrawal and complaint. Requests may require identity and authority checks. A5D is not directed to children and under-18s cannot independently register or purchase. Legally required incident notices will be made without undue delay.

9. Changes and contact

Material changes are dated and notified appropriately; a new purpose requiring consent will request it separately. Contact support@civil.builders for privacy requests or complaints.