Privacy Policy

1. Who We Are

MD Build provides guided business planning products, including Business Blueprint, at buildbymd.com. We are based in South Africa and sell to customers worldwide.

For any question about your data, contact hello@buildbymd.com.

2. What We Collect

2.1 When you buy something

• Your name and email address
• A record of the purchase: which product, the amount, the date, and the payment reference
• Account credentials, held by our authentication provider — your password is stored hashed and is never visible to us

2.2 When you request the free business plan template

• Your name and email address, and your business name if you choose to give it
• Whether you opted in to hear from us

2.3 When you use a product

• The work you enter into modules, templates and planners. Most of this is stored in your own browser rather than sent to us.
• Basic account activity, such as which products your account has access to

2.4 What we never collect

We do not receive or store your card number, expiry date or security code. Those go directly to Paddle, our payment provider. We do not use advertising cookies, tracking pixels or third-party analytics scripts on this site.

3. Why We Use It

• To give you what you paid for — creating your account, granting access, and letting you sign back in
• To send transactional email — your purchase confirmation and password links
• To provide support — answering your questions and resolving access problems
• To send occasional updates — only if you asked for them, and every such email has an unsubscribe link
• To meet legal obligations — keeping records of sales as required for tax and accounting

Where the UK or EU GDPR applies, our lawful bases are performance of a contract for the first three, consent for marketing email, and legal obligation for record keeping. Where South African law applies, we process your information in line with POPIA.

4. Who Processes Your Data

We keep the list of companies handling your data deliberately short. Each is used for one job:

• Paddle — payment processing and billing. Paddle is the Merchant of Record, so they are the seller on your receipt and hold your payment details under their own privacy policy.
• Supabase — our database and login system, hosting your account and purchase record. Our database is located in Zurich, Switzerland.
• Mailgun — sending transactional email such as receipts and password links. Mailgun processes this in the United States.
• Vercel — website hosting. Standard server request logs are generated as part of serving the site.

We do not sell, rent or trade your personal information to anyone, for any purpose.

5. International Transfers

We are in South Africa, our database is in Switzerland, and our email provider operates from the United States, so your data crosses borders. Where the UK or EU GDPR applies, these transfers rely on the providers' own safeguards, including standard contractual clauses and adequacy decisions where available.

6. How Long We Keep It

• Account and access records — for as long as your account exists, since your access depends on them
• Purchase records — retained as long as tax and accounting law requires, typically five years
• Marketing contact details — until you unsubscribe or ask us to delete them

7. Cookies & Local Storage

We do not use advertising or tracking cookies. The site uses your browser's local storage for two practical purposes:

• Keeping you signed in so you are not asked for a password on every page
• Saving your work in progress in planners and templates, which stays in your own browser

Clearing your browser storage will sign you out and may remove unsaved work held only in your browser.

8. Your Rights

Wherever you live, you can ask us to:

• Show you the personal information we hold about you
• Correct anything that is wrong
• Delete your data, subject to records we must keep by law
• Export your data in a portable format
• Stop marketing at any time, by unsubscribing or emailing us
• Object to or restrict processing in certain circumstances

Email hello@buildbymd.com and we will respond within 30 days. Deleting your account removes your access to purchased products, and we cannot restore it afterwards.

If you are in the UK or EU and are unhappy with how we have handled your data, you may complain to your local supervisory authority. In South Africa, that is the Information Regulator.

9. Security

Your password is stored hashed by our authentication provider and is never visible to us or stored in plain text. Traffic to this site is encrypted in transit. Access to customer records is restricted to accounts on an explicit administrator allowlist, verified on our server rather than in your browser.

No system is perfectly secure. If a breach ever affects your personal information, we will tell you and the relevant authority as the law requires.

10. Children

MD Build products are intended for adults running or starting a business. We do not knowingly collect information from anyone under 18. If you believe a child has given us their details, contact us and we will delete them.

11. Changes to This Policy

If we change this policy materially we will update the date above and, where the change affects how we use your data, tell you by email.

12. Contact

Questions, requests or complaints about your data: hello@buildbymd.com. We aim to reply within two business days.

See also our Terms & Conditions and Refund Policy.