Privacy policy

Who we are

Business Builder is a Zero to 1 product. Both are run by Founder Progress Ltd, trading as Zero to 1, company number 17333996, registered in England and Wales. Registered office: Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom. We are registered with the Information Commissioner’s Office, reference ZC213772.

We decide how your information is used in Business Builder, so we are responsible for it. Business Builder uses your Zero to 1 account. The Zero to 1 Privacy Notice covers that account and Zero to 1 itself. This policy covers what Business Builder adds.

What we collect, and why

• Your account. Your name, email address, how you sign in (an email code, Google or Apple), your age group, the country where you legally live (and your province or region, for Canada and Ukraine), and your agreement to our terms. When you tell us where you live, we also keep the country Cloudflare reads from your internet connection at that moment, and we compare your saved card’s country with the country you told us. These are checks, not decisions: a difference is looked at by our team, and only a card from a country we cannot serve pauses AI work and hosting until we have checked it. We use all of this to sign you in and to check that Business Builder is open to you.
• Your business and the work on it. Your business’s name, your answers about your skills, your chats with the AI team, briefs and their versions, comments, plans, the files and code of what is built, your uploads, and the settings of your sites and apps. This is the service itself.
• Your Zero to 1 work, only if you say yes. Your Zero to 1 plan, Founder Memory and skill hint, so the AI team starts from what you already know. You can change this answer in Settings.
• Money. Your top-ups, what each AI job and your hosting cost, your balance and its history, your monthly limit, and your card’s brand, last four digits, expiry and country. Stripe holds the full card number; we never see it. We use this to charge you correctly and to keep accounting records.
• Keys you give us. Your own AI keys, the keys you make for services you connect (such as GitHub, GitLab, Atlassian or Stripe) and the secrets your apps need. They are encrypted, used only for your work, never shown again in full and never put in a prompt to an AI.
• If a sponsor pays. Your sponsor sees your name, email, budget, what was used, your stage and your live link. Never your chats, briefs, plans, uploads or keys.
• Your sites’ visitors. What your own sites and apps collect from their visitors, such as a sign-up list, is kept in that site’s own database on our platform. It is yours: we keep it for you and use it for nothing else. You tell your visitors how you use it.
• Technical information. Your IP address and browser details, kept with each signed-in session and in short-lived logs, and a count of requests per IP address to stop misuse. We use it to run, protect and fix the service.
• Abuse reports. What you report on our Report abuse page, and your email only if you give it for a reply.

AI

The AI team runs on models from Anthropic (Claude) and OpenAI. What a job needs, such as your request, the brief, the relevant files and your business’s context, is sent to the provider to get the answer. If you use your own key, the request goes to the provider under your own account with them. The AI suggests and does work you approve. It makes no decisions about you.

The browser companion

The companion is our Chrome extension. It works only on the sites a guide needs, which you allow when the guide starts, and it acts only after you say yes to each step.

• To guide you, it reads the page you are on. Before anything leaves your browser it removes passwords, card numbers, one-time codes and anything that looks like a key. The rest goes to our servers and the AI to work out the next step, and is not kept.
• If you press “I’m stuck”, and only with your permission, it takes a screenshot of that tab, with sensitive fields blurred first, for the AI guide to read. We delete these screenshots after 30 days. No person looks at them.
• We keep a record of each step: what was proposed, your yes and the result. No other page snapshot is stored.
• It never reads your clipboard, and it never types a password, a card number or a one-time code for you.

Our use of information received through the companion complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to guide you, we never sell it, and we never use it for advertising or for anything unrelated to the guide you started.

Who we share it with

• Cloudflare runs Business Builder, its databases and files, and your sites, sends our email, and checks that a person is sending our forms (Turnstile).
• Anthropic and OpenAI run the AI models.
• Stripe takes card payments and holds your card details.
• PostHog decides which accounts can open Business Builder during the test, records when an account is created on Business Builder, and records errors on our servers. For the first it receives your account id and email; for the second, your account id; for an error, your account id, the request path and the first 160 characters of the error message. It works in the EU.
• Google and Apple, if you sign in with them: they confirm who you are and tell us your name and email.
• Services you connect yourself, such as GitHub, GitLab or Atlassian: we use the key you made to reach your own account there, for the work you asked for.
• Your sponsor, only what is listed above, and only if you link one.
• Authorities, only where the law requires it.

We never sell your information. Some of these providers work outside the UK, including in the United States; where they do, we take the steps UK data protection law requires.

How long we keep it

• Your account and your business’s work: while your account is open. Deleting your account deletes your businesses, their files, your keys and your sites.
• Where you live, and the checks on it: until you delete your account.
• Money records: kept after you delete your account, with your name taken off, for as long as the law on accounting records requires.
• “I’m stuck” screenshots: deleted after 30 days.
• Other page snapshots from the companion: not kept.
• Technical logs: up to 7 days.
• A signed-in session’s IP address and browser: until you sign out; or, once the session expires, until it is next used, when it is removed; or until you delete your account.
• Shared briefs: the copy and the share are deleted when the share expires or you end it. A note that it ended is kept, with no content, so the link can say so.
• Abuse reports: the reporter’s email is deleted 90 days after the report is closed. The report itself is kept as the record of what we did.

Your rights

You can ask for a copy of your information, ask us to correct or delete it, to send it to you in a common format, to stop or limit how we use it, or withdraw a permission you gave. You can also complain to the Information Commissioner’s Office (ico.org.uk), or to the data protection authority where you live.

Cookies

Business Builder uses cookies only to sign you in and keep you signed in. When you add a card, Stripe’s payment form sets its own cookies to prevent fraud. There are no analytics or advertising cookies on businessbuild.tech.

Age

Business Builder is for people aged 18 and over.

Changes

This is version 0.1, a draft before legal review. When it changes we publish the new version here with its date, and we tell you in Business Builder before a change to how we use your information.

Contact

Write to us at our registered office above, or use the contact details in the Zero to 1 Privacy Notice.

To report a site we host, use Report abuse.